Privacy Policy

1. Data Controller

The controller pursuant to the General Data Protection Regulation (GDPR) and applicable national data protection laws is: SKOPION Intelligence, Inhaber Bartosz Joachimiak, Nobelstraße 3–5, 41189 Mönchengladbach, Germany, email: [email protected] (alternative: [email protected]). Further legal details can be found in our Legal Notice.

2. Categories of Data Collected

• Business contact details (name, organization, corporate email) provided when voluntarily submitting an audit inquiry or direct communication under GDPR Art. 6(1)(b) (pre-contractual measures) and Art. 6(1)(f) (legitimate interest in processing business inquiries and security).
• Questionnaire responses and preliminary screening outcomes are processed locally in your browser. Screening can be completed without providing contact details; responses remain stored locally in your browser unless you voluntarily choose to attach them to an inquiry. When submitting an audit inquiry, answers are transmitted to our compliance specialists only if you explicitly check the corresponding option in the form (legal bases: Art. 6(1)(b) GDPR for preparing audit proposals and Art. 6(1)(a) GDPR via your affirmative selection).
• Technical usage and server access data (e.g. IP address, browser version, access timestamp, routing metadata) collected when requesting portal pages. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in portal stability, cybersecurity, abuse prevention, and error diagnostics).

3. Local Storage & Cookies

This portal utilizes strictly necessary client-side browser storage technologies. Browser Local Storage entries remain stored exclusively on your device: the key 'crasteps_answers_v1' stores questionnaire progress and screening results (cleared via the 'Reset' button or browser cache); the key 'regulatory_storage_ack' stores acknowledgment status of the storage notice (validity limited in code to a maximum of 12 months). A strictly necessary technical cookie is set exclusively to preserve your language preference (cookie name: 'crasteps_locale', retention: maximum 12 months). No advertising, profiling, or third-party tracking cookies are used.

4. Web Analytics & Tracking

No invasive tracking mechanisms, advertising cookies, or third-party analytics services are employed.

5. Hosting, Server Location & CDN

Portal operations and core backend services are hosted on secured VPS instances provided by SOLLUTIUM EU Sp. z o.o. in the AMS-COLO datacenter in the Netherlands (Amsterdam / EEA) under strict technical and organizational measures (TOMs) pursuant to Art. 32 GDPR under a Data Processing Agreement (DPA). To protect against DDoS attacks, enforce TLS security, and accelerate resource delivery, a Cloudflare edge reverse-proxy (Cloudflare Inc.) is deployed. Where technical transit data is routed through Cloudflare edge nodes, this occurs under the EU-U.S. Data Privacy Framework and Standard Contractual Clauses (SCCs) approved by the European Commission (Art. 46 GDPR).

6. Email Communication

When you contact us by email, your details are processed exclusively to respond to your inquiry.

7. Recipients and Categories of Recipients

A. External Recipients and Processors: Data processors engaged pursuant to Art. 28 GDPR include: SOLLUTIUM EU Sp. z o.o. (VPS server infrastructure provider at AMS-COLO datacenter in Amsterdam, Netherlands / EU) and Cloudflare Inc. (edge reverse-proxy, TLS termination, and DDoS mitigation). Your personal data is never sold or disclosed to advertising networks or unauthorized third parties. B. Internal Technical Systems of the Controller: Processing of audit inquiries is conducted directly by authorized SKOPION Intelligence personnel utilizing internal server software: local Mail Transfer Agent (Postfix), local mailbox storage (Dovecot), local file-based inquiry logs, and server operating system security logs.

8. Payment Processing

No financial transactions or payments are conducted on this website.

9. Server Log Files

Server log records are maintained temporarily solely to ensure system stability and mitigate cybersecurity attacks.

10. Retention Periods

• Browser Local Storage: The 'crasteps_answers_v1' entry (questionnaire progress) remains on your device until cleared via the 'Reset' button or browser cache clearing; no automatic server transmission or application expiration is imposed. The 'regulatory_storage_ack' entry (acknowledgment status of the storage notice) has a code-enforced lifespan of at most 12 months, after which the notice is presented again.
• Audit and Consultation Inquiries (Lead Data): The active server inquiry datastore (leads.jsonl and retry_queue.jsonl) is purged of entries older than 30 calendar days via an automated daily system routine (legal bases: Art. 6(1)(b) and Art. 6(1)(f) GDPR). Mailbox communications (Maildir/Dovecot), MTA server logs, and system backups are subject to distinct, documented operational retention and lifecycle policies maintained by the controller.
• Web server and operating system security logs are rotated and retained for threat detection and abuse mitigation for an operational period generally between 14 and at most 30 days.

Backup copies are encrypted and subject to defined lifecycle purge routines.

11. Data Portability

The right to data portability pursuant to Art. 20 GDPR applies where the statutory requirements are met, particularly where processing is carried out by automated means on the basis of consent (Art. 6(1)(a) GDPR) or a contract (Art. 6(1)(b) GDPR).

12. Your Rights under GDPR

Under the GDPR, you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection to processing (Art. 21). Providing personal data is voluntary (screening can be completed without providing contact details; responses remain stored locally in your browser unless you voluntarily choose to attach them to an inquiry). However, submitting an audit consultation inquiry requires a valid business email address and minimum organizational information to process and respond to your request (Art. 13(2)(e) GDPR); without this information, your inquiry cannot be answered. No automated decision-making or profiling under Art. 22 GDPR takes place. You also have the right to lodge a complaint with the competent supervisory authority pursuant to Art. 77 GDPR: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestr. 2–4, 40213 Düsseldorf, Germany, https://www.ldi.nrw.de.