Data Controller
For the purposes of the GDPR, the data controller in respect of personal data processed via our website, client audits, and takedown operations is:
- SecurVector B.V., registered in the Netherlands
- Operating as a B2B anti-piracy and threat intelligence agency serving enterprise rightsholders
- Contactable at admin@securvector.com for all data protection matters
Where SecurVector processes data on behalf of a client (for example, evidence submitted for a piracy investigation) in a manner directed by that client, SecurVector acts as a processor, and the client remains the controller. A separate Data Processing Agreement (DPA) governs that relationship and takes precedence over this policy for such processing.
Data We Collect
We collect the following categories of personal data, depending on how you interact with us:
| Category | Examples | Source |
|---|---|---|
| Identity & contact data | Name, business email, job title, phone number, employer | Provided directly (contact forms, contracts, audit intake) |
| Account & client data | Login credentials, dashboard activity, billing contact details | Client portal usage |
| Audit & case data | Infringement URLs, IP addresses of suspected infringers, hosting/registrar data, screenshots, timestamps | Client-submitted evidence and our own monitoring tools |
| Technical data | IP address, browser type, device identifiers, log data | Automatically collected via our website and portal |
| Communications | Correspondence with our team, support tickets | Provided directly |
Audit Form Processing
Our anti-piracy audits require clients to submit case-specific information through a dedicated audit intake form. This is treated as a distinct processing activity because it can involve personal data relating to third parties (suspected infringers) rather than only the submitting client.
Rightsholder contact details; descriptions and URLs of allegedly infringing content; technical identifiers (IP addresses, hosting details, marketplace seller IDs) associated with suspected infringers; and any supporting documentation the client chooses to attach.
Data submitted via the audit form is used exclusively to: (i) verify and scope the reported infringement; (ii) prepare and issue takedown notices to hosts, platforms, or registrars; (iii) compile evidence packages for the client's legal use; and (iv) maintain a case record for SLA and reporting purposes. We do not use audit-form data for marketing, and we do not sell it.
Access to audit case data is restricted to analysts assigned to that case and is logged. Where a case escalates to legal or law-enforcement referral, relevant data is shared strictly as described in Section 05.
Legal Basis for Processing
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Performing our contract with a client (audits, takedowns, reporting) | Art. 6(1)(b) — contract performance |
| Investigating and acting on suspected IP infringement, including processing third-party data | Art. 6(1)(f) — legitimate interests (protection of client IP rights) |
| Responding to inquiries, account administration | Art. 6(1)(b) / 6(1)(f) |
| Legal compliance, cooperation with authorities | Art. 6(1)(c) — legal obligation |
| Website analytics and non-essential cookies | Art. 6(1)(a) — consent |
Where we rely on legitimate interests to process data about suspected infringers, we have balanced that interest against the individual's rights and freedoms and concluded it is proportionate to the goal of enforcing legitimate intellectual property rights.
International Transfers
Personal data is primarily processed within the EU/EEA. Where a sub-processor is located outside the EU/EEA, we ensure an adequate level of protection through the European Commission's Standard Contractual Clauses (SCCs), an adequacy decision, or another lawful transfer mechanism recognised under Chapter V GDPR, together with supplementary technical and organisational measures where warranted.
Retention
| Data type | Retention period |
|---|---|
| Client account & contract data | Duration of the relationship, plus 7 years (statutory bookkeeping) |
| Audit case files & evidence | Up to 5 years after case closure, or as required for legal defence |
| Website analytics data | Up to 14 months |
| Support correspondence | Up to 3 years after last contact |
Data is deleted or irreversibly anonymised once the applicable retention period expires, unless a longer period is required by law.
Your Rights under GDPR
Subject to the conditions set out in the GDPR, you have the right to:
- Access — obtain confirmation and a copy of personal data we hold about you
- Rectification — request correction of inaccurate or incomplete data
- Erasure — request deletion of your data, where applicable (this may be limited for active case files or legal retention obligations)
- Restriction — request that we limit processing in certain circumstances
- Data portability — receive data you provided to us in a structured, commonly used format
- Objection — object to processing based on legitimate interests, including profiling
- Withdraw consent — where processing is based on consent, at any time, without affecting prior lawful processing
- Lodge a complaint — with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or your local EU supervisory authority
If you are a suspected infringer named in an audit case, we will handle your rights request in line with our legitimate-interest balancing assessment and applicable exemptions (e.g. Art. 23 GDPR national implementations relating to the enforcement of civil law claims), and may need to consult the instructing client before responding.
To exercise any of these rights, contact us at admin@securvector.com. We will respond within one month, as required by Art. 12(3) GDPR.
Security Measures
Given the sensitivity of the intelligence and evidence we handle, we apply layered technical and organisational measures including encryption in transit and at rest, role-based access control, audit logging, network segmentation, and regular security testing. Access to case data is limited to personnel with a demonstrated need, under confidentiality obligations described in our Terms of Service.
Changes to This Policy
We may update this policy to reflect changes in our practices or legal requirements. Material changes will be notified to active clients by email and posted here with an updated effective date.
Contact
For any question, request, or concern regarding this policy or your personal data, contact: