Privacy notice

1. What we process and why

Waitlist. If you join the waitlist, we process your e-mail address, the role you select (e.g. software manufacturer), an optional product count and — if you arrive from the Scope-checker — your result code. Purpose: to inform you about the launch of CRAguard and send you introductory information on the Cyber Resilience Act. Legal basis: your consent (Art. 6(1)(a) GDPR). You may withdraw consent at any time by e-mail; withdrawal does not affect processing carried out before it.

Form security. To prevent abuse (spam) of the form we temporarily rate-limit submissions from the same IP address in server memory only. We do not store the IP address in any database or log. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in protecting the service from spam.

Scope-checker. Your answers are evaluated in your browser. Nothing is sent to our server except an anonymous result code and timestamp (no identifier), used for usage statistics. If you ask for the result by e-mail, the Waitlist section applies.

Server logs. The web server keeps standard access logs (URL, time, status code, truncated IP) for security and operations, retained for at most 30 days.

2. Cookies and tracking

This site uses no third-party cookies. To measure traffic we use Vercel Web Analytics, which sets no cookies and does not identify individual visitors — it processes aggregated data only (page visited, country, device and browser type, referrer); the IP address is used solely to derive the country and is not stored. Legal basis: legitimate interest in measuring site performance (Art. 6(1)(f) GDPR). Only strictly necessary browser storage (e.g. your language choice) is used.

3. Recipients

We do not share data with third parties for marketing. We use processors to operate the service: an EU server infrastructure provider, an e-mail service provider, Cloudflare (attack protection), Vercel Inc. (hosting and traffic measurement; data processed in the EU region) and Resend Inc. (delivery of e-mails from the form). Data is not transferred outside the EU/EEA except under standard contractual clauses.

4. Retention

Waitlist: until launch and the launch notification, at most 24 months from consent, or until consent is withdrawn. Access logs: at most 30 days. Anonymous statistics: indefinitely (contain no personal data).

5. Your rights

You have the right of access, rectification, erasure, restriction, portability, the right to object and the right to withdraw consent. Send requests to info@craguard.eu; we respond within 30 days. You may also lodge a complaint with the Slovak Office for Personal Data Protection (dataprotection.gov.sk) or your local supervisory authority.

6. Changes

We may update this notice; the current version is always on this page. Last updated: 2026-09-02.