Privacy Policy

This English version is provided for informational purposes only. The legally binding version is the German “Datenschutzerklärung”.

1. Privacy at a Glance

This policy provides a simple overview of what happens to your personal data when you visit our website. Personal data is any information that can be used to identify you personally.

Data Collection on This Website

Who is responsible for data collection?

Data processing on this website is carried out by the website operator. You can find the contact details of the responsible entity in the section “Data Controller”.

How do we collect your data?

Some data is collected when you provide it to us, for example by entering information into a contact form. Other data is collected automatically by our IT systems when you visit the website (e.g. browser type, operating system, access time).

Why do we use your data?

Some data is required to ensure error-free operation of the website. Other data may be used to analyze user behavior and improve our services.

Your rights

You have the right to obtain information about the origin, recipients and purpose of your stored personal data free of charge at any time. You also have the right to request correction or deletion of this data, to restrict processing and to withdraw consent at any time. You also have the right to lodge a complaint with a supervisory authority.

2. Hosting

We host the contents of our website with professional hosting providers. Processing is based on our legitimate interest in secure and reliable website operation.

Server Log Files

The hosting provider of this website automatically collects and stores information in server log files that your browser transmits to us. These include:

  • Browser type and version
  • Operating system
  • Referrer URL
  • Hostname of the accessing device
  • Time of the server request
  • IP address

This data is not combined with other data sources.

This data is collected on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimization of the website — server log files must be collected for this purpose.

3. General Information and Legal Bases

Data Controller

Blackveil Cybersecurity GmbH
Ottenser Hauptstraße 2–6
22765 Hamburg, Germany
Email: marcus.henschel@blackveil.de

Data Retention

We store personal data only for as long as necessary for the purposes described or as required by statutory retention obligations.

Legal Basis of Processing

Personal data is processed in accordance with GDPR based on consent, contractual necessity, legal obligations and legitimate interests.

Recipients of Personal Data

Personal data is only transferred to third parties if required for contract fulfillment, legal obligations or based on legitimate interest, or if consent has been given.

Right to Object and Withdraw Consent

You may object to the processing of your personal data at any time for reasons arising from your particular situation. You may withdraw any previously given consent at any time.

Right to Data Portability

You have the right to receive personal data that you have provided in a commonly used, machine-readable format.

Security of Processing

We apply appropriate technical and organizational measures to protect personal data from unauthorized access, loss or misuse.

SSL/TLS Encryption

This website uses SSL/TLS encryption for security reasons and to protect the transmission of confidential content, such as inquiries you send to us as the website operator. You can recognize an encrypted connection by the browser address bar changing from "http://" to "https://" and by the lock icon in your browser bar.

When SSL/TLS encryption is activated, the data you transmit to us cannot be read by third parties.

4. Cookies and Consent Management

What are Cookies?

Cookies are small text files stored on your device when you visit a website. They serve various purposes such as remembering preferences, analyzing usage behavior, and enabling advertising functionality.

Cookie Consent

When you first visit our website, a consent banner is displayed asking you to choose which categories of cookies you wish to allow. Your choice is stored locally in your browser (localStorage) and applies to subsequent visits. You can change your cookie preferences at any time by clicking the cookie icon in the bottom-left corner of the page.

Processing is based on your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. You may withdraw your consent at any time with effect for the future.

Cookie Categories

  • Necessary: Required for basic website functionality (always active). No personal data is collected.
  • Analytics: Help us understand how visitors interact with our website. Only activated with your explicit consent.
  • Marketing: Used to measure the effectiveness of advertising campaigns. Only activated with your explicit consent.

5. Google Tag Manager

This website uses Google Tag Manager, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Tag Manager is a tool that allows us to manage website tags (small code snippets) through a single interface.

Google Tag Manager itself does not collect any personal data. It only triggers other tags which may in turn collect data. Google Tag Manager does not access this data. Tags managed through Google Tag Manager only execute if you have given consent via our cookie consent banner (Google Consent Mode v2).

For more information, see: https://policies.google.com/privacy

6. Google Ads and Conversion Tracking

We use Google Ads, an online advertising service provided by Google Ireland Limited. Google Ads Conversion Tracking enables us to measure the effectiveness of our advertising campaigns by tracking whether users who click on our ads complete certain actions on our website (e.g. submitting a contact form).

How it works

When you click on a Google ad and reach our website, a temporary conversion cookie is set — but only if you have given consent for marketing cookies via our consent banner. This cookie does not contain personal identification data. If you visit certain pages on our website (conversion pages), Google and we can recognize that you clicked on the ad and were redirected to this page.

Data processed

The conversion cookie is used to generate aggregated conversion statistics. We learn the total number of users who clicked on our ads and completed a desired action. We do not receive any information that personally identifies users.

