Privacy Policy

1. Who we are and how to contact us

1.1 Controller. Shards Cybersecurity s.r.o. ("we", "us" or "our") provides Vittnor (the "Service"). We are the controller of the personal data covered by this Privacy Policy. This means that we decide why and how that data is used. Our registered office is Kopčianska 3756/10, 851 01 Bratislava, Slovak Republic. Our company identification number (IČO) is 55151531. We are registered in the Commercial Register of the Municipal Court Bratislava III, Section Sro, Insert No. 166725/B.

1.2 Contact. For privacy questions or requests, email privacy@shardscybersecurity.io or write to our registered office. We have not appointed a data protection officer; please use these contact details for all privacy matters.

1.3 About this Policy. This Policy explains how we collect, use, share and retain personal data, and the rights you have under Regulation (EU) 2016/679 (the General Data Protection Regulation, or "GDPR"). It provides the information required by Articles 13 and 14 of the GDPR. It is not part of our Terms of Service (the "Terms"). Reading or acknowledging this Policy does not mean that you consent to all processing described in it.

2. When this Policy applies

2.1 Our own processing. This Policy applies when you:

a. register an organization, receive an invitation, sign in or use the Service;

b. request verification of an organization or are a user of an organization being verified;

c. are named by a customer as a supplier contact when the customer asks us to find or add that supplier;

d. are a sole trader whose business details appear in the Service’s company directory; or

e. contact us, including through a contact request on Microsoft Marketplace.

2.2 Customer content. Customers may enter supplier records, questionnaires, answers, evidence and messages into the Service. When we process personal data in that content on a customer’s behalf, we act as a processor under our agreement with that customer. The customer decides how that data is used, and its privacy notice applies. Please send requests about customer content to the relevant customer. If you contact us instead, we will assist the customer as required by our agreement and applicable law. Account administration, security and other processing for our own purposes remain covered by this Policy.

3. Personal data we collect and where it comes from

3.1 Categories and sources. Depending on how you interact with us, we process:

a. Account data: your email address, Microsoft account identifier and name, organization memberships and roles, invitations, notifications and sign-in records. We receive this data from you, your organization’s administrators and Microsoft.

b. Registration records: when you accepted the Terms, which version you accepted, and any record that this Policy was presented to or acknowledged by you. We collect these records during registration.

c. Verification data: the identity of the person requesting verification, submitted details and notes, users’ email addresses, and the verification outcome and reasons. We receive this data from the people involved and public business registers.

d. Directory and supplier contact data: business details of sole traders, and supplier contacts’ names and email addresses. We receive this data from public business registers and customers who ask us to find or add a supplier.

e. Technical and security data: IP addresses, request logs and signed-in user identifiers, collected when your device connects to the Service. The registration security check also processes browser and connection signals, such as browser information and connection fingerprints, to distinguish people from automated programs.

f. Communications: your contact details and the content of enquiries and support requests. We receive these from you, or from Microsoft when you ask to be contacted through Microsoft Marketplace.

3.2 IP addresses. We do not store IP addresses in the Service’s application database. We use them briefly to limit repeated requests and protect registration against automated programs. Our hosting and network providers may also record IP addresses in their logs.

3.3 Required information. An email address is required to create and use an account. Without it, we cannot provide an account. If you do not provide information needed for an enquiry or verification request, we may be unable to answer the enquiry or complete verification.

4. Why we use personal data

4.1 Purposes and legal bases. We use personal data for the following purposes:

a. Provide accounts and the Service. We use account and technical data to give you access and operate the Service. If you are personally a party to our contract, the legal basis is performance of that contract (Article 6(1)(b) GDPR). If you use the Service for an organization, the basis is our and your organization’s legitimate interest in providing and using the Service (Article 6(1)(f)).

b. Manage invitations. We use email addresses and invitation records to invite users on an organization’s behalf. Microsoft delivers the invitations. The basis is the organization’s and our legitimate interest in managing access to the Service (Article 6(1)(f)).

c. Verify organizations and maintain the directory. We use verification, directory and supplier contact data to check organizations, prevent impersonation and fraud, keep business entries accurate and identify suppliers requested by customers. The basis is our and our customers’ legitimate interest in a reliable supplier directory and secure business relationships (Article 6(1)(f)).

