Privacy Policy
Last updated: 22 September 2026
This Privacy Policy explains how AttackSurfaceCheck (“AttackSurfaceCheck”, “we”, “us”) collects, uses, and protects information when you visit this website or submit a request through it.
Who we are
AttackSurfaceCheck is operated by AttackSurfaceCheck, based in the Netherlands. For any privacy-related question or request, contact us at privacy@attacksurfacecheck.com.
What information we collect
We collect information in two ways:
Information you provide directly
When you submit the Request Assessment form, the Partner enquiry form, or contact us by email, we collect what you enter: your name, business email address, company name, company website, country, role, organization size, and any additional context you choose to share. Submitting this information does not authorize any security testing. See our Terms of Engagement.
Information collected automatically
Our web server records standard technical logs for security and operational purposes: IP address, user agent, requested URL, and timestamp. We also use Microsoft Clarity to understand how visitors use this site. See “Who we share information with” below and our Cookie Policy for details.
How we use your information
- To respond to your enquiry and discuss a potential assessment scope.
- To send you a confirmation when you submit a form.
- To maintain the security, integrity, and availability of this website (e.g. rate-limiting abusive submissions).
- To meet legal or contractual obligations, where applicable.
We do not sell your information, and we do not use it for advertising or profiling.
Legal basis for processing
Where the General Data Protection Regulation (GDPR) applies, we process your information on the following bases: your consent (by submitting a form), our legitimate interest in responding to business enquiries and operating a secure website, and, where an engagement proceeds, performance of a contract.
Who we share information with
We use a small number of service providers to operate this website and deliver email:
- Hosting infrastructure: the servers that run this website and process form submissions.
- Email delivery provider (Brevo): used to reliably deliver form-notification and confirmation emails. Brevo processes the contents of these emails on our behalf as a data processor.
- Microsoft Clarity (analytics): used to understand site usage through aggregated click, scroll, and session-replay data. Clarity is not linked to the personal information you submit through our forms. See our Cookie Policy and the Microsoft Privacy Statement for details.
We do not share your information with any other third party, and we do not transfer it outside these processing relationships without your knowledge.
International transfers
AttackSurfaceCheck serves clients worldwide, and our service providers may process data outside your country of residence. Where this involves a transfer out of the European Economic Area, we rely on appropriate safeguards such as Standard Contractual Clauses or an equivalent adequacy mechanism.
Data retention
We retain enquiry and lead information for as long as reasonably necessary to respond to it, pursue a potential engagement, and meet legitimate business record-keeping needs. That’s typically no longer than 24 months after your last contact with us, unless a longer period is required by law or an active engagement. You can request earlier deletion at any time (see “Your rights” below).
Security
We apply reasonable technical and organizational measures to protect the information you share with us, including encrypted transport (HTTPS), access controls, and isolated infrastructure for this website. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Your rights
Depending on your jurisdiction, you may have the right to:
- Request access to the personal data we hold about you.
- Request correction of inaccurate data.
- Request deletion of your data.
- Object to or restrict our processing of your data.
- Request a portable copy of your data.
- Withdraw consent at any time, where processing is based on consent.
- Lodge a complaint with your local data protection supervisory authority.
To exercise any of these rights, contact privacy@attacksurfacecheck.com. We will respond within a reasonable timeframe, generally within 30 days.
Children’s privacy
This website and our services are intended for business use by professional adults and are not directed at children. We do not knowingly collect information from anyone under 16.
Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. The “Last updated” date at the top of this page reflects the most recent revision.
Contact
Questions about this policy or how we handle your data: privacy@attacksurfacecheck.com.