Privacy policy

1. Who the controller is

Data Protection Officer: Alexandru Angheluș, accredited data protection officer – [email protected]. Every request concerning personal data is handled at this address.

2. What this policy covers

It covers the website www.prodefence.ro in both language versions, and the correspondence we receive through the forms, e-mail address and phone number published here.

It does not cover:

• Data processed under service contracts – audits, penetration testing, investigations, NIS2 consulting, training. There, processing is governed by the contract and, where applicable, by a separate data processing agreement in which ProDefence normally acts as processor rather than controller.
• Associated sites with their own documents: cyberaid.eu (educational project).
• Third-party sites linked from our articles.

3. What we process and on what basis

3.1 The contact form

3.2 E-mail, phone or professional-network messages

If you contact us directly, we process the data you send us (name, contact details, role, message content) for the same purpose, on the same basis and with the same retention as in 3.1.

3.3 Server and security logs

3.4 Audience measurement and advertising

3.5 Downloading published materials

Guides and analyses in the research section are downloaded freely. We do not ask for personal data and do not gate downloads behind a form. We only keep a total download count per item.

3.6 Fonts and external page resources

Pages use fonts delivered by Google Fonts. When a page is displayed, your browser requests these files directly from Google’s servers, which transmits your IP address to that provider. The basis is Article 6(1)(f) – our legitimate interest in rendering content correctly and quickly. No cookies are set by this request. We are reviewing a move to self-hosted fonts in order to remove this transfer entirely.

4. What we do not do

• We have no newsletter and send no unsolicited commercial e-mail.
• We do not sell, rent or trade personal data.
• Comments are disabled across the site, so we collect no data through them.
• There are no visitor accounts; we never ask you for a password.
• We build no profiles and take no automated decisions producing legal or similarly significant effects on you, within the meaning of Article 22 GDPR.
• We do not process special categories of data through the site, and we ask you not to send such data through the form.

5. Who else has access

Article 28 GDPR processing terms are in place with every processor. The full list of processors, with their identification details, is available on request.

6. Transfers outside the EEA

Two of the providers above – Google and Cloudflare – may process data on infrastructure located in the United States or other countries outside the EEA. Transfers rely on the European Commission’s adequacy decision for the EU–U.S. Data Privacy Framework, to which both providers are certified, and additionally on the Commission’s standard contractual clauses. You may request a copy of the applicable safeguards at [email protected]. Otherwise, data stays on infrastructure in the European Union.

7. How long we keep data

Specific periods are stated for each category in section 3. The general rule: we keep data for as long as the purpose requires, then delete or anonymise it. Where the law imposes a longer period – accounting and tax archiving, for instance – the statutory period applies.

8. Your rights

• Access – to find out whether we process your data and to receive a copy.
• Rectification – to have inaccurate data corrected or incomplete data completed.
• Erasure – to have data deleted where we no longer have a lawful reason to keep it.
• Restriction – to have processing suspended while we verify a challenge you raise.
• Objection – to object to processing based on our legitimate interest, on grounds relating to your particular situation.
• Portability – to receive your data in a structured, commonly used, machine-readable format.
• Withdrawal of consent, at any time and as easily as it was given, without affecting the lawfulness of processing before withdrawal.
• Not to be subject to automated decision-making, including profiling – noted for completeness: we use no such processes.

How to exercise them

Write to [email protected], preferably with “GDPR” in the subject line, and tell us what you want. No legal wording is needed.

• We respond within one month of receiving the request. For complex or numerous requests the period may be extended by two further months, in which case we tell you within the first month and explain why.
• Exercising your rights is free. We may charge a reasonable fee or refuse only where a request is manifestly unfounded or excessive, particularly because of its repetitive character – and we will say why.
• Where we have reasonable doubts about the identity of the person making the request, we may ask for additional information, strictly limited to confirming who you are.

Right to lodge a complaint

You also have the right to an effective judicial remedy before the competent courts.

9. Personal data in published analyses

Part of the site consists of analyses of fraud campaigns, phishing and malicious software. These materials may contain e-mail addresses, domain names, IP addresses, accounts, phone numbers or screenshots used by attackers – elements that in some cases constitute personal data.

• Publication relies on Article 6(1)(f) GDPR – the legitimate interest in informing the public and preventing fraud – read together with Article 85, which reconciles data protection with freedom of expression and information.
• Data belonging to victims is anonymised or removed before publication.
• Technical indicators are published for identification and defence, not for access. Do not visit them.

If you appear in such material and believe you should not, write to [email protected] with the page address and your explanation. We assess the request and, where your interest overrides the public interest in information, we withdraw or anonymise the information, within the same deadline as any GDPR request.

10. How we secure data

• All traffic to the site is encrypted (HTTPS/TLS).
• The site is protected by an application firewall and network-level filtering of abusive traffic.
• Administration access uses named accounts with unique passwords and two-factor authentication.
• Components are updated regularly; reported vulnerabilities are handled under our responsible disclosure policy.
• Backups are taken weekly and stored separately from the production server.
• Access to data is limited to those who need it for their tasks.

No measure offers an absolute guarantee. Where a personal data breach poses a risk to your rights and freedoms, we notify ANSPDCP within 72 hours under Article 33 GDPR, and where the risk is high we also inform you, under Article 34.

11. Children

The site and the services presented here are addressed to organisations and professionals. We do not knowingly collect data from children under 16 – the threshold set by Article 8 GDPR as applicable in Romania. If we learn that we have received such data without the consent of the holder of parental responsibility, we delete it.

12. Cookies

The cookies used, their duration and purpose are described separately, including in a table verified directly on the site, in the cookie policy. You can change your choice at any time from the consent banner available in the footer of every page.

13. Changes to this policy

We update this document whenever the way we process data or the applicable legal requirements change. The version in force is always the one published on this page, with the version number and date in the header. Substantial changes are announced on the home page for at least 30 days.

Version 2.0 · effective 17 September 2026 · replaces the version of 19 December 2023 · next scheduled review: September 2027.