Skip to content

Legal

Privacy policy

Which personal data snapSEC GmbH processes on this website, for what purpose and on which legal basis. In short: as little as possible.

Last updated: November 2026

This is a courtesy translation. The legally binding version is the German Datenschutzerklärung.

This privacy policy explains, in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR), which personal data snapSEC GmbH processes when you visit the website www.snapsec.at, use the contact form or contact us by email or phone. The websites blacklens.io and acdc.onl have their own privacy policies.

At a glance

Data flows on this website in only four ways, and one of them only with your consent. The details are in the sections below.

  1. With every visit

    Viewing a page

    1. Your browser
    2. Cloudflare Workers

    IP address, time, page requested and browser data, to deliver the website and protect it against attacks.

    Art. 6(1)(f) GDPRDetails: Viewing a page

  2. Only when used

    Sending an enquiry

    1. Contact form
    2. Cloudflare Turnstile
    3. Microsoft Azure, Germany
    4. Odoo CRM, Germany

    The details you enter in the form, to handle your enquiry and get in touch with you.

    Art. 6(1)(b) and (f) GDPRDetails: Sending an enquiry

  3. Only after a click

    Watching a video

    1. Click on play
    2. YouTube (Google)

    Only when you press play does your browser load the player from youtube-nocookie.com; Google receives data in the process.

    Art. 6(1)(a) GDPRDetails: Watching a video

  4. Only with consent

    Measuring usage

    1. Cookie banner: “Allow statistics”
    2. Google Tag Manager
    3. Google Analytics 4

    Only after you agree does your browser load Tag Manager; Google Analytics then counts page views, time on page and sources in pseudonymised form.

    Art. 6(1)(a) GDPRDetails: Measuring usage

  5. Not in use

    Advertising tracking · Google Signals · External fonts · Social media plugins

1. Controller

snapSEC GmbH
Asamerstraße 1b
4655 Vorchdorf
Austria

Email: hello@snapsec.at
Phone: +43 720 51 37 07

Further details are in the legal notice. For any data protection question and to exercise your rights, contact us at the email address above.

2. Website delivery and hosting

The website is delivered through Cloudflare Workers, a platform of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. With every page request Cloudflare processes technically necessary data: IP address, date and time, requested address, referrer, browser and operating system. Cloudflare uses this data to deliver the pages and to protect the website against attacks and abuse; for this it may set security cookies (e.g. __cf_bm, 30 minutes).

Cloudflare stores our own server logs (error and operational messages) on our behalf for a few days. If forwarding to our CRM fails, the content of a form request may appear in these logs so that no request is lost. To protect the contact form against abuse, our application also counts in memory, for one minute at a time, how many requests come from an IP address; this count is not stored.

The legal basis is our legitimate interest in a secure and stable website (Art. 6(1)(f) GDPR). Cloudflare processes this data as our processor (Art. 28 GDPR). Cloudflare runs a global network, so data may also be processed outside the EU; Cloudflare, Inc. is certified under the EU-US Data Privacy Framework (adequacy decision under Art. 45 GDPR), and standard contractual clauses apply in addition.

3. Cookies, analytics and fonts

Strictly necessary

When you open the website we do not set any cookies ourselves. Cloudflare's security cookies (section 2) are strictly necessary for operating the website and are permitted without consent under § 165(3) of the Austrian Telecommunications Act 2021. We store your decision in the cookie banner in your browser's local storage (entry snapsec-consent, 180 days); this entry never leaves your browser and is needed so that we can respect your choice. We use no advertising services, social media plugins or tracking pixels. YouTube cookies can only arise once you actively start a video (section 6).

Statistics with Google Analytics (only with your consent)

If you choose “Allow statistics” in the cookie banner, we use Google Analytics 4, loaded through Google Tag Manager, both services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Without your consent your browser loads neither Tag Manager nor Google Analytics; no connection to Google is made, not even in anonymised form. Google Tag Manager itself is a tool for loading measurement scripts and collects no usage data of its own.

Google Analytics sets the cookies _ga and _ga_* (two years) containing a random identifier for your browser and uses it to process, in pseudonymised form: pages viewed, time on page, source (referrer, campaign), events such as scrolling or outbound clicks, browser, operating system, device type and screen resolution, and your approximate location (country, region, city). Google Analytics 4 uses the IP address only to derive the location and does not store it. Google Signals, personalised advertising and sharing with other Google services are disabled; user data is deleted in Google Analytics after 14 months.

The purpose is statistical analysis of how the website is used, so that we can improve content and navigation. The legal basis is your consent (Art. 6(1)(a) GDPR, § 165(3) of the Austrian Telecommunications Act 2021). Google processes the data as our processor (Art. 28 GDPR) under the Google Ads Data Processing Terms; data may be transferred to Google LLC in the USA (section 8). You can withdraw your consent at any time with effect for the future: via (also in the footer of every page) or by deleting the cookies in your browser. On withdrawal we stop measuring and delete this website's Google Analytics cookies. Google's privacy policy (opens an external website) applies to the processing by Google.

Fonts

We serve the font (Poppins) and all icons ourselves. No connection to Google Fonts or other font or content providers is made when you load a page.