d. Protect the Service. We use technical data and relevant account records to detect misuse, limit repeated requests and protect network and information security. The basis is our legitimate interest in keeping the Service secure (Article 6(1)(f)).

e. Keep registration records. We record acceptance of the Terms and the version presented, together with any acknowledgement of this Policy. The basis is our legitimate interest in proving contractual arrangements and maintaining accountability records (Article 6(1)(f)).

f. Answer enquiries and provide support. We use contact details and communications to respond to you. The basis is taking steps at your request before entering into a contract with you, or performing that contract (Article 6(1)(b)), where applicable. Otherwise, it is our legitimate interest in communicating with users and prospective customers (Article 6(1)(f)).

g. Meet legal obligations. We use relevant records to handle data protection requests, keep accounting records and respond to legally required notices or requests. The basis is compliance with applicable legal obligations, including the GDPR and Slovak accounting law (Article 6(1)(c)).

h. Handle legal claims. We use relevant records where necessary to establish, exercise or defend legal claims. The basis is our legitimate interest in protecting our legal rights (Article 6(1)(f)).

4.2 Legitimate interests. We rely on legitimate interests only where those interests are not overridden by your interests or fundamental rights and freedoms. You may ask us for information about the balancing assessment. You may also object on grounds relating to your particular situation; see Section 9.1.

4.3 Advertising and automated decisions. We do not sell your personal data or use it for advertising. We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you within Article 22 GDPR. The registration security check is automated; contact us if it blocks you in error. Our personnel make organization verification decisions.

4.4 Data received from others. We use supplier contact details provided by customers only to identify the supplier and set up its directory entry. When we obtain personal data from a customer, an administrator or a public register, we provide the information required by Article 14 GDPR within a reasonable period and no later than one month, or at our first communication or first disclosure if earlier. This does not apply where you already have the information or another lawful exception applies. Public availability alone does not remove this obligation.

5. Who receives personal data

5.1 Service providers. We use the following providers to operate and protect the Service. Where they process personal data on our behalf, they do so under written data processing terms:

a. Microsoft Ireland Operations Limited: hosting in Microsoft Azure Sweden Central, sign-in through Microsoft Entra ID, email delivery and application monitoring.

b. Cloudflare, Inc.: network protection and the registration security check.

5.2 Other users and organizations. Users in your organization can see your email address and roles. Answers and messages shared with other organizations are shown as coming from your organization, rather than identifying you as the sender. This does not remove personal data that you include in the content itself. Verified directory entries are visible to all customers of the Service. For sole traders, these entries include business details listed under the trader’s name.

5.3 Providers’ own processing. Microsoft processes personal data for its own purposes in connection with personal Microsoft accounts and certain business operations, as explained in the Microsoft Privacy Statement. If you use a work or school account, your organization’s privacy notice and account controls may also apply. Cloudflare acts as our processor when providing the registration security check and as a separate controller when using security signals to improve its bot detection, as explained in the Cloudflare Turnstile Privacy Addendum.

5.4 Authorities, advisers and business transfers. We may disclose relevant personal data to courts or public authorities where required by law, and to professional advisers where necessary for advice or legal claims. We may also disclose relevant data to a prospective or actual acquirer or successor in a merger, reorganization or sale of our business, subject to appropriate confidentiality and data protection safeguards.

6. International data transfers

6.1 Where processing takes place. The Service’s application data is hosted in Microsoft Azure Sweden Central in the European Union. This does not mean that all processing stays in the EU or the European Economic Area ("EEA"). Microsoft’s identity, support and global delivery services, and Cloudflare’s global network and security services, may involve processing or access outside the EEA, including in the United States. Microsoft Entra ID’s EU Data Boundary commitments depend on the tenant and service configuration and are subject to documented exceptions. Further details are available in Microsoft’s European data storage documentation.

