DE – Diese Seite auf Deutsch Book a free 20-min test audit
Book a free 20-min test audit

Not yet reviewed by a qualified lawyer; not legal advice.

Privacy policy

1. Controller

, Ireland. CRO no. . Email: via the contact form, phone: . Data protection officer: We have not appointed a data protection officer because we are not required to under Art. 37 GDPR. Our core activities do not consist of processing operations that require regular and systematic monitoring of data subjects on a large scale, nor of large-scale processing of special categories of data (Art. 9) or criminal-offence data (Art. 10). Privacy contact: via the contact form.

2. Hosting and server logs

This website runs on a virtual private server (VPS) that we manage ourselves (IP 151.242.43.164). The server infrastructure is provided by our VPS host, which acts as our processor under Art. 28 GDPR. When you visit a page, the web server processes your IP address, the date and time, the requested URL, the HTTP status, and your user agent. We do this to deliver the site and keep it secure. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation). Server logs (nginx access logs) include your full IP address and are deleted after 14 days unless we need them to investigate a security incident.

3. Audience measurement (cookieless, self-hosted)

Status: active. We use our own cookieless audience measurement, hosted on our own server. The measurement uses no cookies, stores nothing on your device, and involves no third-party analytics service. This website itself sets only one cookie, the strictly necessary security cookie pl_pcsrf (see section 7 "Cookies and browser storage"), which is not used for analytics. Our script (pl.js) sends simple events to our server (/api/hit), where they are stored in our own database. We store: pageview counts per page and page language; the referring domain only (not the full URL); campaign parameters (UTM tags, utm_* only); and, to count unique daily visitors, a pseudonymous hash computed from your IP address, user agent and a random key that is replaced every day (the old key is deleted), so visits cannot be linked across days. No raw IP addresses are stored in this database, and we only evaluate aggregated counts. If your browser sends "Do Not Track" or "Global Privacy Control", no events are sent. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in privacy-friendly, aggregate measurement of website use). Device access: the script stores nothing on and reads no identifier from your device; to the extent any access to your device is assumed, it is strictly necessary to provide the service you requested (§ 25(2) no. 2 TDDDG / Art. 5(3) ePrivacy Directive), so no consent is required. You may object at any time (Art. 21 GDPR; see section 10 "Your rights"), for example by blocking pl.js in your browser or by emailing us; DNT/GPC has the same effect. Retention: analytics data is deleted after 13 months. When you submit a form or leave your details in the chat, we store the entry page, referring domain and campaign of that visit with your enquiry. Same legal basis.

4. Contact form and free check-up form

Contact form fields: name, company, email, service of interest, and project description. Free check-up form fields: name, company, email, target URL, selected checks, notes, and your confirmation that you are authorised to have the target tested. All forms on this website (contact and free check-up) post directly to our own server (/api/contact, /api/free-check) and are stored only in our own database (SQLite) on our server. No third-party form provider is used. No emails are currently sent (no email delivery service is configured). If we enable email notifications or an internal notification channel (e.g. Telegram – currently not configured) in future, we will update this notice and name the provider. We use it to answer your enquiry or carry out the check-up. Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps), plus Art. 6(1)(f) GDPR for business contacts acting for their employer. Required fields are needed to respond. Enquiries and lead data are deleted 24 months after our last interaction with you. Otherwise statutory retention periods apply (e.g. 6 years under Irish tax law, Taxes Consolidation Act 1997, s. 886).

5. Booking a call (Cal.com)

Online calendar booking via Cal.com is not active on this site at the moment. To request a call, use the contact form or free check-up form instead (section 4). If we enable a Cal.com calendar later, we will update this notice. No Cal.com scripts are loaded today.

6. Chat (Assertwise team with AI assistance)

The chat is optional, and we only process data once you use it. The Assertwise team answers the chat, sometimes through a clearly labelled AI assistant. Replies from the AI assistant are always labelled "Assertwise AI assistant" and are never presented as coming from a person or from the team (Art. 50(1) EU AI Act, applicable from 2 August 2026). Replies from our staff show the team member's name or "Assertwise team". You can always ask for a person, or leave a message and we will reply by email. What we process: your chat messages and the earlier messages of the same conversation, a random conversation ID, the page language and timestamps. If you provide them, we also process your name, work email, company and request. Purpose: answering your questions about our services, routing you to a person on request, and handling your enquiry. Human operators: Assertwise staff may read conversations, including those answered by the AI assistant, and may take them over. We do this to check answers, help you and follow up on your enquiry. Staff replies show the team member's name or "Assertwise team". Provider: the AI assistant is operated for us by an external AI service provider (details on request), which acts as our processor (Art. 28 GDPR). If this provider processes data outside the EEA in a country without an EU adequacy decision, the transfer is based on the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Art. 46(2)(c) GDPR); you can request a copy via the contact form. Legal basis: Art. 6(1)(b) GDPR where you ask about an engagement or leave an enquiry; otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering questions about our services efficiently). If you enter your name and email and tick the consent box, we store them with the conversation as an enquiry (Art. 6(1)(a) and (b) GDPR). You can withdraw consent at any time. Retention: chat transcripts are deleted after 90 days. Enquiries are handled as described in section 4. Your IP address is only held briefly in memory for abuse rate limiting and is not stored by the chat function; it is, however, recorded in our general server logs (section 2, 14 days). AI answers may be inaccurate and are not binding offers. Please do not enter passwords, secrets, special categories of data, or your customers' data.

