Privacy Policy

1. Who we are

CyberFence GmbH ("we," "us") is the controller responsible for personal data processed through this website (cyberfence.io).

Contact for privacy questions: contact@cyberfence.io

2. Data Protection Officer

CyberFence is not currently required to appoint a Data Protection Officer under Art. 37 GDPR. Direct any privacy inquiry to the contact above.

3. What we collect, and why

Website visits. Server log data (IP address, browser type, time of access) is processed for security and site stability, under legitimate interest (Art. 6(1)(f) GDPR).

Request a Demo form. Name, company, email, phone (optional), and what you're inquiring about — processed to respond to your inquiry, under Art. 6(1)(b) (steps prior to entering a contract) or Art. 6(1)(f) (legitimate interest in following up on a business inquiry).

Newsletter. If you subscribe, your email address is processed to send you the newsletter, based on your double opt-in consent (Art. 6(1)(a) GDPR) — you'll receive a confirmation email and must click to confirm before you're actually subscribed, as required under German law (§7 UWG) in addition to GDPR. You can withdraw consent and unsubscribe at any time, via the link in every newsletter email or by contacting us directly. We use Brevo (Sendinblue SAS, France) to send the newsletter and manage the subscriber list; see Section 5 for what data Brevo receives.

We do not currently collect any other personal data through this website.

4. Cookies

Necessary cookies. Used only to make the site function (e.g. remembering your cookie preference itself). These don't require consent and can't be switched off without breaking the site.

Analytics. We use Plausible Analytics to understand site traffic. Plausible does not use cookies, does not generate persistent identifiers, and does not collect or store personal data — visits are counted using a daily rotating hash that is discarded after 24 hours. Because no tracking cookie or personal data is involved, this does not require cookie consent under TTDSG §25, and does not appear in the cookie consent banner.

Marketing cookies. As of publication, this site does not use marketing/advertising cookies. If we add one in the future, it will sit behind the consent banner's opt-in gate.

Embedded newsletter form. The signup form on our blog is hosted by Brevo and is not loaded until you click "Load signup form" (or have already allowed embedded third-party content). That click loads Brevo's iframe, which may set its own cookies.

5. Third parties and data recipients

Brevo (Sendinblue SAS, 7 rue de Madrid, 75008 Paris, France) — receives the email address of anyone who subscribes to our newsletter, in order to send it and manage unsubscribes. Brevo acts as our data processor under an Art. 28 GDPR data processing agreement.

Web3Forms — receives whatever you submit through the Request a Demo or Contact form (name, company, email, and your message) in order to deliver it to us by email. Processed under Web3Forms' Data Processing Agreement.

Plausible Analytics (Plausible Insights OÜ, Estonia) — processes site traffic data for analytics purposes without cookies or persistent identifiers, and without collecting personal data. Listed here for transparency, consistent with our own approach to disclosure, even though Plausible states no personal data is retained.

6. International data transfers

Brevo is based in France (EU/EEA), so no international transfer occurs for newsletter data.

Plausible is based in Estonia (EU/EEA) and hosts all data on EU infrastructure, so no international transfer occurs for analytics data.

Web3Forms operates infrastructure across multiple regions (per their own published privacy policy: AWS, Cloudflare, and Hetzner), so this is not an EU-only vendor. Where form submission data is transferred outside the EU/EEA, that transfer relies on Standard Contractual Clauses, as set out in Web3Forms' own Data Processing Agreement.

7. Retention

We retain personal data only as long as necessary for the purpose it was collected for. Request a Demo and Contact form inquiries that don't lead to a client relationship are deleted after 12 months on our own side. Web3Forms' own retention period for the copy they hold is governed by their Data Processing Agreement; please refer to their privacy policy for details.

Where German commercial or tax law requires longer retention for business records, that legal minimum applies instead.

8. Automated decision-making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you.

9. Your rights

Under Arts. 15–21 GDPR, you have the right to access, rectify, restrict, or delete your data, to data portability, to object to processing, and to withdraw consent at any time without affecting the lawfulness of processing carried out before that withdrawal.

10. Right to complain

You may lodge a complaint with your local data protection supervisory authority. For CyberFence, the competent authority is the Berliner Beauftragte für Datenschutz und Informationsfreiheit.

11. Changes to this policy

We'll update this page as our data processing activities change, and update the effective date above accordingly.