Privacy Notice

Processing contexts

• Website visitors: IP address, request metadata, locale preference, and security events; legitimate interests in delivery and security. Operational log retention is under verification and will be published as a fixed schedule; contact privacy@gosec.cloud for the current period.
• Website measurement (optional, consent only): where the visitor opts in, first-party Matomo analytics processes the full unmasked IP address; the country, region, city, latitude, and longitude derived from it; a visitor and configuration identifier derived from the IP address, user agent, and browser settings with a daily-rotating salt; browser, operating system, device, screen, and language characteristics; referrer; the page URLs and titles visited; on-site actions, searches, and events; visit timings and time on site; returning-visitor counters; and, for AI crawlers, the detected agent name. No cookie is set and no user identifier is recorded. Legal basis: consent under Article 6(1)(a) GDPR with the national provisions implementing Article 5(3) of the ePrivacy Directive; withdrawable at any time through the cookie-settings control. Raw measurement records are deleted 90 days after the visit; aggregated reports derived from them are retained for longer and contain no IP address and no visitor or configuration identifier. The full inventory is in the Cookie and Storage Notice.
• Contact requests and commercial prospects: contact details, organisation, and message; steps at your request or legitimate interests; routine enquiries retained up to 24 months.
• Newsletter subscribers: email, language, consent evidence, confirmation and unsubscribe state; consent; retained until withdrawal plus suppression evidence. Subscription state is stored with the Vianordis website service in France; confirmation and newsletter mail is sent through Microsoft Graph and Exchange Online under the applicable Microsoft processing terms. No claim is made that the entire delivery chain is EU-only.
• Managed-access applicants, testers, contributors, Navigators, design partners, sector Alpha participants, investors, and partners: application, professional, eligibility, and correspondence data; steps at request, contract, consent, or legitimate interests; rejected applications normally retained up to 12 months unless law or consent supports longer retention.
• SaaS users, support, billing, future Forge activity, and security reports: handled under the applicable agreement, DPA, contributor terms, private security process, and legal retention duties. Security-report retention is defined by that private process and incident requirements, not the general contact schedule.

Public-website providers and locations

• GoSec Cloud OÜ: controller and website operator in Estonia.
• Current public website, effective 6 August 2026: an OVHcloud VPS in France provides compute, network, and local database storage. OVHcloud acts as infrastructure subprocessor. GoSec Cloud OÜ administers the server remotely from the EU. Provider support access and any transfer safeguards are governed by the applicable OVHcloud processor terms; this notice makes no broader EU-only support-chain claim.
• Planned managed-service production hosting: provider, regions, hardware, replication, recovery, support access, subprocessors, safeguards, and transfer position remain under selection and will be stated in the signed service schedule before production contracting. This is separate from the current public-website host.
• Matomo Analytics for optional website measurement: the software is self-hosted by GoSec Cloud OÜ at matomo.vianordis.eu on Scaleway infrastructure in the DC5 data centre in Paris, France, with Scaleway as infrastructure subprocessor. Measurement data is not sent to Matomo's own cloud service and is not shared with third parties.
• Microsoft Graph and Exchange Online: transactional contact and newsletter email delivery; processing and transfers follow the applicable Microsoft contractual terms.
• Professional advisers and authorities: only where necessary or legally required. A versioned managed-service subprocessor schedule is supplied with the applicable contract.

Controller and transfers

GoSec Cloud OÜ is controller for website, optional website measurement, contact, newsletter, and applicant processing. The current public website runs on OVHcloud infrastructure in France; future managed-service production hosting remains under selection. Email delivery through Microsoft services is not represented as an EU-only chain. Managed-service processors, support access, locations, safeguards, and transfer position are stated in the applicable DPA and processor schedule.

Sensitive data and sector programmes

The public website and general contact form are not intended for special-category data. Managed services or controlled sector programmes may process categories specified in the applicable customer agreement, DPA, and service schedule. Do not submit passwords, keys, patient data, learner data, or confidential security details through the general form.

Children and Omniscola

Omniscola Alpha participation is contracted with eligible organisations. Early validation uses synthetic data by default. Any later processing involving children requires an approved organisational deployment, defined roles, documented legal basis, and applicable safeguarding controls.

Rights and contact

Where applicable, you may request access, correction, deletion, restriction, portability, or objection, withdraw consent, and complain to the competent supervisory authority. Consent to website measurement can be withdrawn at any time through the cookie-settings control, with no effect on the lawfulness of measurement carried out beforehand. Contact GoSec Cloud OÜ using the details in the Imprint. Required form fields are identified; other fields are optional.