Privacy policy (landing page and free scan)
Controller: IOSEC Slovakia s. r. o., Mariánska 2222/3, 811 08 Bratislava – mestská časť Staré Mesto, Slovakia, company ID 44517734, VAT ID SK2022758562. Contact: sales@rejekto.eu.
What this site does not do. It uses no cookies, no analytics or advertising tools, no fonts or other third-party resources. Nothing is loaded from other domains.
Theme choice. If you switch the theme, your browser stores the choice on your device (localStorage, key cs-theme). It is not sent to us.
What data we process and why
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| The address of the website you submit for testing | Running the scan and showing the report | Performance of the contract for the free test, which you enter into by accepting the terms of use (Art. 6(1)(b) GDPR) | 7 days, then the report and screenshots are deleted |
| A hash of your IP address (one-way, with a server secret) | Abuse protection: at most 3 scans per hour from one address | Legitimate interest in protecting the service from abuse and overload (Art. 6(1)(f) GDPR) | 24 hours; the IP address itself is neither stored nor logged |
| Your e-mail address, if you enter it | Sending the link to the report | Performance of the contract for the free test (Art. 6(1)(b) GDPR) | 7 days; longer only if you consent to being contacted |
| Your e-mail address, the consent text and the language, if you tick and confirm the consent; the tested website's domain, the date and the score of the test while the report exists | Sending information about the products and services of IOSEC Slovakia s. r. o.: Rejekto website monitoring and data protection services. We never hand the data to agencies or anyone else | Consent (Art. 6(1)(a) GDPR) | Until withdrawn. An unconfirmed consent is deleted after 7 days, the domain, date and score of the test after 7 days with the report |
| A request to withdraw consent: a one-way hash of the e-mail address and the page language | Making sure the owner of the e-mail address asks for the withdrawal (link in the e-mail) | Legitimate interest in verifying the requester, so that nobody else can withdraw the consent (Art. 6(1)(f) GDPR) | 24 hours; after the withdrawal, every consent of the e-mail address is deleted |
| The agency's name and the account owner's e-mail address when registering | Creating the agency account with its trial and signing in to the application | If you register as a sole trader: steps prior to entering into a contract and performance of the contract (Art. 6(1)(b) GDPR). If you create the account for a legal entity: legitimate interest in entering into and performing the contract with the agency you represent (Art. 6(1)(f) GDPR) | An unconfirmed registration 24 hours; after the confirmation while the account exists |
| A record of the registration without the e-mail address: the e-mail's domain, a hash of the connection and the dates | Protection against repeated abuse of the trial | Legitimate interest in protecting the service from abuse (Art. 6(1)(f) GDPR) | 7 days after the registration is confirmed |
Content of the scanned website. The scan records requests, cookies, screenshots and the cookie banner texts of the tested website. This is publicly available content that every visitor sees. Cookie values are stored truncated to 64 characters. If the screenshots or texts contain personal data of other people, such as names shown on the tested website, we process them only as part of the report, based on our legitimate interest in a technical audit of a publicly available page (Art. 6(1)(f) GDPR). The report is available for 7 days at a link with a random identifier; then we delete it together with the screenshots.
Required and voluntary data. The website address is needed to run the scan. The e-mail address and the consent to be contacted are voluntary; the test works without them.
Where the data is. Everything runs on our own infrastructure in the European Union. Scan data is not sent to any third-party service. E-mails are sent by our own server. We do not transfer data to countries outside the European Economic Area.
Who receives the data. Nobody, except where the law requires it.
Automated decision-making. We do not carry out automated decision-making or profiling that would have legal or similarly significant effects on you.
Your rights. You have the right of access, rectification, erasure, restriction of processing and data portability. You can object at any time to processing based on legitimate interest. You can withdraw your consent to be contacted at any time on the Withdraw consent page, via the link in every e-mail or by writing to dpo@iosec.eu. You can lodge a complaint with the Office for Personal Data Protection of the Slovak Republic (dataprotection.gov.sk) or with the supervisory authority in the country where you live or work.
Data protection officer. dpo@iosec.eu
Security. Access to data is restricted, the connection is encrypted (HTTPS), and the process that opens third-party websites runs separately from the database.
Paid plans. For account and billing data, IOSEC is the controller; for the content an agency enters into the application, it is a processor under the data processing agreement.
Changes. We may update this policy. Last changed: 12 Nov 2026. In case of any difference, the Slovak version prevails.