Legal basis

Processing is based on your consent pursuant to Art. 6(1)(a) GDPR. You may withdraw your consent at any time by changing your cookie settings.

Data transfer to the USA

Google LLC is based in the USA. Data may be transferred to the USA. Google is certified under the EU-US Data Privacy Framework, ensuring an adequate level of data protection. More information: Google Privacy Policy.

Opt-out

You can prevent participation in conversion tracking by changing your cookie preferences on our website (click the cookie icon in the bottom-left corner) or by adjusting your browser settings to block cookies from the domain "googleadservices.com". You can also opt out of personalized advertising at https://adssettings.google.com.

7. Microsoft Clarity

This website uses Microsoft Clarity, a web analytics service provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

Purpose

Clarity captures mouse movements, scroll behavior, clicks and page views and creates pseudonymized session recordings and heatmaps. We use this data to analyze how visitors interact with our website and to improve its usability.

Masking

Clarity is configured with "Strict Masking". This means that text entered into forms and other input fields is masked and not captured in the recordings.

Legal basis

Processing is based on your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. Clarity is loaded via Google Tag Manager and only executes when you have given consent for analytics cookies via our consent banner (Google Consent Mode v2, analytics_storage: granted).

Withdrawal of consent

You can withdraw your consent at any time by clicking the cookie icon in the bottom-left corner of the page to reopen the consent banner and changing your preferences.

Data transfer to the USA

Data may be transferred to the USA for processing. Microsoft is certified under the EU-US Data Privacy Framework, ensuring an adequate level of data protection. In addition, EU Standard Contractual Clauses apply.

Provider privacy policy

https://privacy.microsoft.com/privacystatement

Cookies set by Microsoft Clarity

Cookie Purpose Duration
_clck Stores a unique user ID for Clarity and website preferences 12 months
_clsk Connects multiple page views into a single Clarity session recording 1 day
CLID Identifies the user across sessions (first-party, set by Clarity script) 12 months
ANONCHK Indicates whether MUID has been transferred to ANID (set by clarity.ms) 10 minutes
MR Used to transfer data between Microsoft domains (set by bing.com) 7 days
MUID Microsoft user identifier for analytics and advertising (set by bing.com) 13 months
SM Used for synchronization with Microsoft data services (set by bing.com) Session

Note: Some cookies (CLID, ANONCHK, MR, MUID, SM) are set by third-party domains (clarity.ms, bing.com). The actual cookies and durations may vary depending on your browser configuration and Clarity version.

8. Contact Form

When you contact us via the contact form, the information you provide, including the contact details you enter, will be stored by us for the purpose of processing your inquiry and in case of follow-up questions.

Data collected

The contact form collects the following data:

  • First and last name (required)
  • Email address (required)
  • Company name (optional)
  • Phone number (optional)
  • Domain (optional, depending on selected service)
  • Selected service / subject (dropdown)
  • Message (free text, optional)

Purpose of processing

The data is used exclusively to process your inquiry and for any follow-up questions.

Legal basis

Processing is based on Art. 6(1)(b) GDPR insofar as your inquiry is aimed at concluding a contract. Otherwise, processing is justified on the basis of our legitimate interest in the effective handling of inquiries pursuant to Art. 6(1)(f) GDPR. If you have given explicit consent, processing is based on Art. 6(1)(a) GDPR; consent may be withdrawn at any time.

Data transmission

The data you enter is transmitted to us by email. Transmission is handled via the mail server of our hosting provider All-Inkl (ALL-INKL.COM - Neue Medien Münnich, Germany). No external third-party services are used for form processing. Your data will not be shared with third parties without your consent.

Data retention

Your data will be deleted once the purpose of storage no longer applies — in particular after your inquiry has been fully processed. Statutory retention periods (e.g. tax or commercial law) remain unaffected. In the event of a deletion request or withdrawal of consent, the data will be deleted unless statutory retention obligations prevent this.

9. Free Dark Web Check

On our landing page /de/darkweb-check/ we offer a free dark web check. You can enter your business email address to receive a one-time dark web analysis for your company domain.

Data collected

  • Business email address
  • Company domain derived from the email address
  • IP address (for abuse prevention, rate limiting)

Purpose of processing

Creation of a one-time, free dark web analysis for the company domain derived from the email address. The analysis is manually prepared by an analyst from our team and sent to you by email.

Legal basis

Processing is based on Art. 6(1)(b) GDPR (performance of pre-contractual measures at the request of the data subject).

Data transmission

The email address you enter is transmitted to us by email. Transmission is handled via the mail server of our hosting provider All-Inkl (ALL-INKL.COM - Neue Medien Münnich, Germany). No data is shared with third parties.

Data retention

The email address is processed solely for the purpose of creating and sending the report. After the analysis is complete and the report has been sent, the data will be deleted unless an ongoing business relationship is established. Statutory retention periods remain unaffected.