Privacy Notice
How Defline SRL ("we") handles personal data as a controller under the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) when you visit our website or use an OpenPerimeter account. Personal data inside your organisation's workspace (incident records, evidence, supplier contacts) is processed on your organisation's behalf under the Data Processing Agreement.
1. Contact
Controller: Defline SRL, Sighisoarei 16, Cluj-Napoca, Romania. Privacy questions and requests: [email protected].
2. What we collect and why
| Data | Purpose | Legal basis (GDPR Art. 6) | Kept for |
|---|---|---|---|
| Account data: name, work email, password (stored only as a salted scrypt hash), MFA settings (secret encrypted), organisation memberships and roles | Create and secure your account, sign you in, manage team access | Contract (6(1)(b)); security as legitimate interest (6(1)(f)) | While the account exists, then deleted within 30 days |
How you found us, recorded when you sign up: the campaign tags of the link you arrived with (utm_source, utm_medium, utm_campaign, utm_term, utm_content), the name of the ad network if you came from an ad (its click identifier is discarded) and the host name of the referring website | Understanding which of our marketing brings customers | Legitimate interest (6(1)(f)) | While the account exists, deleted with it |
| Activity in the Service: actions recorded in your organisation's audit trail (who, what, when) | Accountability and evidence for your organisation; security | Contract (6(1)(b)); legitimate interest (6(1)(f)) | As long as your organisation's workspace exists |
| Website and server logs: IP address, country, requested URL, time, browser user agent, referrer | Operate, secure and troubleshoot the Service, detect abuse | Legitimate interest (6(1)(f)) | 30 days |
| Emails we send you: alerts, invitations, incident reminders, service notices | Provide the features you configure; inform you about the Service | Contract (6(1)(b)) | Delivery records kept by our email provider for its standard period |
| Billing data, once billing starts: company details, invoices | Invoicing and accounting | Contract (6(1)(b)); legal obligation (6(1)(c)) | As long as tax and accounting law requires |
The free NIS2 applicability check does not store your answers unless you are signed in and choose to save them; the answers appear in our server logs (30 days) as part of the page address. We do not sell personal data, use it for advertising, or make decisions about you based solely on automated processing.
3. Cookies
We use a strictly necessary session cookie, op_session, that keeps you signed in and protects forms against cross-site request forgery. It expires after 14 days or when you sign out. We also use op_lang, which remembers the language you chose. If you tick “Remember this device” at two-step sign-in, op_device lets that browser skip the code for 30 days; only a hash of it is stored, and you can revoke it on your account page. We use no analytics, advertising or tracking cookies, so no consent banner is needed. Campaign tags are carried along in the page links and saved only if you sign up; nothing is stored in your browser for this. Our content delivery provider may set strictly necessary security cookies to protect the site from attacks.
4. Who receives data
Only the service providers ("sub-processors") we need to run the Service, under contracts that bind them to GDPR standards:
| Provider | Purpose | Location and safeguards |
|---|---|---|
| Amazon Web Services EMEA SARL | Hosting of the application, database and stored files (AWS Lightsail) | EU — Frankfurt, Germany (eu-central-1) |
| Cloudflare, Inc. | DNS, TLS termination, content delivery and DDoS protection for the website | Global edge network; EU Standard Contractual Clauses and EU-US Data Privacy Framework |
| SMTP2GO | Delivery of alert, invitation and notification emails | Sent through the EU region (mail-eu.smtp2go.com); provider based in New Zealand, which has an EU adequacy decision |
We may also disclose data where the law requires it (for example to a court or competent authority), and only to the extent required.
5. International transfers
We host the Service and its data in the European Union (Frankfurt, Germany). Where a provider may process data outside the EEA, the transfer is covered by an EU adequacy decision or the European Commission's Standard Contractual Clauses.
6. Security
Traffic is encrypted with TLS; passwords are hashed; multi-factor authentication is available for every account; integration and MFA secrets are encrypted at rest; access to production systems is restricted and logged; and each organisation's audit trail is hash-chained so changes can be detected.
7. Your rights
You have the right to access your personal data, have it corrected or deleted, restrict or object to processing based on legitimate interest, and receive the data you gave us in a portable format (GDPR Art. 15–21). Write to [email protected]; we answer within one month. For data inside an organisation's workspace, we will pass your request to that organisation, which decides on it as controller.
You may also complain to a data protection supervisory authority. In Romania this is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), www.dataprotection.ro, or the authority where you live or work.
8. Changes
We will post updates here and notify account holders of material changes by email or in the Service before they take effect.
Operator: Defline SRL, Sighisoarei 16, Cluj-Napoca, Romania, trade register no. J12/5570/21/12/2023, VAT RO49325536. Contact: [email protected]. Effective 2026-10-17.