Privacy policy

How Deltus handles personal data. This is a draft for legal review and not yet in force. Everything in brackets is still to be decided.

1. Who is responsible

The controller for your data is [TO FILL: company name and legal form], [TO FILL: address], email [TO FILL].

2. What we collect

Free threat scan form: your name, work email, company, main website, what you sell or run, your brand names and where you have seen fakes.
Dispute form: your name, email, the link to the reported page or account, your role, and why you think the report is wrong.
Emails you send us: your address and whatever you write.
Customer accounts: names and contact details of your team, billing details, your approvals and rules, and the signed authorisation that lets us act as your agent.
Evidence about fake sites and accounts: public web data such as screenshots, page captures, domain registration and hosting data, and public profile or ad details. This can include personal data of the people who run these sites or accounts.
Website visits: technical data your browser sends, such as your IP address. [TO CONFIRM: what our hosting provider logs]

3. Why we use it, and on what legal basis

We only use personal data for the purposes below. The legal bases under Art. 6 GDPR still need legal review.

Sending your free scan and answering messages: [TO CONFIRM: Art. 6(1)(b) or (f) GDPR]
Providing the service to customers: [TO CONFIRM: Art. 6(1)(b) GDPR]
Reviewing disputes about our reports: [TO CONFIRM: Art. 6(1)(f) GDPR]
Collecting evidence about fakes and filing takedowns: [TO CONFIRM: Art. 6(1)(f) GDPR]
Keeping records the law requires, such as invoices: [TO CONFIRM: Art. 6(1)(c) GDPR]

4. Who we share it with

We use service providers who process data on our behalf:

Website hosting: [LIST TO FILL]
Website forms (Framer forms): [LIST TO FILL]
Email: [LIST TO FILL]
Payments and invoicing: [LIST TO FILL]

When we file a takedown, we send the link and our evidence to the host, registrar, platform, payment processor or blocklist responsible for the fake. [TO CONFIRM: international transfers and the safeguards used]

5. How long we keep it

Scan requests and messages: [TO DEFINE]
Disputes: [TO DEFINE]
Customer account data: while you are a customer, then [TO DEFINE]. Invoices for as long as tax law requires. [TO CONFIRM]
Evidence about fakes: [TO DEFINE]

6. Your rights

You can ask us for access to your data, and to correct it, delete it, restrict how we use it, or give it to you in a portable format. You can object to processing that is based on legitimate interests. Where we rely on your consent, you can withdraw it at any time.

To use these rights, write to [TO FILL: contact email].

7. Complaints to a data protection authority

You can complain to a data protection authority. [TO FILL: contact details of the responsible authority]

8. Cookies and analytics

[TO CONFIRM: which cookies or analytics tools this site uses, and whether a consent banner is needed]

9. Changes to this policy

When the way we handle data changes, we update this page and the date at the top.

10. Contact

Questions about privacy: [TO FILL: contact email].