Privacy Policy

This English version is provided for convenience. In case of discrepancies, the German version shall prevail.

1. Privacy at a Glance

We have deliberately designed this website to collect as little data as possible. In short:

• Fonts, graphics, and scripts are loaded exclusively from our own server.
• Google Analytics 4 (statistics) and Google reCAPTCHA (spam protection) are only loaded once you consent via our consent banner or directly on the form. Without your consent, no connections to Google are established.
• We store your consent decision in your browser (local storage). We only set a cookie of our own if you actively switch the website language.
• Form submissions are sent to us by email via Microsoft 365 and are not stored in a database.
• The NDA generator works entirely locally in your browser; your entries are not transmitted.

2. Controller

The controller responsible for data processing on this website within the meaning of the EU General Data Protection Regulation (GDPR) is:

Rootsektor IT-Security GmbH
Lottenweg 11
59757 Arnsberg
Germany
Represented by its Managing Director, Sebastian Michel
Phone: +49 2932 465265-0
Email: info@rootsektor.de

This privacy policy applies to the website www.rootsektor.de, including the English-language pages at www.rootsektor.de/en/. The processing of personal data as part of commissioned security services – such as penetration tests, social engineering assessments, incident response, or dark web monitoring – is not covered by this privacy policy. It is governed by the agreements concluded with our clients, in particular data processing agreements under Art. 28 GDPR.

3. Privacy Contact

If you have questions about data protection or wish to exercise your rights, please use the contact details in Section 2, for example by emailing info@rootsektor.de.

4. General Information on Data Processing

Definitions

“Personal data” means any information relating to an identified or identifiable natural person, such as a name, an email address, or an IP address. “Processing” means any operation performed on such data, such as collecting, storing, transmitting, or deleting it. Otherwise, we use the terms as defined in Art. 4 GDPR.

Legal Bases

We only process personal data where a legal basis permits it. The following legal bases are particularly relevant:

• Art. 6(1)(a) GDPR – your consent;
• Art. 6(1)(b) GDPR – the performance of a contract with you or steps taken at your request prior to entering into a contract;
• Art. 6(1)(c) GDPR – compliance with a legal obligation, such as retention obligations under commercial and tax law;
• Art. 6(1)(f) GDPR – the pursuit of our legitimate interests, unless your interests or fundamental rights and freedoms override them.

Storing information on your device and accessing information already stored there is only permitted with your consent, unless it is strictly necessary to provide a service you have expressly requested (Section 25 of the German Telecommunications Digital Services Data Protection Act, TDDDG).

Recipients

We only share your data where permitted by law. Recipients are primarily our processors, who process data exclusively on our instructions: our hosting provider (Section 5), Microsoft for email communication (Section 12), and – only with your consent – Google (Sections 7 and 8). For quote requests regarding products of our technology partners, we transmit your information to the respective vendor (Sections 10 and 11). We only transmit data to public authorities where we are legally obliged to do so. In individual cases, advisors bound by professional secrecy, such as tax advisors or lawyers, receive data where this is necessary to exercise our rights or fulfill our obligations. We do not share data for advertising purposes.

Transfers to Third Countries

When Microsoft 365, Google Analytics, or Google reCAPTCHA (the latter two only with your consent) are used, and for quote requests for Rapid7 products, personal data may be transferred to the United States. For companies certified under the EU-U.S. Data Privacy Framework, an adequacy decision of the European Commission applies (Art. 45 GDPR). Microsoft Corporation and Google LLC are certified under this framework; for Rapid7, see Section 11.

Retention and Deletion

We only store personal data for as long as necessary for the respective purpose and delete it afterward, unless statutory retention obligations apply. Under Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO), we retain in particular:

• 10 years: books of account, records, annual financial statements, and management reports,
• 8 years: accounting vouchers, such as invoices,
• 6 years: business correspondence received and sent, such as quotes, order confirmations, and business emails.

Obligation to Provide Data and Automated Decision-Making

You are under no statutory or contractual obligation to provide us with personal data. However, we cannot process your request without the information marked as required in the forms. We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

5. Hosting and Server Log Files

Hosting

This website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany (“hosting provider”). The hosting provider processes the data generated when the website is visited – in particular server log files and the information submitted via forms while it is being processed – on our behalf and on our instructions under a data processing agreement pursuant to Art. 28 GDPR. The legal basis is our legitimate interest in providing our website securely, quickly, and reliably (Art. 6(1)(f) GDPR).

Server Log Files

Each time our website is accessed, your browser automatically transmits information to the server, which may be stored in so-called server log files: the IP address of the requesting device, date and time of access, the page or file requested, HTTP status code and amount of data transferred, referrer URL, and browser type and operating system (user agent). This processing serves to deliver the website, to ensure the stability and security of the systems, and to detect and defend against attacks. The legal basis is Art. 6(1)(f) GDPR. The data is not combined with other data sources. The log files are deleted automatically after a short period set by the hosting provider; data that must be retained for evidentiary purposes is exempt from deletion until the incident has been resolved.

