Privacy policy

1. Controller

The controller within the meaning of Art. 4 (7) GDPR is:

Data protection officer: [Name / external DPO, contact]
Privacy enquiries: [email protected]

2. What this website does not do

• It sets no cookies for visitors and uses no browser storage (localStorage, sessionStorage, IndexedDB) — not even to remember that you closed the sign-up pop-up. The only cookie is the portal's session cookie, set when you log in (see section 7).
• It uses no analytics, tracking pixels, advertising or social-media plugins.
• It loads no third-party scripts. Fonts, images and the hero video are served from this website itself — your browser does not contact Google or any CDN.
• Framework telemetry (Next.js) is disabled.

3. Hosting and server log files

This website is hosted by Railway Corporation, [provider address — see the provider's own imprint / DPA], in the region [hosting region, e.g. EU West]. When you open a page, your browser necessarily transmits technical data that the hosting provider records in server log files:

• IP address of the requesting device
• date and time of the request
• requested page or file, HTTP status code and amount of data transferred
• referrer URL, browser type and version, operating system

This processing is necessary to deliver the website securely and reliably and to detect and defend against attacks. The legal basis is our legitimate interest pursuant to Art. 6 (1) (f) GDPR. Log files are deleted after [retention period, e.g. 14 days] unless they are needed to investigate a specific security incident.

We have concluded a data processing agreement with the hosting provider (Art. 28 GDPR). Where data is processed outside the European Economic Area, this is based on [EU-U.S. Data Privacy Framework certification and/or EU Standard Contractual Clauses] (Art. 44 ff. GDPR).

4. Contacting us

If you contact us by e-mail, we process the data you provide (such as your name, e-mail address and message) to answer your enquiry. The legal basis is Art. 6 (1) (b) GDPR where the enquiry relates to a contract, otherwise our legitimate interest in answering enquiries (Art. 6 (1) (f) GDPR). We delete the data once it is no longer needed, unless statutory retention periods apply.

5. Product updates (newsletter)

If you sign up for product updates, we process your e-mail address to send you news about Verlocx — at most about once a month. The legal basis is your consent (Art. 6 (1) (a) GDPR).

• Double opt-in: after signing up you receive an e-mail with a confirmation link. You are only subscribed once you confirm. Unconfirmed sign-ups are not used for anything else.
• Proof of consent: we store the time of sign-up and confirmation and the wording you agreed to — no IP address, no tracking.
• No tracking in e-mails: our e-mails contain no tracking pixels and no tracked links.
• Withdrawal: you can unsubscribe at any time with the link in every e-mail; withdrawal does not affect the lawfulness of earlier processing. We then delete your address, keeping only a record of the unsubscription where needed to honour it.

6. Demo requests

If you request a demo, we process your name, work e-mail, company, the approximate number of VMs, your hypervisor and your message to answer the request and arrange the demo. The legal basis is Art. 6 (1) (b) GDPR (steps prior to entering into a contract). We delete the request [retention, e.g. 12 months after the last contact], unless it leads to a contract or statutory retention periods apply.

Sign-ups and demo requests are stored in our own database and sent through our own mail server, operated by [database / e-mail provider, location] on our behalf under a data processing agreement (Art. 28 GDPR).

7. Your Verlocx account (portal)

If you create an account at portal.verlocx.com, we process your name, e-mail address, the name of your organization, your password (only as a one-way scrypt hash — we can't read it) and the sites and projects you add. We use this to provide your account and the portal: signing you in, verifying your e-mail, showing your organization's data and sending account e-mails (verification, welcome, security notices) from [email protected]. The legal basis is Art. 6 (1) (b) GDPR (providing the service you signed up for).

• Encryption: your name and e-mail address are stored encrypted with AES-256-GCM; accounts are found by a keyed hash of the e-mail address, not the address itself.
• Session cookie: when you log in, we set one cookie (__Host-verlocx_session) holding a random token that keeps you signed in. It is strictly necessary for the log-in you asked for, so no consent is required (§ 25 (2) no. 2 TDDDG). It can't be read by JavaScript, is only sent over HTTPS to portal.verlocx.com, is deleted when you close your browser or log out, and expires on our side after 12 hours without activity. We store only a hash of the token.
• Retention: account data is kept for as long as your account exists. Unverified sign-ups and expired sessions are removed; to delete your account, write to [email protected].

8. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15)
• rectification of inaccurate data (Art. 16)
• erasure (Art. 17) and restriction of processing (Art. 18)
• data portability (Art. 20)
• object at any time to processing based on our legitimate interests, on grounds relating to your particular situation (Art. 21)

To exercise these rights, contact [email protected]. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), for example the authority responsible for us: [Supervisory authority, address].

9. Changes

We update this policy when the website or the legal requirements change. The current version is always available on this page.