6.2 Transfer safeguards. Where personal data is transferred outside the EEA, we use a lawful transfer mechanism. This may be an adequacy decision, including the EU–US Data Privacy Framework for transfers covered by a recipient’s active certification. Microsoft Corporation and Cloudflare, Inc. participate in this framework. Where an adequacy decision does not cover a transfer, we rely on the European Commission’s standard contractual clauses in the applicable provider terms, together with additional safeguards where required. You may contact us for information about the relevant transfers and a copy of the applicable safeguards, with confidential information redacted where necessary.

7. How long we keep personal data

7.1 Retention periods and criteria. We keep personal data only for as long as needed for the purposes described in this Policy. The main periods and criteria are:

a. Account data: while you belong to at least one organization in the Service. After your last membership ends, we retain only records still needed for legal obligations, security or legal claims.

b. Registration and verification records: while the relevant organization remains registered in the Service, and afterwards only to the extent needed for legal obligations or legal claims.

c. Supplier contact details: until the customer’s request to identify or add the supplier has been resolved, unless a specific legal obligation or claim requires longer retention.

d. Directory data: while the business entry remains relevant and accurate for the directory’s purpose. We remove or correct data that is no longer needed or is inaccurate.

e. Enquiries and support records: until the enquiry or support matter is resolved, and afterwards only where needed for follow-up, legal obligations or legal claims.

f. Technical logs and backups: technical logs for 90 days, and backup copies for up to 35 days.

g. Accounting records: ten years following the year to which the records relate, where required by Act No. 431/2002 Coll. on Accounting.

7.2 Longer retention and deletion. Where records are needed for legal claims, we retain only the relevant data for the applicable limitation period under Slovak law and, if a dispute arises, until it is resolved. We consider the type of claim, when the limitation period starts and any suspension or extension. When retention is no longer justified, we delete the data or make it anonymous. Backup copies are removed through the applicable backup cycle. Customer content is retained and deleted under the relevant customer agreement, rather than this Policy.

8. How we protect personal data

8.1 Security. We use technical and organizational measures appropriate to the risks of processing to protect personal data against unauthorized access, loss, alteration or disclosure. These include the account access controls, network protection and registration security checks described in this Policy. No online service or storage system can be guaranteed to be completely secure. If you believe your account or personal data has been compromised, contact us promptly using the details in Section 1.2.

9. Your privacy rights

9.1 Your rights. Subject to the conditions and exceptions in the GDPR, you may:

a. Access: ask whether we process your personal data and receive a copy and information about the processing.

b. Correction: ask us to correct inaccurate data or complete incomplete data.

c. Erasure or restriction: ask us to delete your data or limit its use where the GDPR provides this right. We may need to retain some data for legal obligations or legal claims.

d. Portability: receive data you have provided in a structured, commonly used, machine-readable format, and ask us to transmit it to another controller where technically feasible. This applies where processing is automated and based on your consent or a contract with you.

e. Objection: object to processing based on legitimate interests on grounds relating to your particular situation. We will stop that processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims.

9.2 How to make a request. Email privacy@shardscybersecurity.io. We may ask for information reasonably needed to verify your identity. We respond without undue delay and normally within one month of receiving your request. If the request is complex or we receive many requests, we may extend this by up to two further months. We will tell you about the extension and the reasons within the first month. Requests are normally free. For manifestly unfounded or excessive requests, we may charge a reasonable fee or refuse to act, as permitted by the GDPR. If we cannot act on your request, we will explain why and tell you about your complaint and judicial remedy options.

9.3 Complaints. You may complain to the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky), Hraničná 12, 820 07 Bratislava 27, Slovak Republic. You may also complain to the supervisory authority in the EU Member State where you habitually live, work or where the alleged infringement occurred. You do not have to contact us before making a complaint.

10. Browser storage and changes to this Policy

10.1 Browser storage. Our Browser Storage Notice explains the cookies, local storage and similar technologies used by the Service, their purposes and duration, and any choices available to you. It is available at vittnor.com/legal. Where applicable law requires consent for non-essential storage or access, we will ask for it before using those technologies. Acknowledging this Policy is not cookie consent.

10.2 Changes. We update this Policy when our processing practices or legal requirements change. We show the version and effective date at the top. We notify users of material changes in advance by email. Previous versions are available at vittnor.com/legal/privacy/history. If we intend to use personal data for a new purpose, we provide the required information before that further processing begins.