1. Controller and scope
The controller responsible for the processing described in this policy is Lucreds Technology OÜ (“Lucreds”, “we”, “us”).
Address: Meistri tn 16, 13517 Tallinn, Estonia
Email: info@lucreds.com
This policy applies to the public website at lucreds.com, communications sent to Lucreds and preliminary discussions about our consulting and security services. It does not cover the Defensiq application, which has its own privacy information and service terms.
2. Personal data we process
Website and technical data
When you access the website, the infrastructure used to deliver and protect it may process technical request data. Depending on the request and provider configuration, this can include your IP address, request time, requested URL, browser and device information, referring page, response status and security-related signals.
Enquiries and business communications
When you contact us, we may process:
- your name, email address and organisation;
- the service you are interested in;
- the content of your message and subsequent correspondence;
- information you voluntarily provide about your organisation, systems, objectives or timeline.
It prepares a message in your email application. The data is processed by Lucreds only after the email is sent and received. Your chosen email provider may process the message under its own terms.
Engagement and client data
If discussions lead to an engagement, we may process business contact details, contractual records, billing information, project communications and information necessary to deliver the agreed service. Service-specific handling requirements may also be defined in the relevant agreement, statement of work, confidentiality agreement or data processing agreement.
Analytics data
If you allow analytics, Matomo may collect information such as visited pages, page titles, referrer information, visit time, interactions with links, browser type, operating system, device category and approximate location derived from network information. Analytics is intended to help us understand website performance and improve content.
We do not use the website to make decisions that produce legal or similarly significant effects about you.
3. Purposes and legal bases
| Purpose | Typical data | Legal basis |
|---|---|---|
| Delivering, operating and securing the website | Technical request and security data | Our legitimate interest in providing a reliable and secure website, GDPR Article 6(1)(f) |
| Responding to an enquiry or preparing a possible engagement | Identity, contact details and message content | Steps requested before entering into a contract, Article 6(1)(b), and our legitimate interest in managing business communications, Article 6(1)(f) |
| Delivering services and managing the client relationship | Contract, project, contact and billing records | Performance of a contract, Article 6(1)(b), and compliance with legal obligations, Article 6(1)(c) |
| Website analytics and improvement | Analytics and device-related data | Your consent, Article 6(1)(a), where consent is required |
| Establishing, exercising or defending legal claims | Relevant communications and records | Our legitimate interests, Article 6(1)(f), and legal obligations where applicable |
Where processing is based on legitimate interests, we consider the necessity of the processing, its impact on individuals and the safeguards available. You may object to such processing as described below.
4. Analytics, cookies and local storage
We use Matomo Cloud, operated by InnoCraft Ltd, to measure website usage. Matomo is configured so that analytics tracking is held until you choose “Allow analytics”. Declining analytics does not restrict access to the website.
If you allow analytics, Matomo may use first-party cookies or similar browser storage to distinguish visits and support reporting. Cookie names can begin with _pk_ and their duration depends on the relevant function and Matomo configuration.
We use a local storage entry named lucreds_analytics_consent solely to remember whether you accepted or declined analytics. This preference remains in your browser until you change it, clear your browser storage or use a browser mode that removes it automatically.
Manage analytics preferences
You can change your choice at any time. Rejecting analytics deletes accessible Matomo cookies from this site and prevents further tracking unless you later allow it.
6. How long we keep data
We retain personal data only for as long as reasonably necessary for the relevant purpose, taking account of contractual, legal, security and dispute-resolution requirements.
- General enquiries: normally for up to 24 months after the last meaningful contact, unless a longer period is needed for an active opportunity, contract or legal claim.
- Client and contractual records: for the duration of the engagement and afterwards for applicable statutory, accounting and limitation periods.
- Website security records: for the period necessary to investigate incidents, prevent abuse and maintain reliable infrastructure, subject to provider settings.
- Analytics: according to the retention settings used in our Matomo account. Visit-level data is reviewed and removed or aggregated when it is no longer necessary for website analysis.
- Consent preference: until you change your choice or clear browser storage.
Data may be retained longer where required by law, where you ask us to retain it, or where it is needed to establish, exercise or defend legal claims.
7. Your data protection rights
Subject to the conditions and limitations in applicable law, you may have the right to:
- request access to your personal data;
- ask us to correct inaccurate or incomplete data;
- request deletion of personal data;
- request restriction of processing;
- object to processing based on legitimate interests;
- receive data you provided in a structured, commonly used and machine-readable format where the right to portability applies;
- withdraw consent at any time, without affecting processing that occurred before withdrawal;
- lodge a complaint with a data protection authority.
In Estonia, the supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon). You may also contact the authority in the EU or EEA country where you live, work or believe an infringement occurred.
To exercise your rights, email info@lucreds.com. We may need to confirm your identity before fulfilling a request. We will not request more information than is reasonably necessary for that purpose.
8. Security
We use proportionate technical and organisational measures intended to protect personal data against unauthorised access, disclosure, alteration, loss or destruction. Measures are selected according to the nature of the processing and may include access controls, encryption, logging, secure configuration, backups, supplier controls and confidentiality obligations.
No method of transmission or storage is completely risk-free. Please do not send passwords, private keys, live credentials, sensitive production data or exploit details through the public contact form. We can agree a secure exchange method before receiving sensitive assessment material.
9. Other information
Third-party links
The website may link to third-party websites or services. Their operators are responsible for their own processing and privacy notices.
Children
Our services and website are intended for organisations and professional users. We do not knowingly seek to collect personal data from children through this website.
Changes to this policy
We may update this policy when our services, providers, processing activities or legal requirements change. The current version will be published on this page and the “Last updated” date will be revised. Material changes may also be communicated through an additional notice where appropriate.
10. Contact us
Questions about this policy or Lucreds’ processing of personal data can be sent to:
Lucreds Technology OÜ
Meistri tn 16
13517 Tallinn, Estonia
info@lucreds.com