Privacy policy
How we collect, use and protect personal data when you visit this website or get in touch with us.
This policy explains how Avus Security S.R.L. processes personal data through this website, in line with Regulation (EU) 2016/679 (the General Data Protection Regulation, or GDPR) and the Italian Personal Data Protection Code (Legislative Decree 196/2003, as amended). It covers this website and the forms on it. The Avus platform, when provided to customers, is covered by separate agreements.
Who is responsible for your data
The data controller is:
For anything about your personal data or this policy, contact our data protection contact, Victor-Catalin Bodiu, CTO, at victor@avussecurity.com.
What we collect
When you contact us or request a demo
Your name, email address, company, role, where you operate, the topics you are interested in, your timeline, and anything you choose to write in your message. We also record which page the form was sent from.
When you apply for a job
Your name, email address, the area you are interested in, any link you share (such as LinkedIn, GitHub or a portfolio), and your message. Please do not include special categories of data, such as health information, in an application.
When you browse the site
- Technical data. Our hosting provider's servers record your IP address, browser type, the page requested and the time, as part of normal operation and security.
- Analytics data, only if you accept. If you accept analytics cookies, Google Analytics collects information about how you use the site, such as pages viewed, time on page, approximate location (country or city), device and browser. Google Analytics 4 does not log or store full IP addresses. Microsoft Clarity also records how you interact with pages, such as clicks, scrolling and mouse movement, as heatmaps and session replays; text you type into forms is masked. See our cookie policy.
- Your cookie choice. We store your accept or reject choice in your browser so we do not ask on every page.
Why we use it, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Replying to your enquiry, arranging a demo, preparing a proposal | Steps you asked us to take before a possible contract, Art. 6(1)(b); and our legitimate interest in answering business enquiries, Art. 6(1)(f) |
| Sending an automatic confirmation that we received your message | Legitimate interest in confirming receipt, Art. 6(1)(f) |
| Considering your job application | Steps you asked us to take before a possible employment contract, Art. 6(1)(b) |
| Keeping the site secure and preventing abuse and spam | Legitimate interest, Art. 6(1)(f) |
| Understanding how the site is used, with Google Analytics and Microsoft Clarity | Your consent, Art. 6(1)(a), which you can withdraw at any time |
| Meeting legal obligations and defending legal claims | Legal obligation, Art. 6(1)(c); legitimate interest, Art. 6(1)(f) |
We do not sell your data, use it for automated decision-making or profiling, or add you to marketing lists because you filled in a form. If we would like to send you marketing, we will ask first.
Who we share it with
We use a small number of service providers who process data on our behalf, under data processing agreements, and only as we instruct:
- Twilio SendGrid (Twilio Inc.), to deliver form notifications to our team and confirmation emails to you.
- Fly.io (Fly.io, Inc.), to host this website. The site is served from the European Union.
- Google Ireland Limited, for Google Analytics, only if you accept analytics cookies. Google signals and advertising features are turned off.
- Microsoft Ireland Operations Limited, for Microsoft Clarity, only if you accept analytics cookies.
- Our email and workspace providers, where your message is received and handled by our team.
We may also disclose data to professional advisers, or to authorities where the law requires it.
Transfers outside the EU
Some of these providers are based in, or use infrastructure in, the United States. Where personal data is transferred outside the European Economic Area, we rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework, for providers certified under it, or on the Commission's Standard Contractual Clauses, together with additional safeguards where needed. You can ask us for more information about these safeguards.
How long we keep it
- Enquiries and demo requests: up to 24 months after our last contact, unless we go on to work together, in which case our contract terms apply.
- Job applications: up to 12 months after the recruitment process ends, so we can consider you for other roles, unless you ask us to delete it sooner.
- Server logs: up to 30 days, unless needed to investigate a security incident.
- Analytics data: up to 14 months in Google Analytics, and up to 13 months in Microsoft Clarity.
- Your cookie choice: 6 months, after which we ask again.
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- have inaccurate data corrected;
- have your data erased;
- restrict how we use it;
- receive it in a portable format;
- object to processing based on our legitimate interests;
- withdraw your consent at any time, without affecting processing done before. For analytics, use the control.
To exercise any of these, email victor@avussecurity.com. We will reply within one month, and may need to confirm your identity first.
You also have the right to lodge a complaint with a supervisory authority. In Italy this is the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma. You can also contact the authority in the EU country where you live or work.
How we protect it
The site is served only over encrypted connections (HTTPS), form data is sent to our own server and delivered by email, and access to it is limited to the people who need it to reply. No method of transmission or storage is completely secure, but we take appropriate technical and organisational measures to protect your data.
Children
This website is intended for businesses and professionals. It is not directed at children, and we do not knowingly collect data from anyone under 18.
Changes to this policy
We may update this policy from time to time. The date at the top shows when it last changed. If a change is significant, we will make it clear on this page.