1. Controller
The controller of personal data collected through this website is Kartia IKE, a private company (Ιδιωτική Κεφαλαιουχική Εταιρεία) registered in Greece, Dorylaiou 10-12, 11521 Athens, registered in the General Commercial Registry (ΓΕΜΗ) under number 170727601000, which provides Vardion ("Vardion", "we"). Contact: support@getvardion.com.
2. Scope
This policy applies to the website at getvardion.com and to the free domain check at check.getvardion.com. It does not apply to the Vardion software. A customer that installs Vardion on its own infrastructure is the controller of the data processed there, and Vardion does not receive that data. For the hosted console, Vardion processes customer data as a processor under the data processing agreement (section 4).
The demo at demo.getvardion.com shows sample data only. It sets the console's sign-in cookies (cookie policy) and counts requests per IP address in memory for up to 10 minutes to limit them. It writes none down. A personal link opens it for 7 days and names no one.
3. Data collected
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, email address, organisation and message content sent by email | Replying to an enquiry, arranging a demonstration, partner discussions | Steps prior to a contract (Art. 6(1)(b) GDPR) and legitimate interests (Art. 6(1)(f) GDPR) | 24 months after the last contact, or the term of any resulting contract |
| Name, email address, company, staff band, role and note entered in the demo form | Arranging the demo the visitor asked for | Steps prior to a contract (Art. 6(1)(b) GDPR) | 12 months from the request and then deleted |
| Name, work email and company entered to get demo access | Sending the visitor a personal link to the demo and replying to them | Steps prior to a contract (Art. 6(1)(b) GDPR) | 12 months from the request and then deleted |
| Domain entered in the domain check, with its grade, the date and the language, and, when the link to the check carries them, its campaign tag and the name of the website that linked to it | Showing the result from public records; a record of the domains checked and of which links bring visitors to the check | Legitimate interests (Art. 6(1)(f) GDPR) | While the domain check is offered. The record names no visitor. |
| Email address entered to receive the domain check report, when switched on | Sending the report the visitor asked for | Performing the visitor's request (Art. 6(1)(b) GDPR) | Not kept once the report is sent, unless the visitor asks to be contacted (next row). The record that a report was sent keeps the domain and the date, not the address. |
| Email address of a visitor who ticks "Vardion may contact me about this report", with the domain checked, its grade and the date, when switched on | Following up on the report | Consent (Art. 6(1)(a) GDPR) | 12 months from the check and then deleted, or sooner when consent is withdrawn |
| Answers to the NIS2 readiness check, as bands (sector, staff, turnover, group, the steps in place), with the result and the day but nothing that identifies the visitor | Counting how organisations answer | Legitimate interests (Art. 6(1)(f) GDPR) | Kept as counts, which identify no one |
| Name, work email and organisation entered to sign up for the free workspace for the assessments of Greece's National Cybersecurity Authority (ΕΑΚ), with the username chosen and the date of each sign-in, when switched on | Confirming the address and providing the free workspace | Performing the visitor's request (Art. 6(1)(b) GDPR) | 24 hours for a sign-up not confirmed. For a workspace, until it is closed. One with no sign-in for 12 months is deleted |
| IP address of a visitor using the domain check, the readiness check, the demo form, the demo access form or the free sign-up, kept only as a one-way digest of the address and its network | Limiting the number of checks, demo requests and sign-ups per address, per network and per day | Legitimate interests (Art. 6(1)(f) GDPR) | One hour. One day for the sign-up |
| Delivery data: IP address, date and time, requested page, browser type | Delivering and securing the website and the domain check | Legitimate interests (Art. 6(1)(f) GDPR) | Not kept by Vardion, which keeps no server logs. The hosting providers process these details to deliver each request. |
The website uses no analytics, no advertising technology and no third-party embeds. The cookie policy describes the website's use of cookies.
The domain check counts, per day, how many checks start and finish and how often each next step is followed. The counts hold no address, domain or cookie.