7. Cookies and browser storage (localStorage / sessionStorage)

Cookies. This website itself sets only one cookie: pl_pcsrf (first-party). It is a security token set on every page load to protect the forms, chat and our server endpoints against cross-site request forgery (CSRF). HttpOnly, SameSite=Strict, sent only to /api/, valid for up to 12 hours (Max-Age 43200 s). It contains no personal data and is not used for analytics, advertising or tracking. We use no analytics, advertising or third-party cookies of our own.

Cal.com booking calendar. Not active on this website at present. No Cal.com scripts, cookies or storage are loaded. If we enable booking via Cal.com later, we will update this notice and section 5.

Scripts. Our pages load only our own scripts from our own server: main.js and/or app.js (we are currently updating the site) for site functions such as the menu and the sticky contact button, and pl.js for the cookieless audience measurement described in section 3 "Audience measurement (cookieless, self-hosted)". main.js and app.js store nothing in your browser, set no cookies and make no network requests. No Cal.com or other third-party booking script is loaded at present. Some features store small entries in your browser, only when you use them:

  • plChatBtn / plChatWin (localStorage): the position of the chat button or window, saved only when you drag it. Contains no personal data and stays until you clear your browser storage.
  • plChatId (sessionStorage): a random conversation ID while you chat. Deleted when you close the tab.

8. Free online tools

Browser-only tools (OpenAPI linter, k6 generator, capacity/SLO calculators, results analyser) run entirely on your device, and nothing is sent to us. Server-side checks (API response time, security headers/CORS, SSL/TLS, rate-limit indicator) send the target URL and your authorisation confirmation to our server. Our server sends at most 10 light requests to that URL (User-Agent AssertwiseCheck/1.0). Results are not stored. Your IP address is held in memory for up to one hour for rate limiting. We keep only aggregated daily counts. The AI test-case generator is coming soon and not active yet; no data is processed by it. Once enabled, it will send your text to the external AI service provider described in section 6 to generate the output; neither the input nor the result will be stored by us. Please do not enter personal data. EAA Quick Scan: the page URL you enter (and your authorisation confirmation) is sent to our server. Our server makes one GET request to that URL, plus up to 3 redirects (each re-checked), with User-Agent AssertwiseCheck/1.0, and analyses only the static HTML; no JavaScript from the page is executed. The result is returned to your browser and not stored. Our general server logs (section 2) may record the requested tool URL, including the scanned address; they are deleted after 14 days. You may only scan pages you own or are authorised to test – see section 2 of our terms of use. The DORA readiness self-assessment runs entirely in your browser; your answers are not sent to us or stored. Legal basis: Art. 6(1)(b) and (f) GDPR.

8a. Newsletter and email follow-ups

Current status: not active. No newsletter or follow-up emails are sent yet (no mail delivery configured, Listmonk not installed). This section applies once enabled.

If you subscribe to Assertwise Test Notes, or tick the optional box on a download form (e.g. the DORA testing checklist), we process your email address, optional first name, language, and the time and IP address of your sign-up and of your confirmation click. - Double opt-in: your subscription starts only after you click the link in our confirmation email. We keep the timestamps, IP addresses and the version of the consent text as proof of consent (Art. 7(1) GDPR). - Legal basis: your consent, Art. 6(1)(a) GDPR. The box is never pre-ticked, and downloads never depend on it (Art. 7(4) GDPR). Without it we send no newsletter or follow-up emails. - Withdrawal: you can withdraw at any time with effect for the future (Art. 7(3) GDPR) via the unsubscribe link in every email or by writing to us (section 1). - Tool: self-hosted Listmonk on our own server; no external newsletter provider and no additional processor. - Retention: until you unsubscribe. Unconfirmed sign-ups are deleted after 30 days. If you only requested a download (e.g. the DORA checklist) without confirming the newsletter, your address is deleted 30 days after delivery. After unsubscribing we may keep your address in a block list only to respect your objection.

9. Fonts and third parties

All fonts (Inter, JetBrains Mono) are self-hosted, and no connection is made to Google Fonts or similar services. No other third-party content is embedded. Recipients of personal data: our hosting provider, an email provider (none at present), the external AI service provider operating the chat (see section 6) and, after your click, Cal.com. Audience measurement and country lookup (local DB-IP database) run on our own server with no third party. All except Cal.com act as processors.. Data we access during client testing engagements is governed by a separate data processing agreement (Art. 28 GDPR).

10. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), and data portability (Art. 20). You may withdraw consent at any time (Art. 7(3)). Right to object (Art. 21): you may object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR. We do not use automated decision-making under Art. 22 GDPR. You may lodge a complaint with a supervisory authority (Art. 77), in particular in the EU member state where you live or work or where the alleged infringement took place. Our lead supervisory authority is the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland, www.dataprotection.ie. Contact for requests: .

11. Security

This site uses TLS encryption (HTTPS).