6. Consent Management, Local Storage, and Cookies

On your first visit, a banner asks whether you allow Google Analytics 4 (statistics) and Google reCAPTCHA (spam protection). Both buttons – “Accept all” and “Necessary only” – are given equal weight; under “Settings,” you can choose individual categories. We store your decision in your browser’s local storage under the key “rs-consent” (choice, version number, and time) so that we don’t have to ask you again on every page. This storage is strictly necessary (Section 25(2) no. 2 TDDDG) and also serves as proof of your consent (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR). We ask again after 12 months or when the services we use change.

You can withdraw or change your consent at any time with effect for the future via the “Cookie settings” link in the footer of every page. If you withdraw your consent, we remove the analytics cookies and reload the page.

Only if you actively switch the website language (using the language switcher or the language notice) do we store your choice in the cookie “rs_lang” (value “de” or “en,” lifetime 12 months) so that the home page appears in your language in the future. If you close the language notice, we remember this in local storage under “rs_lang_hint.” Both are strictly necessary for the service you have expressly requested (Section 25(2) no. 2 TDDDG); the legal basis for the associated processing is our legitimate interest in user-friendly language selection (Art. 6(1)(f) GDPR). We do not set any other cookies; Google cookies are only set with your consent (Sections 7 and 8).

7. Google Analytics 4

With your consent, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). We use Google’s consent mode in its basic implementation: Google Analytics is only loaded after you have given your consent; before that, no data is transmitted to Google, not even cookieless signals.

Google Analytics uses cookies (ga and _ga<ID>, lifetime of up to 2 years) to recognize your browser and processes information about your use of our website – such as pages viewed, time spent, approximate location based on the IP address, and device and browser information. According to Google, IP addresses are not stored in Google Analytics 4. We have disabled Google Signals and advertising features (ad personalization). The data is retained in Google Analytics for 2 months and then deleted automatically. In addition, we record – without any personal content – whether a form was submitted successfully, a phone or email link was clicked, or a document was downloaded, copied, or printed in the NDA generator.

The purpose is the statistical analysis and improvement of our website. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time via “Cookie settings.” Google also processes data in the United States; Google LLC is certified under the EU-U.S. Data Privacy Framework. More information: policies.google.com/privacy.

8. Google reCAPTCHA (Spam Protection)

To protect our forms against spam and abuse, we use Google reCAPTCHA Enterprise (Google Cloud Fraud Defense) with your consent. The provider is Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland (“Google”). reCAPTCHA is only loaded once you consent in the consent banner or directly on the form (“Enable spam protection”). In particular, your IP address, device and browser information, and information about your interaction with the page are transmitted to Google; Google uses this to assess whether the request comes from a human. Our server verifies the result directly with Google. For this purpose, reCAPTCHA may use cookies (for example, _GRECAPTCHA) or similar technologies.

Google processes the data for this assessment as our processor under the Google Cloud data processing terms. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time via “Cookie settings.” Data is transferred to the United States on the basis of the EU-U.S. Data Privacy Framework. Without consent, you can always reach us by email at info@rootsektor.de or by phone at +49 2932 465265-0.

9. Contacting Us and Forms

Forms on This Website

Our forms allow you to contact us, send a short inquiry or callback request, describe your test scope in the scoping wizard and request a quote, report a security incident, report a vulnerability to us, or request a quote for products of our technology partners (Sections 10 and 11). We process the information you enter – depending on the form, for example your name, company, email address, phone number, your message, and details about the desired scope, the incident, or the reported vulnerability.

After you submit a form, our web server transmits your information in encrypted form via the Microsoft Graph interface as an email to the responsible mailbox (general inquiries, quote requests, and scoping: info@rootsektor.de; emergency reports: incident@rootsektor.de; vulnerability reports: security@rootsektor.de). The form content is not stored in a database or in files on the web server itself. Your IP address is not included in the email. If you have provided an email address, you will receive an automatic confirmation of receipt; it does not repeat your entries.

We use your information solely to process your request. The legal basis is Art. 6(1)(b) GDPR if your request is aimed at concluding or performing a contract, and otherwise our legitimate interest in responding to inquiries addressed to us (Art. 6(1)(f) GDPR).

Please do not submit credentials, passwords, or confidential details about vulnerabilities in your systems via the forms. For such content, we will agree on a suitable transmission method with you.

Protection Against Abuse

In addition to reCAPTCHA, our server checks every submission for a field that is invisible to humans and must remain empty, for a minimum time between loading and submitting the form, and for a form token signed by our server that contains no personal data. To prevent mass submissions, our server stores the times of recent submissions per form type under a cryptographic hash of your IP address – not under the IP address itself. These entries are disregarded after 24 hours and deleted automatically at regular intervals. Our technical log of form deliveries contains no personal data. The legal basis is our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR).

Contact by Email or Phone

If you contact us by email or phone, we process your information – such as your name, contact details, and the content of your inquiry – to handle your request. The legal bases are the same as for the forms. We do not record phone calls.

