Privacy policy

This is a courtesy translation. The legally binding version is the German Datenschutzerklärung.

This privacy policy explains, in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR), which personal data we process when you visit the blacklens.io website, fill in a form, use the exposure check or contact us. For data that our customers process in the blacklens.io platform we act as a processor; the terms of service and the data processing agreement under Article 28 GDPR apply.

1. Controller

snapSEC GmbH Asamerstraße 1b 4655 Vorchdorf Austria

Email: hello@blacklens.io Phone: +43 720 51 37 07

Further details are in the imprint. For any data protection question and to exercise your rights, contact us at the email address above.

2. Website delivery and hosting

The website is delivered through Cloudflare Workers, a platform of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. With every page request Cloudflare processes technically necessary data: IP address, date and time, requested address, referrer, browser and operating system. Cloudflare uses this data to deliver the pages and to protect the website against attacks and abuse; for this it may set security cookies (e.g. __cf_bm, 30 minutes).

Cloudflare stores our own server logs (error and operational messages) on our behalf for a few days. If forwarding to our CRM fails, the content of a form request may appear in these logs so that no request is lost.

The legal basis is our legitimate interest in a secure and stable website (Art. 6(1)(f) GDPR). Cloudflare processes this data as our processor (Art. 28 GDPR). Cloudflare runs a global network, so data may also be processed outside the EU; Cloudflare, Inc. is certified under the EU-US Data Privacy Framework (adequacy decision under Art. 45 GDPR), and standard contractual clauses apply in addition.

We serve fonts ourselves. No connection to Google Fonts or other font providers is made when you load a page.

3. Cookies and similar technologies

We set necessary cookies without consent because they are strictly required to operate the website or a service you request (§ 165(3) of the Austrian Telecommunications Act 2021). We set all other cookies only with your consent, which you give in the cookie banner and can change or withdraw at any time via the "Cookie settings" link in the footer of every page.

Necessary

• bl_consent (blacklens.io): stores your choice in the cookie banner, 180 days.
• bl_locale (blacklens.io): stores the selected language, 365 days.
• bl_exposure_lead, bl_trial_lead (browser session storage): hand over your entries from the exposure check to the trial or contact form and to the confirmation page, so you do not have to type them again. They are deleted when you close the browser tab.

Statistics (only with consent)

• _ga, _ga_<ID> (Google Analytics 4): distinguish visitors and sessions, up to 2 years.

Marketing (only with consent)

• _gcl_au and other Google Ads cookies: conversion measurement and remarketing, usually 90 days.
• _bl_gclid, _bl_landing, _bl_ref, _bl_utm (blacklens.io): store which ad, campaign or page brought you to us, so that we can attribute a later request to that campaign, 90 days. Without consent this information stays only in your browser's memory and is sent only with a request made during the same visit, without the Google click ID.

4. Google Tag Manager, Google Analytics and Google Ads

We use Google Tag Manager, Google Analytics 4 and Google Ads, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google may transfer data to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework.

Consent mode (Consent Mode v2). Before any Google tag loads, statistics and marketing are denied by default. Only your consent enables the respective category. Tag Manager itself loads with every page view; Google receives your IP address and technical browser data in the process. As long as you have not consented, the Google tags set no cookies and send only cookieless signals without an identifier (e.g. time, page viewed, browser type, consent status), from which Google models statistics. The legal basis for this is our legitimate interest in data-minimising audience measurement (Art. 6(1)(f) GDPR).

Google Analytics 4 (statistics). With your consent we measure page views, button clicks, form steps and the campaign source to improve the website. Google Analytics 4 does not store IP addresses. The legal basis is your consent (Art. 6(1)(a) GDPR).

Google Ads (marketing). With your consent we measure whether a visit via an ad led to a request (conversion measurement) and may show you ads on third-party websites (remarketing). When you submit a form, Tag Manager sends your email address to Google as a SHA-256 hash so that Google can match the conversion to a Google account (enhanced conversions); your address itself does not leave your browser in plain text. If you arrive via a Google ad, we store the Google click ID with your request and later report to Google Ads whether it resulted in a trial or an order. The legal basis is your consent (Art. 6(1)(a) GDPR).

Otherwise, the events we send to Google only contain the domain of your email address and whether it is a business or a private address.