4. Leaked-credential lookups in the console
The free domain check does not look up leaked credentials. The Vardion console looks them up only for the domains a customer has declared in its workspace's scope. It sends the domain, never an email address or a password, to the sources in the table. Each source returns the accounts of the domain it lists, and the console keeps only the account, the source and the date of each as a finding in the workspace. A password or hash that a response may contain is never read or stored.
| Source | What it answers | What it receives | What it returns |
|---|---|---|---|
| XposedOrNot | Accounts of a domain that appear in breaches | The domain | The accounts (email addresses) of the domain it lists |
| Hudson Rock | Accounts of a domain in infostealer logs | The domain | The accounts of the domain it lists |
| Have I Been Pwned | As XposedOrNot, only with a key the customer sets | The domain | The accounts of the domain it lists |
On a customer's own server the lookups are made from there and Vardion receives nothing. On the hosted console the customer is the controller of its staff's accounts and Vardion processes them on its behalf, under the data processing agreement. The findings stay in the customer's workspace until the customer deletes them or the agreement ends.
5. Staff lists and policy acknowledgements in the console
A customer can list its staff in the console to send them its policies to read: each person's name, work email and department, from a spreadsheet, by hand or from the customer's Microsoft 365 or Google Workspace directory. The console records when the link for each policy version was sent, opened and acknowledged. It also records whether the person completed the training the customer assigned. Each link works once and only a one-way digest of it is kept.
On the hosted console the customer is the controller of these records and Vardion processes them on its behalf, under the data processing agreement. They stay in the customer's workspace until the customer deletes them or the agreement ends. A person who leaves is kept and marked as having left, so the record of what they acknowledged stays complete.
6. Evidence requests and DMARC reports in the console
A customer can publish a trust page and offer a form on it for asking for evidence. The console keeps the name, work email and organisation a visitor enters with what they ask for. Only the customer sees them. A customer can also have the console read its DMARC aggregate reports, which list the addresses of servers sending mail as its domains and how many messages each sent. No message content is in a report and none is kept. With content checks on, the console counts the personal data in samples of a customer's exposed data stores and keeps only the counts, never the data itself.
On the hosted console the customer is the controller of these records and Vardion processes them on its behalf, under the data processing agreement. They stay in the customer's workspace until the customer deletes them or the agreement ends.
7. Recipients
Personal data is disclosed only to the following processors, under contracts that meet Article 28 GDPR:
| Subprocessor | Purpose | Location |
|---|---|---|
| OVH SAS (OVHcloud) | Hosting of the hosted console and the free domain check | EU |
| Sinch Mailjet SAS (Mailjet) | Sending the console's and the free check's email: invitations, password resets, reports and notices | France |
| Google Ireland Limited (Google Workspace) | Receiving and answering email to Vardion's addresses | Ireland |
| Cloudflare, Inc. | Hosting and delivery of the getvardion.com website and DNS for Vardion's domains | United States, delivered from the nearest data centre |
The console also sends a domain in a customer's scope, and nothing else, to the leaked-credential sources of section 4: XposedOrNot, Hudson Rock and Have I Been Pwned.
Personal data is not sold or shared for marketing purposes.
8. Transfers outside the European Economic Area
Where a processor is located outside the European Economic Area, the transfer is based on an adequacy decision of the European Commission or on the Standard Contractual Clauses.
9. Rights of the data subject
Under the GDPR, a data subject has the right to:
- access their personal data;
- have inaccurate data rectified;
- have data erased;
- restrict processing;
- receive their data in a portable format;
- object to processing based on legitimate interests;
- withdraw consent at any time, without affecting processing carried out before the withdrawal.
Requests are sent to support@getvardion.com and answered within one month. A data subject may also lodge a complaint with the Hellenic Data Protection Authority, 1-3 Kifissias Avenue, 115 23 Athens, www.dpa.gr. For an account that appears in a finding on the hosted console, the request goes to the customer that is the controller. Vardion assists it.
10. Security
The website and the domain check are served over HTTPS. Access to enquiries and to the record of domains checked is limited to the staff who handle them. The record of domains checked does not identify the visitor.
11. Changes
Changes to this policy are published on this page with a new date.