Privacy policy

This policy describes how we process personal data on our website and in the Fixradar portal.

1. Controller

We are currently not legally required to appoint a data protection officer. For any questions about data protection, you can reach us at info@fixradar.tech.

2. Website

2.1 Hosting

The website and portal run on our own server at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in a data centre in Germany. When you access a page, the server processes your IP address, the date and time and the page requested in order to deliver the page to your browser. We do not store access logs with IP addresses permanently; to prevent misuse, the server keeps the IP address in memory for a short time. The legal basis is Art. 6(1)(f) of the General Data Protection Regulation (GDPR), our legitimate interest in secure operation. We have concluded a data processing agreement with Hetzner pursuant to Art. 28 GDPR.

2.2 Cookies, analytics and advertising

The website does not use analytics tools, advertising pixels or cookies. We serve fonts and scripts from our own server; your browser does not connect to Google or other third parties for this. This is why we do not show a cookie banner.

2.3 Demo requests

Via the form on the home page, we receive your name, your business email address, your company and, optionally, your phone number and a message. We use this information to answer your request and prepare the meeting. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures at your request). The request is stored on our server at Hetzner. If no contract is concluded, we delete it after 12 months at the latest. An invisible check field keeps automated spam submissions out; we do not evaluate any data for this purpose.

2.4 Contact by email

If you write to us, we process your details (name, company, contact details, content of the enquiry) in order to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a contract, otherwise Art. 6(1)(f) GDPR. We delete the data once the enquiry has been dealt with and no retention obligations apply. We retain business correspondence for six years pursuant to Section 257 of the German Commercial Code (HGB).

2.5 Sending emails

We send invitations, deadline reminders and replies to enquiries via Brevo GmbH, Köpenicker Str. 126, 10179 Berlin. In doing so, Brevo processes your email address and the content of the message on our behalf on the basis of an agreement pursuant to Art. 28 GDPR.

3. Fixradar portal

3.1 Your company's data: we process it on your behalf

In the portal, we process the data your company enters: products, firmware versions, software bills of materials (SBOMs), vulnerability assessments, draft reports, evidence and the names, job titles and email addresses of the people in the team. Your company is the controller for this data. We act as processor on the basis of the data processing agreement (DPA, German: AVV) pursuant to Art. 28 GDPR that we conclude with every customer.

3.2 Sign-in and account

You sign in with your email address and password and, if you wish, additionally with a code from an authenticator app. We store passwords only as Argon2 hashes. After several failed attempts, we block sign-in for 15 minutes. The legal basis is Art. 6(1)(b) GDPR in conjunction with your company's contract and Art. 6(1)(f) GDPR.

3.3 Strictly necessary cookie

The portal sets a session cookie that keeps you signed in until you sign out, for a maximum of 14 days. Your browser also remembers the display mode you selected (light or dark) in local storage. Both are permitted without consent under Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG).

3.4 Audit log

We log decisions, imports, approvals and recorded submissions with the person and time in a tamper-evident chain. This keeps it traceable for authorities and customers who decided what. The legal basis is Art. 6(1)(c) and (f) GDPR. The log is kept for the term of the contract and deleted together with the customer account.

3.5 Share links and supplier requests

If your company shares evidence via a share link, we log every view with the time and a truncated IP address so that your company can see who opened the evidence. If your company asks a supplier for an SBOM, we send the supplier an email on your company's behalf with a link that is valid for 30 days.

3.6 Public vulnerability databases

For matching, our server queries the NVD (NIST, USA), OSV (Google), CISA KEV (USA), ENISA EUVD and FIRST EPSS databases. In doing so, we only transmit names and versions of software components, no personal data and no information about your company.

3.7 Language model and assistant

For the automatic pre-assessment of vulnerabilities and for the assistant in the portal, we use the language model of Mistral AI SAS, 15 rue des Halles, 75001 Paris, France, with processing in the European Union. For the pre-assessment, we only transmit technical information: component, version, product type and the public description of the vulnerability. For the assistant, we transmit your question, the conversation so far, relevant sections of the help and brief information about the open page. We do not store the conversations; your browser only keeps the history while the page is open. Please do not enter passwords, access credentials or personal data of third parties in the assistant. Mistral does not use this data for training and is listed as a sub-processor in the DPA. At your company's request, Fixradar works purely rule-based without a language model. The legal basis is Art. 6(1)(b) GDPR.

4. Recipients and third countries

We only pass on personal data to the service providers named above who work on our behalf. All of them process the data in the European Union. No transfer to countries outside the EU takes place.

5. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). To exercise these rights, write to us at info@fixradar.tech. If your request concerns data we process on behalf of a customer, we will forward it to that company.

You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach.

6. Automated decision-making

Fixradar suggests assessments and prepares reports. Decisions and submissions are always made by a human. No automated decision-making within the meaning of Art. 22 GDPR takes place.

7. Changes

We update this policy when our services or the legal situation change. The version published here at any given time applies.

Last updated: October 2026