5. Contact, trial, partner and pricing requests

When you submit one of our forms (trial, contact and demo, partner request, pricing request), we process the information in the form: name, business email address, company, domain, phone number (optional), message and topic; for the trial also VAT ID, company size, requested scope and how you heard about us; for pricing requests the selected configuration. In addition we process language, time, IP address, browser identifier (user agent) and the campaign source as described in section 3.

The purpose is to handle your request, set up the trial and contact you about it. The legal basis is taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR) and your consent given in the form (Art. 6(1)(a) GDPR). Mandatory fields are required to handle the request; without them we cannot process it.

The forms transmit your information via a service of Microsoft Ireland Operations Limited (Azure Logic Apps, data centre region Germany) to our CRM system Odoo, which we operate on servers of Hetzner Online GmbH in Germany. Both providers process the data as our processors (Art. 28 GDPR).

We store your information as long as it is needed to handle your request and a possible business relationship. If a contract is concluded, the statutory retention periods also apply, in particular seven years for accounting records (§ 132 of the Austrian Federal Fiscal Code, BAO).

Spam protection with Cloudflare Turnstile. To protect the forms and the exposure check against automated requests we use Cloudflare Turnstile, provided by Cloudflare, Inc. The script only loads when you interact with a form. Turnstile checks characteristics of your browser and your IP address to tell humans from bots, usually without a visible challenge. The legal basis is our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR).

Booking a meeting. For demo and partner calls we link to the booking pages of our Odoo system (odoo.snapsec.at). There we process your name, email address and the selected slot to hold the meeting (Art. 6(1)(b) GDPR).

Email and phone. When you contact us directly, we process your information to answer your enquiry (Art. 6(1)(b) or (f) GDPR).

6. Exposure check

For the free exposure check you enter a business email address. We derive your company's domain from it and query our own analysis service for information about this domain that is publicly visible, such as subdomains, reachable services, known vulnerabilities and hits in leak and dark web sources. Only counts are shown, never individual credentials or people. We run the analysis service on Google Cloud Platform, provided by Google Cloud EMEA Limited, in the Frankfurt am Main region (Germany); Google processes the data as our processor.

We store your email address, the domain, the language and a summary of the result in our CRM system (see section 5) to send you the result and answer questions about it. The legal basis is your consent given in the form (Art. 6(1)(a) GDPR) and the provision of the service you requested (Art. 6(1)(b) GDPR). We only use your address for a newsletter if you subscribe to it separately.

7. Newsletter

When you subscribe to the newsletter, we process your email address, language, time of subscription and the campaign source described in section 3 in our CRM system. The subscription only takes effect once you confirm it via the link in the confirmation email (double opt-in). The legal basis is your consent (Art. 6(1)(a) GDPR, § 174 of the Austrian Telecommunications Act 2021).

You can unsubscribe at any time via the link in every issue or by emailing us. After you unsubscribe we remove your address from the mailing list; we keep the record of your consent as long as we need it to defend against claims (Art. 6(1)(f) GDPR).

8. Links to social networks

Our website links to our profiles on LinkedIn and other services. These are plain links; data is only transferred when you click a link and open the provider's website. The provider's privacy policy applies there.

9. Recipients and transfers to third countries

Your data is only accessed by staff who need it for the purposes described and by our processors: Cloudflare (hosting, Turnstile), Google (Tag Manager, Analytics, Ads and Cloud Platform), Microsoft (forwarding of form data) and Hetzner (operation of the CRM system). Data is only disclosed to authorities where we are legally obliged to do so.

Where data reaches Cloudflare, Inc., Google LLC or Microsoft Corporation in the USA, we rely on the European Commission's adequacy decision on the EU-US Data Privacy Framework of 10 July 2023 (Art. 45 GDPR), under which these companies are certified, and additionally on standard contractual clauses (Art. 46(2)(c) GDPR).

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent at any time with effect for the future (Art. 7(3)): for cookies via "Cookie settings" in the footer, otherwise informally by email.

Right to object (Art. 21 GDPR). Where we process your data on the basis of legitimate interests, you can object at any time on grounds relating to your particular situation. You can object to processing for direct marketing at any time without giving reasons.

If you believe that the processing of your data infringes data protection law, you can lodge a complaint with a supervisory authority. In Austria this is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at. We would appreciate it if you contacted us first.

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

11. Data security and changes

All connections to the website are encrypted with TLS. We update this privacy policy when the website, our service providers or the legal situation change. The version published here applies; the date of the last change is shown at the top of this page.