Privacy policy

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Please send data protection questions to the address above or by email. Whether a data protection officer must be appointed will be checked before launch: [Contact of the data protection officer, if appointed]

Email

support@vallion.eu

Sales

sales@vallion.eu

Phone

[to be added]

When you visit the website, we process technically necessary data transmitted by your browser:

• IP address
• Date and time of access
• Requested address and referring page (referrer)
• Browser and operating system (user agent)
• A random request ID for troubleshooting

The purpose is delivering and securing the website. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and stable operation. Server logs are deleted after [set retention period, e.g. 14 days].

The website sets no tracking or analytics cookies and embeds no advertising or social media services. Fonts are served from our own server; no data is sent to font providers.

After you sign in to the application, we set a technically necessary session cookie (prefix “vallion”). The legal bases are Section 25(2) no. 2 TDDDG and Art. 6(1)(b) GDPR. The session ends after seven days at the latest.

When you send us a request via the contact form, we process the following details:

• Name and business email address
• Company and role
• Number of employees and products
• Your message
• Language of the request

The purpose is handling your request and arranging a demo. The legal bases are Art. 6(1)(b) GDPR (pre-contractual measures) and your consent under Art. 6(1)(a) GDPR, which you can withdraw at any time with effect for the future.

The details are deleted once they are no longer needed to handle your request, at the latest after [set retention period]. Our operational logs store no names or email addresses for requests.

To provide the application, we process account data (name, email address, password hash), organization data and the product, SBOM and notification data you enter. Changes are recorded in the audit log with actor, time, IP address and user agent.

The legal basis is Art. 6(1)(b) GDPR. Where we process content on behalf of our customers, we do so under a data processing agreement pursuant to Art. 28 GDPR.

During the public beta we operate Vallion ourselves. Before launch we will add all recipients and processors here, with purpose and location: [List of processors]

To match against vulnerability databases, we send only package identifiers and versions to public services such as OSV; they contain no personal data.

No transfer of personal data to countries outside the EU and EEA is planned. [Verify against the processors before launch]

We store personal data only as long as needed for the respective purpose or required by statutory retention obligations. Evidence of compliance with the Cyber Resilience Act reporting obligations is kept on behalf of our customers for up to ten years.

You have the right to:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdraw consent with effect for the future (Art. 7(3) GDPR)
• Lodge a complaint with a data protection supervisory authority (Art. 77 GDPR)

Where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).

Providing your data is neither a statutory nor a contractual requirement. Without the required details in the contact form, however, we cannot handle your request; without account data, the application cannot be used.

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

We update this privacy policy when the processing changes. The version published here applies.