Privacy policy

1. Controller

The controller for data processing on this website is:
davque, Musterstraße 1, 10115 Berlin
Email: hello@davque.com

Data protection officer: TODO – appoint if required.

2. Principles of this website

This website is built so that as little personal data as possible arises when you visit it:

• All fonts and graphics are delivered from our own server. No connection is made to Google Fonts or other external networks.
• We do not use cookies for advertising or tracking purposes. That is why no cookie banner appears.
• No social media plugins, chat widgets or external video embeds are active.

3. Server log files

When this website is accessed, technically necessary data is processed: requested address, time, amount of data transferred, status code, referrer as well as browser and operating system information. The IP address is shortened or deleted after TODO days.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and stable operation of the website and in defending against attacks.

4. Contact form and inquiries

If you write to us via the contact form or by email, we process the data you provide – name, work email, company, role as well as your details on the test target and your message – to handle the inquiry.

The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(a) GDPR insofar as you have consented. The data is deleted once handling is complete, unless statutory retention periods prevent this.

To defend against automated submissions we use TODO (Cloudflare Turnstile / Altcha). Details on the provider, the processing and the legal basis are to be added here.

5. Sample report (download)

To send the sample report we process name, work email and company. Sending takes place using the double opt-in procedure: you first receive an email with a confirmation link; only after confirmation do we send the download link.

The legal basis is Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future. To prove consent we store the time and IP address of the sign-up and the confirmation.

6. Newsletter

The newsletter is only sent if you have explicitly requested it. The double opt-in procedure applies here as well. You can unsubscribe via the link in every email. Sending service provider: TODO (EU provider, data processing agreement concluded).

7. Appointment booking

To book intro calls we use TODO (e.g. a self-hosted Cal.com instance). Name, email address and the desired appointment are processed. The legal basis is Art. 6(1)(b) GDPR.

8. Audience measurement

We use TODO (e.g. self-hosted Matomo or Plausible) without cookies and without recognizing individual persons. Only aggregated figures are collected. The legal basis is Art. 6(1)(f) GDPR. If a cookie-based method is used instead, a consent solution is required.

9. Hosting

This website is hosted by TODO (provider, location in the EU). A data processing agreement under Art. 28 GDPR is in place with the provider.

10. Data from customer projects

In the course of commissioned security tests we process data from our customers’ systems. This processing takes place on the basis of the respective contract and – where personal data is concerned – a data processing agreement. The principles are described under Security & trust. No data is transmitted to providers of cloud AI services.

11. Recipients and third-country transfers

Data is only passed on to third parties where this is necessary to perform the contract, you have consented or there is a legal obligation. No transfer to countries outside the EU or the EEA takes place. We provide the current list of processors on request.

12. Your rights

You have the right to:

• information about the data stored about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing based on legitimate interests (Art. 21 GDPR)
• withdraw consent given, with effect for the future (Art. 7(3) GDPR)

An informal message to hello@davque.com is sufficient to exercise them. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). Competent authority: TODO.

13. Changes to this policy

We adapt this policy when the processing or the legal situation changes. The version published on this page applies in each case.