4. Contact form

When you submit the contact form, we process the information in the form: name, business email address, company, phone number (optional), topic and message, and your confirmation of the processing. In addition we automatically process the language, the page from which you send the form, the time, your IP address and the browser identifier (user agent). From your email address we derive the domain and note whether it is a business address or one of a free email provider, so that we can route your enquiry correctly.

The purpose is to handle your enquiry and contact you about it. The legal basis is taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR); where no possible contract is concerned, our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). Mandatory fields are required to handle the enquiry; without them we cannot process it. A hidden field serves as a spam trap and stays empty for genuine enquiries.

The form transmits your information encrypted via a service of Microsoft Ireland Operations Limited (Azure Logic Apps, data centre region Germany) to our CRM system Odoo, which we operate on servers of Hetzner Online GmbH in Germany. Both providers process the data as our processors (Art. 28 GDPR). If your enquiry concerns the Active Cyber Defense Center (ACDC), it may be necessary to pass it on to Active Cyber Defense Center Service GmbH, Asamerstraße 1b, 4655 Vorchdorf, Austria, which provides this service (Art. 6(1)(b) and (f) GDPR).

We store your information as long as it is needed to handle your enquiry and a possible business relationship. If a contract is concluded, the statutory retention periods also apply, in particular seven years for accounting records (§ 132 of the Austrian Federal Fiscal Code, BAO).

Spam protection with Cloudflare Turnstile

To protect the form against automated requests we use Cloudflare Turnstile, provided by Cloudflare, Inc. The script is only loaded from challenges.cloudflare.com when you click into the form or submit it; if you do not use the form, no connection to Turnstile is made. Turnstile checks characteristics of your browser and your IP address to tell humans from bots, usually without a visible challenge. The legal basis is our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR); for the transfer to the USA see section 8.

5. Email, phone, appointments and job applications

When you contact us by email or phone, we process your information to answer your enquiry (Art. 6(1)(b) or (f) GDPR). Section 4 applies accordingly to the storage period.

For appointments, such as a blacklens.io demo, we link to the booking page in our Odoo system (odoo.snapsec.at, servers of Hetzner Online GmbH in Germany). There we process your name, your email address and the slot you choose in order to hold the meeting (Art. 6(1)(b) GDPR).

For job applications we link to our job portal jobs.snapsec.at, which we run in our Odoo system (odoo.snapsec.at, servers of Hetzner Online GmbH in Germany). We process applications made through the portal or by email to jobs@snapsec.at to carry out the application process (Art. 6(1)(b) GDPR), and only for as long as necessary for the process and for defending possible legal claims.

6. YouTube videos

On some pages, such as “About us”, we show videos from YouTube, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Before you click, we only show a placeholder served from our own server; no connection to YouTube is made. Only when you click “Play video” does your browser load the player from youtube-nocookie.com (privacy-enhanced mode).

Google then receives your IP address, the address of the page and technical data about your browser. Once the video starts, YouTube may set cookies or similar technologies, for example for playback statistics and fraud prevention, and transfer data to Google LLC in the USA. If you are signed in to Google, Google may associate the request with your account. The legal basis is the consent you give with your click (Art. 6(1)(a) GDPR, § 165(3) of the Austrian Telecommunications Act 2021). It only applies to the video you started; if you reload the page, the video only loads after another click. Google's privacy policy (opens an external website) applies to the processing by Google.

Our website links to other websites, including blacklens.io (also operated by snapSEC GmbH), acdc.onl (Active Cyber Defense Center Service GmbH), our job portal and booking pages on odoo.snapsec.at, our LinkedIn profile and OpenStreetMap for the map link on the contact page. These are plain links: data is only transferred when you click a link and open the provider's website. The provider's privacy policy applies there.

8. Recipients and transfers to third countries

Your data is only accessed by staff who need it for the purposes described and by our processors: Cloudflare (hosting, Turnstile), Microsoft (forwarding of form data), Hetzner (operation of the CRM system) and, only with your consent, Google (Google Analytics, section 3). Enquiries about ACDC may be passed on to Active Cyber Defense Center Service GmbH (section 4). When you play a video, Google receives data as an independent controller (section 6). Data is only disclosed to authorities where we are legally obliged to do so.

Where data reaches Cloudflare, Inc., Google LLC or Microsoft Corporation in the USA, we rely on the European Commission's adequacy decision on the EU-US Data Privacy Framework of 10 July 2023 (Art. 45 GDPR), under which these companies are certified, and additionally on standard contractual clauses (Art. 46(2)(c) GDPR).

9. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent at any time with effect for the future (Art. 7(3)), informally by email.

Right to object (Art. 21 GDPR). Where we process your data on the basis of legitimate interests, you can object at any time on grounds relating to your particular situation. You can object to processing for direct marketing at any time without giving reasons.

If you believe that the processing of your data infringes data protection law, you can lodge a complaint with a supervisory authority (Art. 77 GDPR). In Austria this is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at (opens an external website). We would appreciate it if you contacted us first.

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

10. Data security and changes

All connections to the website are encrypted with TLS. The pages are generated in advance and delivered as static files; without your consent no third-party content is loaded when you open a page. We update this privacy policy when the website, our service providers or the legal situation change. The version published here applies; the date of the last change is shown above the first section of this page.