Privacy Notice

This notice explains how we collect and use personal data when you visit our website, contact us, or use our client portal, in line with the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”).

1. Who we are

We are the data controller for the personal data described in sections 2 and 3. For any privacy question or request, write to sudoodt@gmail.com.

2. Contact form, readiness checks and email enquiries

When you use the contact form on our website or write to us, we process:

• your name, work email address and, if you provide them, your company name;
• the topics you select (for example NIS2, SOC 2, ISO 27001) and your message;
• if you request a readiness report (NIS2 or ISO 27001): your answers to the check (for NIS2: sector, company size and assurance level; for ISO 27001: your reason for certification, company size and timeline; plus the ten readiness questions) and the resulting indicative score, which we use to generate your PDF report and email it to you;
• the date and time of your request, and your confirmation that you read this notice.

Purpose: to answer your request and, if you wish, arrange a discovery call and prepare a proposal.
Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in responding to business enquiries (Art. 6(1)(f) GDPR).
Retention: up to 24 months after our last exchange if no engagement follows; if we start working together, the data becomes part of the client relationship (section 3).

We do not use these details for newsletters or marketing campaigns, and we do not store your IP address with your request.

3. Client portal

Our clients' staff use our compliance portal to track controls and upload evidence. For portal users we process account data (name, work email, role, organisation) and activity needed to run the service, such as who changed a control or uploaded a file.

• Account data is processed to provide the portal under our contract with your organisation (Art. 6(1)(b) and (f) GDPR) and is kept for the duration of the contract plus the period needed for legal and audit obligations.
• Assessment answers and evidence files uploaded by a client are processed on that client's behalf and instructions, under the data processing terms of our contract. If such files contain personal data, the client organisation is the controller; please contact them first for requests about that data.

4. Where your data is stored and who processes it

We use the following service providers (processors), bound by data processing agreements:

None of these providers is established in the European Economic Area (Cloudflare and Google are US companies, Supabase is based in Singapore). Where data may be accessed from outside the EEA, transfers are protected by the European Commission's Standard Contractual Clauses included in each provider's data processing terms and, for the US providers, also by the EU–US Data Privacy Framework.

We do not sell personal data and do not share it with third parties for their own marketing.

5. Cookies and similar technologies

Our website does not use advertising or analytics cookies, and our fonts are served from our own servers. To understand which pages are useful, we use Cloudflare Web Analytics: a small script reports aggregated information such as the page visited, the referring site, browser and device type, country and page load times. It sets no cookies, stores nothing on your device, does not fingerprint you and does not track you across sites or over time; we only see totals. We rely on our legitimate interest in running and improving the website (GDPR Art. 6(1)(f)). The site and portal store only what is strictly necessary in your browser: your language choice (English or Romanian), your light/dark display preference and, when you sign in to the portal, your login session. These do not require consent under the ePrivacy rules. If we enable Cloudflare Turnstile spam protection on the contact form, it checks that requests come from a real browser without tracking you across sites.

6. Security

Data is encrypted in transit (HTTPS) and at rest by our providers. Access is restricted by role: clients can only see their own organisation's data, and contact requests are visible only to our administrators.

7. Your rights

Under the GDPR you have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, and to data portability. Where processing is based on consent, you may withdraw it at any time. To exercise any right, email sudoodt@gmail.com; we reply within one month.

You also have the right to lodge a complaint with the Romanian data protection authority, the National Supervisory Authority for Personal Data Processing (ANSPDCP), www.dataprotection.ro, or with the authority in your EU country of residence.

8. Changes to this notice

We may update this notice when our services or legal requirements change. The date at the top shows the latest version.