Privacy policy

1. Controller

The controller for the processing described here is NodeOps Security OÜ, an Estonian private limited company. Postal and registration details are on our legal notice. For any question about this policy or your data, write to info@nodeops-sec.tech.

Given our size we are not required to appoint a Data Protection Officer. Data protection questions are handled directly by the management board.

2. What we collect

2.1 Enquiries you send us

When you use the contact form we receive the name, company, email address, country, enquiry category and message you enter, together with the fact and time of submission. If you email us directly we receive whatever your message and mail headers contain.

Unless you ask for it to be sent in the clear, your browser encrypts all of that to our public key before it is sent, and our web server only ever handles the ciphertext - it is decrypted in the mailbox. If you attach your own public key so that we can reply encrypted, we keep it with the enquiry for as long as we keep the enquiry itself.

2.2 Server log data

Our hosting provider records standard web server logs for every request: IP address, date and time, the resource requested, HTTP status, referring page and browser user agent. These logs are generated by the web server itself and are necessary to operate the site securely and diagnose faults.

2.3 What we do not collect

• No cookies of any kind are set by this website.
• No analytics, tag managers, heatmaps or advertising pixels.
• No fonts, scripts, stylesheets or images loaded from third-party servers or CDNs.
• No social media embeds, share widgets or tracking parameters.
• No profiling and no automated decision-making.

Because nothing is stored on your device and no third party receives data, this site does not require a cookie consent banner.

2.4 Choosing a language

When you open the site at its bare address, the server reads the Accept-Language header your browser already sends with every request and, if your preferred language is one we publish, forwards you to that version. Nothing is stored on your device and no record of the choice is kept beyond the ordinary server log described above. Any explicit address is served exactly as asked, so the language picker always overrides this.

3. Why we process it, and on what legal basis

• Responding to your enquiry - Article 6(1)(b) GDPR, steps taken at your request prior to entering into a contract; and your consent under Article 6(1)(a) GDPR, given via the checkbox on the form. You may withdraw consent at any time, which does not affect processing already carried out.
• Operating and securing the website - Article 6(1)(f) GDPR, our legitimate interest in providing a stable, secure service and preventing abuse. We have assessed this as low impact: log data is not combined with other sources and is not used to identify individuals.
• Preventing form spam - Article 6(1)(f) GDPR. We use a hidden honeypot field and a timing check. No third-party CAPTCHA service is involved, so no data leaves our server for this purpose.
• Meeting statutory obligations - Article 6(1)(c) GDPR, where accounting or commercial law requires records to be kept.

4. How long we keep it

• Enquiries that do not lead to an engagement: deleted within 12 months.
• Enquiries that lead to an engagement: kept for the life of the relationship and then for the statutory retention period under Estonian accounting law.
• Server logs: retained by our hosting provider according to their standard policy, typically a matter of weeks.

5. Who else sees it

We do not sell personal data, and we do not share it for marketing. Data is disclosed only to:

• our hosting provider, which stores the website and processes server logs and form submissions on our behalf under a data processing agreement;
• our email provider, which transmits and stores our correspondence;
• professional advisers or authorities, where we are legally required to disclose.

Separately from the website, the work itself is done from a dedicated server we rent in a datacenter in France. Its provider supplies the machine, its power and its network connection: it holds no account on the system and administers nothing on it. Physical access to the hardware stays with the datacenter, which is the limit of any arrangement of this kind and is worth saying plainly. The disks are encrypted, so hardware that leaves the building - seized, swapped out or retired - leaves as ciphertext. On a machine that is running, the keys are necessarily in memory: encryption at rest answers for the disk, not for the live system.

Our website is hosted by Namecheap, Inc. (United States), on servers located in Europe. Our mailboxes are provided by Proton AG (Switzerland). A data processing agreement is in place with each. The dedicated server we work from is rented from OneProvider (Canada) and stands in a datacenter in France.

6. Requests from authorities

Law enforcement bodies, regulators and courts can compel disclosure. This section sets out what we do when they ask, so that a client does not have to guess.

• We disclose nothing voluntarily. An informal approach - a telephone call, an email asking us to “take a look”, a request that states no legal basis - is declined in writing.
• We act only on a request that is legally binding on NodeOps Security OÜ and that identifies the provision it relies on. A request binding on somebody else is not binding on us.
• We check that it reaches us at all. Where the data sought sits on a client's own systems rather than ours, we say so and direct the request to them.
• We tell the affected client before disclosing anything, unless we are legally forbidden from doing so - and then as soon as that prohibition ends.
• We disclose the minimum the order compels. An order for one document does not open the mailbox it happens to sit in.
• We object, in writing, to requests that are overbroad, defective, or outside the requesting body's jurisdiction.
• We record every request received and how it was handled.

The substantive protection here is not a promise but a design decision: we hold very little. From this website, only the enquiries you send us and our host's server logs. From engagements, no client credentials at all - access runs through named accounts on your own systems, time-boxed and revoked when the work ends. There is correspondingly little that any order could reach.

What this section cannot cover: our hosting and mail providers, and the datacenter that houses the server we work from, can be served directly, under their own jurisdictions and their own policies, and in that event we would not necessarily be told. Anything you would not want reached that way should not travel to us in the clear - the OpenPGP keys on our contact page are there for exactly that.

7. Where the data is held, and transfers outside the EEA

The data described above is stored on servers in Europe. Where a provider is established outside the European Economic Area - as our website host is, being a United States company - that relationship is governed by a data processing agreement relying on an adequacy decision of the European Commission, or on Standard Contractual Clauses together with appropriate supplementary measures.

Switzerland, where our mail provider is established, is covered by an adequacy decision of the European Commission, so no additional transfer mechanism is required for it.

The server we work from stands in France, inside the European Union. The company that rents it to us is established in Canada, which the European Commission has recognised as offering an adequate level of protection for organisations subject to the Canadian federal privacy statute, so no additional transfer mechanism is required there either.

8. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased where no overriding obligation applies;
• restrict processing while a dispute is resolved;
• receive your data in a portable, machine-readable format;
• object to processing based on our legitimate interests;
• withdraw consent at any time, with future effect.

Write to info@nodeops-sec.tech to exercise any of these. We respond within one month. You also have the right to complain to a supervisory authority - in Estonia, the Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) - or to the authority in your own country of residence.

9. How we protect it

The site is served exclusively over HTTPS with HTTP Strict Transport Security. Form submissions are validated and length-limited server-side, and the response headers restrict which content the browser will load. Access to the mailbox receiving enquiries is limited to the people who need it and protected by multi-factor authentication.

Please do not send passwords, private keys, configuration files or client data through the contact form or by ordinary email. If an enquiry requires sensitive material, ask us and we will arrange an appropriate channel.

Encrypted email works in both directions here. Our OpenPGP keys are published on the contact page and through Web Key Directory, so anything sensitive can be encrypted end to end - and we will reply the same way.

10. Changes to this policy

We may update this policy as our services or providers change. The current version is always published here with its revision date. Material changes affecting existing clients will be communicated directly.