Privacy statement

1. Who processes your data Steadia is a service of LoreVault, located at Vogelenzanglaan 2, 3208 AT Spijkenisse, the Netherlands. If you have any questions about this statement or about your data, you can contact us using the contact details provided on our invoices and contact page. We have not appointed a Data Protection Officer. For an organization of this size and with these types of processing activities, this is not required. 2. What data we process From your account: your name, email address, selected language, country, and an encrypted version of your password. Passwords are stored in hashed form and cannot be read by us either. For a business account, additionally: company name, address, postal code, city, and the VAT number you provide, along with the result of the verification and the name registered with the European Commission. For the service itself: the web addresses you have monitored, the results of each check (status code, response time, whether the site was reachable and, if not, why), incidents and their duration, expiration dates of SSL certificates and domain names, and, when scanning for broken links, the pages and links found during the scan. If you run an SEO report, we store the crawled URLs and the issues found. Regarding payments: a customer number and mandate number from our payment service provider, as well as the amounts, dates, and invoices associated with them. Your card details or bank account number do not reach our systems; they remain with Mollie. When you subscribe, we record when you agreed to the terms and conditions and to immediate delivery, which versions of those documents were shown to you at that time, and the IP address and browser information used. This is necessary to be able to demonstrate later what was agreed. When you contact us or submit a support ticket: your name, email address, subject, and the content of your messages. We also keep track of failed login attempts for a short period, linked to your email address and IP address, in order to limit abuse. We do not use advertising networks. For measuring website usage, we use Google Analytics, but only if you give your consent. See Cookies below. The only cookies we place are necessary to keep you logged in and to secure forms; no consent is required for these. 3. Why we process your data and the legal basis For the performance of the agreement: your account, monitoring your sites, sending notifications, SEO reports, and our support. Without this data, we cannot provide the service. To comply with a legal obligation: our invoicing and administration, including VAT treatment and the verification of VAT numbers. Based on a legitimate interest: limiting abuse of login and contact forms, and recording your agreement at the time of purchase so that we can demonstrate what was agreed. We do not process special categories of personal data and do not make decisions based solely on automated processing that significantly affect you. 4. How long we keep your data We keep individual monitoring results for ninety days; after that, they are automatically deleted. Incident overviews are retained, however, so that your history remains useful. We keep invoices and the associated administration for seven years. This is a statutory retention obligation from which we cannot deviate, including upon request. Purchased report credits are valid for twelve months; the administration relating to them is subject to the same retention period as invoicing. We keep your other account data for as long as your account exists. If you delete your account, your sites, monitoring results, reports, and tickets are also deleted. Anything subject to a statutory retention obligation remains stored. 5. Who else receives your data Mollie B.V. (Amsterdam) processes our payments. They receive your name, email address, and the payment details you enter on their page. The European Commission receives the VAT number you provide through the VIES service. This only happens for a business account with a VAT number, and only to verify whether that number is valid. Netcup GmbH hosts the application and database. Brevo sends our emails and receives your email address and the content of the messages we send you for this purpose. We do not sell your data and do not share it with anyone other than those listed above, unless we are legally required to do so. 6. Your rights You have the right to access, correct, or delete your data. You can also request restriction of processing, object to processing based on legitimate interest, and request your data in a commonly used format so that you can take it elsewhere. You can change your name, email address, and business details yourself in your profile. You can also delete your account there; this happens immediately and cannot be undone. For other requests, you can contact us. We will respond within one month. If you disagree with how we handle your data, you can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). 7. Changes If we change this statement, we will publish it as a new version with its own date. Previous versions will remain stored so that it can always be determined which text applied at the time you agreed to it. 8. Cookies Necessary cookies. We always place these cookies, and no consent is required because the service does not work without them. These include a session cookie that keeps you logged in and a cookie that protects forms against abuse. They do not contain information about your browsing behavior and disappear when you log out or close your browser. Analytical cookies. We use Google Analytics 4 to measure how the site is used: which pages are visited, for how long, and through which channel someone arrives. This only happens if you click "Accept" in the notification at the bottom of the page. If you click "Decline", or do nothing, nothing from Google is loaded and no analytical cookies are placed. If you do give consent, Google places two cookies, _ga and _ga_ followed by our measurement ID. Both remain for two years and are used to distinguish returning visitors from one another. We have IP anonymization enabled, which means your IP address is shortened before it is stored. We store your choice in your browser's local storage under the key steadia.analytics-consent.v1. This is not a cookie and is not sent to us; it is only used to prevent you from being asked the same question on every visit. Withdrawing consent. At the bottom of every page there is a "Cookie Preferences" option. This brings the notification back and allows you to decline. From that moment onward, no further measurements are taken. Data that has already been stored by Google can be deleted through Google itself, or by submitting a request to us. Google Analytics is provided by Google Ireland Limited. Google processes the data as our processor under a data processing agreement. Data may be transferred to countries outside the EEA; this is done on the basis of the EU-US Data Privacy Framework.