Retention of Inquiries

We delete inquiries once they have been fully processed and no further communication is expected. If your inquiry leads to a quote or contract, the statutory retention periods apply (Section 4).

10. Quote Requests for Greenbone Products

If you request a quote using the form on our Greenbone page, we process your information (company, name, contact details, address, request type, the name or identifier of your subscription key, details about the appliance and the number of assets, and your message) in order to obtain a quote from Greenbone AG. For this purpose, we forward your information to Greenbone AG, Neumarkt 12, 49074 Osnabrück, Germany. The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract taken at your request). We do not ask for the subscription key itself. Retention on our side is governed by Section 9; Greenbone AG’s own privacy notice applies to processing by Greenbone AG.

11. Quote Requests for Rapid7 Products

If you request a quote using the form on our Rapid7 page, we process your information (company, name, contact details, area of interest, the number of assets where applicable, company size, information on any existing customer relationship, desired time frame, and message) in order to obtain a quote from Rapid7 and register the project with Rapid7. For this purpose, we forward your information to Rapid7: Rapid7, Inc., 120 Causeway Street, Suite 400, Boston, MA 02114, USA, and its affiliated companies in the Rapid7 group. The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract taken at your request).

In its privacy notice, Rapid7 states that it complies with the EU-U.S. Data Privacy Framework; to that extent, data is transferred to the United States on the basis of the European Commission’s adequacy decision (Art. 45 GDPR). Rapid7’s representative in the EU under Art. 27 GDPR is Rapid7 Ireland Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland; privacy contact: privacy@rapid7.com. Information on processing by Rapid7: rapid7.com/privacy-policy. Retention on our side is governed by Section 9.

12. Email Communication (Microsoft 365)

For our email communication – including the delivery of requests submitted via the forms through the Microsoft Graph interface – we use Microsoft 365 (Exchange Online). The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland (“Microsoft”). Microsoft processes emails, including sender, recipients, content, and technical metadata, on our behalf under the “Microsoft Products and Services Data Protection Addendum” as a data processing agreement pursuant to Art. 28 GDPR. Access by Microsoft Corporation in the United States cannot be ruled out; it is certified under the EU-U.S. Data Privacy Framework. The legal basis is our legitimate interest in a secure and reliable email infrastructure (Art. 6(1)(f) GDPR). Emails between mail servers are generally transmitted with transport encryption (TLS).

13. Job Applications

You can apply to us by email at jobs@rootsektor.de. We process the data you send us – such as contact details, résumé, and references – solely to carry out the application process. The legal basis is Art. 6(1)(b) GDPR (initiation of an employment relationship). Where you voluntarily provide special categories of personal data, we process them on the basis of Art. 9(2)(b) GDPR. Your documents are only accessible to the people involved in the selection process. If no employment relationship results, we delete your documents six months after the process ends, unless you have consented to longer storage; until then, we retain them to defend against possible claims (Art. 6(1)(f) GDPR).

14. NDA Generator

Our NDA generator creates the non-disclosure agreement entirely locally in your browser. Your entries are neither transmitted to us nor to third parties and are not stored; they are gone when you close or reload the page. A file is only created if you download, copy, or print the document yourself.

15. Links to Other Websites

We refer to the websites of our partners and other providers using simple links only. We do not embed social media plugins, videos, or maps from third-party providers; only when you click a link are you taken to the respective provider’s website, where its privacy policy applies.

16. Your Rights

Under the GDPR, you have the following rights, provided the respective legal requirements are met:

• Access to the data we process about you and a copy of that data (Art. 15 GDPR),
• Rectification of inaccurate data or completion of incomplete data (Art. 16 GDPR),
• Erasure of your data (Art. 17 GDPR),
• Restriction of processing (Art. 18 GDPR),
• Data portability in a structured, commonly used, and machine-readable format (Art. 20 GDPR),
• Objection to processing (Art. 21 GDPR, see below),
• Withdrawal of consent you have given, with effect for the future (Art. 7(3) GDPR); the lawfulness of processing carried out before the withdrawal remains unaffected.

To exercise your rights, an informal message to the contact details in Section 2 is sufficient, for example an email to info@rootsektor.de. To prevent misuse, we may ask you to verify your identity.

Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your data violates the GDPR (Art. 77 GDPR). The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia)
Kavalleriestraße 2–4, 40213 Düsseldorf, Germany
Phone: +49 211 38424-0
Email: poststelle@ldi.nrw.de
Website: www.ldi.nrw.de

17. Data Security

We take technical and organizational measures under Art. 32 GDPR to protect your data against loss, manipulation, and unauthorized access. In particular, this includes end-to-end encryption of the connection to our website using TLS (HTTPS). Our website works without a content management system and without a database and technically restricts embedded third-party content using a Content Security Policy. We continuously adapt our security measures to the state of the art.

18. Changes to This Privacy Policy

We update this privacy policy when changes to our website, our services, or the legal situation require it. The version published on this page applies.