Privacy notice
What personal data this website handles, why, and what you can ask us to do about it. It covers the marketing site only; the TrustSek app has its own privacy notice.
Last reviewed
Who is responsible for your data
TrustSek is the controller for personal data handled through this website.
For anything about your personal data, write to privacy@trustsek.com. We have not appointed a data protection officer, as the law does not require one for what we do; the privacy address reaches the people who handle these questions. You can also reach us through the contact page.
What this notice covers
This notice covers the public marketing website: the pages you are reading now. When you use the free domain check, or sign up or log in, you leave this site for the TrustSek app at app. followed by our domain. The app is a separate service, and its own privacy notice governs what happens there.
What data we handle
We keep this short on purpose. The website sets no cookies. Fonts, scripts and images are served from our own domain, except the script for our cookieless analytics, which comes from Plausible.
Technical data when you visit. Like any web server, our hosting provider receives your IP address, the page you asked for, the time, your browser's user agent and the referring page, and keeps them in server logs to deliver the site and protect it from abuse.
Instant checks. When you use one of the instant checks on our check pages (DMARC, SPF, security headers, certificate, MTA-STS and DNSSEC), the domain you enter is sent to our server, which reads that domain's public DNS records or connects to its website the way a browser does, and returns the result to your browser. To tell whether DNSSEC is enabled, the domain name is also sent to a public DNS resolver (Cloudflare, with Google as a fallback), as the TrustSek app does. We do not store the domain or the result, and the request carries the domain in its body, not in the address, so it does not appear in server logs.
Visit statistics. On our live website we use Plausible Analytics to count visits. It sets no cookies, uses no local storage and does not store your IP address or other personal data. It records the page you view, the site you came from, your country, your device type and clicks on links to other sites, and counts it when someone submits the free domain check form, without sending the domain. We only see the results as totals.
Speed measurements. On our live website, Plausible also records how quickly each page loads and responds (the Core Web Vitals), as anonymous totals per page. Like the visit statistics, this sets no cookies and identifies no one.
The domain you enter in the free check. The domain check form does not send anything to this website. Your browser takes you straight to the TrustSek app with the domain in the address, and the app runs the check. The app stores the domains that are checked, and the app's privacy notice governs that. A company domain name on its own is usually not personal data, but it can be if it identifies a person, for example a sole trader's own name.
What you send us. The site has no forms. If you email us, for example to ask a question or request a demo, we receive what you choose to write: typically your name, work email address, company and message.
Demo bookings. If you book a demo through the scheduling link, our scheduling provider processes your name, email address, the time you choose and anything you write in the booking, and passes the booking on to us.
Your browser's own storage. The site stores one small value in your browser's session storage so the opening animation plays only once per visit. It contains no personal data and is never sent to us. See the cookie notice.
Why we use it, and our legal basis
| What | Why | Legal basis under the GDPR |
|---|---|---|
| Technical data in server logs | To deliver the website, keep it secure and investigate abuse | Legitimate interests (Article 6(1)(f)): running a secure website |
| Visit statistics and speed measurements | To see which pages are used and where visitors come from, and to keep the site fast | Legitimate interests (Article 6(1)(f)): improving the website, using measurements that store nothing on your device and identify no one |
| Emails you send us and demo bookings | To answer you, arrange a demo and follow up on your request | Legitimate interests (Article 6(1)(f)) in answering business enquiries, or steps taken at your request before a contract (Article 6(1)(b)) |
| Records we must keep by law | To meet accounting and other legal obligations, if an enquiry becomes a customer relationship | Legal obligation (Article 6(1)(c)) |
We do not send marketing emails from this website. We do not sell personal data, and we do not use it for profiling or automated decisions that have legal or similarly significant effects on you.
How long we keep it
- Server logs: kept by our hosting provider, Vercel, for up to 30 days, then deleted.
- Enquiries you email us and demo bookings: kept for 24 months after our last contact, then deleted, unless the enquiry becomes a customer relationship.
- Visit statistics: kept by Plausible only as totals, which contain no personal data.
- Records we must keep by law: kept for the period the law requires.
Who receives it
We share personal data only with service providers that process it on our behalf, under a data processing agreement, and only for the purposes above:
- Vercel Inc., a US company, which hosts the website on its global network and keeps the server logs. Pages are served from the Vercel location nearest to you, and the instant checks run in Stockholm;
- Plausible Insights OÜ, an EU company based in Estonia, which provides our cookieless visit statistics and speed measurements and hosts that data in the EU;
- our email provider, which runs the inboxes that receive your messages;
- our scheduling provider, which handles demo bookings made through the scheduling link.
We may also disclose data when the law requires it, for example to a public authority with a lawful request.
Transfers outside the EEA
The website is hosted by Vercel, a US company, so server logs can be processed outside the European Economic Area. Our email provider and our scheduling provider may also process data outside the EEA. Plausible keeps its data in the EU. Where data leaves the EEA, the transfer relies on the EU–US Data Privacy Framework, for providers certified under it such as Vercel, or on the European Commission's standard contractual clauses. You can ask us for details of the safeguard used at privacy@trustsek.com.
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy;
- have inaccurate data corrected;
- have data erased when there is no longer a reason to keep it;
- restrict how we use it while a question is being resolved;
- object to processing based on legitimate interests;
- data portability for data you gave us, where the processing is based on a contract.
To use any of these rights, write to privacy@trustsek.com. We answer within one month, and we may ask you to confirm your identity first.
Complaints
If you think we handle your personal data wrongly, please tell us first so we can put it right. You also have the right to complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se, or to the supervisory authority where you live or work.
Security
We protect the site the way we would advise anyone to: HTTPS everywhere, strict security headers, and no third-party scripts except the Plausible analytics script. To report a vulnerability, see the security page.
Changes to this notice
We will update this notice when what we do with personal data changes, for example before we add a new service provider. The date at the top of the page shows when it was last reviewed. For significant changes that affect data we already hold, we will tell the people concerned directly where we can.
Related: terms of use and cookie notice.