CriticalNew PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619). They allow an attacker to take over a web server.Check your website →
Home / Privacy

Privacy policy.

Draft. Needs a lawyer's review before publishing. The Estonian version is authoritative.

Controller

Streel OÜ (trademark Halden Cybersecurity), registry code 16169089, Pärnu mnt 28-16, 10141 Tallinn. Contact: tere@halden.ee.

What data we collect

  • Forms. Through the contact and follow-up forms: email address and, optionally, name, company, phone, message and domain.
  • Alerts newsletter. Your email address, language (Estonian or English), when you subscribed and confirmed, and a log of which mailings we have sent you. We don't store your IP address with the subscription. We keep this on our own server at Zone.ee in Estonia and send the emails through Zone's mail server. We don't use a third-party newsletter provider.
  • Free email check and website check. We use the domain you enter only to run the check. The check is run by an external scanning service that reads the domain's public DNS records and looks at which services (such as the web and mail server) are open to the internet. For that, the domain is sent to the service, which runs on Modal Labs Inc. servers in the USA. We keep the result for 24 hours so the same domain isn't checked repeatedly; after that it is deleted automatically.
  • Sending a result by email. If you ask us to email a check result, we use your address and the recipient's only to send that email. If the recipient is someone else, you get a copy; one copy stays in our inbox so we can answer questions. We don't add the addresses to any mailing list.
  • Technical logs. Our hosting provider briefly keeps request logs (including IP address) to run the service and prevent abuse.
  • Clients. During a security check we process only what the signed permission covers.

Usage statistics

On our own server we count how many people visit the site, which pages they view, where they come from, and how many checks, requests and orders are made. We use no cookies for this and don't store IP addresses: we tell visitors apart with an identifier computed from the IP address and browser that changes every day, so nobody can be followed from one day to the next. Links in our emails carry a short code (?r=…) that shows which email a click came from. For a check we store the domain checked and the result. We keep this data for 6 months. Basis: our legitimate interest in knowing whether the site and our emails work.

The signature of our emails contains the Halden Cybersecurity logo, loaded from our server. The logo address carries the kind of email (for example a check result or an order confirmation) and, in campaign emails, the email's code. This is how we count how many emails were opened. Here too we store no IP address and use no cookies. If your email app doesn't load images, we don't count the open either.

Cookies

Google Analytics cookies are loaded only if you accept them in the banner. Without your consent nothing is loaded from Google. You can withdraw consent with "Cookie settings" at the bottom of the page. We don't use ad networks. The short code from our emails is never sent to Google.

Why and on what basis

  • Replying to enquiries and preparing a contract: entering into and performing a contract.
  • Newsletter: your consent, which you can withdraw at any time.
  • Service security and abuse prevention: legitimate interest.

Processors

  • Google Ireland Ltd (Google Analytics), only with your consent. Data may be transferred to the USA under the EU–US Data Privacy Framework and the European Commission's standard contractual clauses.
  • External scanning service for the free email and website checks, hosted on Modal Labs Inc. (USA) servers. Only the domain being checked is sent there. Transfers rely on the European Commission's standard contractual clauses.
  • Zone Media OÜ (Estonia) website hosting and email, including delivering form messages to our inbox, keeping newsletter subscribers' data on our server and sending the newsletter.
  • Anthropic the AI service we use to process client security-check results and draft reports. Website visitors' data is not sent there.

Where a processor is outside the European Economic Area, we transfer data under the European Commission's standard contractual clauses or another legal basis.

How long we keep data

  • Enquiries: up to 24 months or until our cooperation ends.
  • Newsletter: until you unsubscribe. When you unsubscribe we delete your address at once and the related mailing log at the next mailing. Unconfirmed sign-ups are deleted after 7 days.
  • Security reports and working files: 12 months unless agreed otherwise.

Your rights

You have the right to know what data we hold about you, to correct and delete it, to restrict processing and to withdraw consent. Write to tere@halden.ee. You can file a complaint with the Estonian Data Protection Inspectorate.