Privacy Policy

Last updated: [DATE] · Effective: [DATE]

Template notice. This document is a starting template, not legal advice. Have it reviewed and completed by qualified counsel for your jurisdiction (e.g. GDPR/UK GDPR, CCPA/CPRA) before publishing. Replace every [BRACKETED] placeholder.

This Privacy Policy explains how [Company Legal Name] ("Bastionize", "we", "us") collects, uses, and protects personal data when you use bastionize.com and the Bastionize service (the "Service"). We are the data controller for account data; for assessment data you submit, you are the controller and we act as processor under our Terms of Service and DPA.

1. Data we collect

Account data: name, email, organisation, and authentication details.
Engagement & scan data: targets you enter, engagement metadata (client, scope, testing period, tester), findings produced, and the authorization/audit record for each scan.
Usage & device data: log data, IP address, browser/device information, and product analytics necessary to operate and secure the Service.
Billing data: processed by our payment provider; we do not store full card numbers.
Communications: messages you send to support, sales, or security.

2. How we use data

To provide, maintain, and secure the Service and produce your assessment reports.
To authenticate you and enforce authorization/ownership verification.
To communicate about your account, security, and (with consent where required) product updates.
To comply with legal obligations and prevent abuse of the Service.

3. Legal bases (where GDPR/UK GDPR applies)

Performance of a contract, our legitimate interests in operating and securing the Service, compliance with legal obligations, and your consent where required (e.g. non-essential cookies, marketing). See our Cookie Policy.

4. Sharing & subprocessors

We share data with vetted subprocessors that host and operate the Service (e.g. cloud hosting, database, email, analytics, payments) under contractual data-protection terms. A current subprocessor list is available at privacy@bastionize.com. We do not sell personal data. We may disclose data if required by law.

5. International transfers

Where data is transferred outside your region, we rely on appropriate safeguards such as Standard Contractual Clauses. [Describe hosting regions.]

6. Retention

We retain account data for the life of your account and assessment data per your configuration or contract, then delete or anonymise it. You may request export or deletion at any time.

7. Your rights

Subject to your jurisdiction, you may have rights to access, correct, delete, restrict, or port your data, and to object to certain processing. Contact privacy@bastionize.com. You may also complain to your local data-protection authority.

8. Security

We protect data with encryption in transit, access controls, and the practices described on our Security page. No method of transmission or storage is perfectly secure.

9. Children

The Service is not directed to individuals under 16, and we do not knowingly collect their data.

10. Changes

We will post updates here and, for material changes, notify you through the Service or by email.

11. Contact

[Company Legal Name], [Registered Address] · privacy@bastionize.com · Data Protection Officer / EU-UK representative: [NAME/CONTACT, if applicable].