Privacy Policy

Last updated: 2026-09-26

1. Data Controller

Legal Entity: [Company Name - TBD]

Registered Address: [Address - TBD]

VAT Number: [VAT Number - TBD]

Contact: privacy@eurtifact.eu

2. Data We Collect

2.1 Account Information

  • Email address (via SSO authentication)
  • Username (optional)
  • Organization name (for multi-tenant isolation)

2.2 Audit Logs (Pseudonymized)

  • Artifact access events (user ID, not name)
  • API operations (timestamped, user ID referenced)
  • System events (no personal data)

2.3 Technical Data

  • IP addresses (for security monitoring, retained 90 days)
  • Browser user agent (for compatibility)
  • Session tokens (encrypted, expired after 12 hours)

3. Legal Basis for Processing

Contract Performance (GDPR Art. 6(1)(b)): We process your data to provide the Eurtifact artifact registry service as per our Terms of Service.

Legitimate Interest (GDPR Art. 6(1)(f)): Audit logging and security monitoring are necessary for NIS2 compliance and protecting our systems.

4. Data Retention

  • Audit logs: 2 years (NIS2 Article 23 requirement)
  • Account data: Until account deletion requested
  • IP addresses: 90 days
  • Session tokens: 12 hours (absolute timeout)

5. Data Location (EU Sovereignty)

ALL data is stored exclusively in EU regions:

  • Production: Hetzner Falkenstein, Germany (fsn1)
  • Staging: Hetzner Nuremberg, Germany (nbg1)
  • Backups: Hetzner Helsinki, Finland (hel1)
  • No third-country transfers: No data leaves EU jurisdiction

6. Data Sharing

We do NOT sell or share your personal data with third parties.

Sub-processors (GDPR Art. 28):

  • Hetzner Online GmbH: Infrastructure hosting (EU-based, DPA signed)
  • SSO Provider (self-hosted): Identity management (EU-hosted on our infrastructure)

7. Your Rights (GDPR Articles 15-22)

  • Right to Access: Request copy of your data
  • Right to Rectification: Correct inaccurate data
  • Right to Erasure: Request account deletion
  • Right to Data Portability: Export your data
  • Right to Object: Object to data processing

To exercise rights: Email privacy@eurtifact.eu

8. Security Measures (GDPR Art. 32)

  • TLS 1.3 encryption for all communications
  • AES-256 encryption at rest for persistent volumes
  • Multi-factor authentication (TOTP) required
  • Pseudonymized audit logs (user IDs, not names)
  • 2-year immutable audit trail
  • NIS2-compliant incident response procedures

9. Cookies

Essential Cookies Only:

  • Session Token: SSO authentication (12-hour expiry)
  • CSRF Token: Security protection

No tracking or marketing cookies are used.

10. Changes to This Policy

We may update this policy to reflect changes in our practices or legal requirements. Updated policies will be posted with a new "Last updated" date.

11. Contact & Complaints

Data Protection Officer: [DPO Name - TBD]

Email: privacy@eurtifact.eu

Complaints: You have the right to lodge a complaint with your national data protection authority.