Privacy Statement
Last updated: 30 October 2026
This is an English translation of the Dutch “Privacyverklaring”. Only the Dutch version is legally binding; if the two differ, the Dutch version prevails.
This privacy statement describes how Hasecon handles personal data within the Exposentry service, in accordance with the General Data Protection Regulation (GDPR; in Dutch: Algemene verordening gegevensbescherming, AVG).
1. Our role: controller and processor
Exposentry processes two kinds of data, each with a different legal role:
- Account data (registration, invoicing, communication): for this data, Hasecon is the controller. This statement describes that processing.
- Scan data (the results of a Scan of a domain of the Customer, which may contain personal data of third parties such as email addresses or names): Hasecon processes this data as a processor, on behalf of and on the instructions of the Customer. The Customer is the controller for it. This processing is governed by the Data Processing Agreement (DPA), not by this statement.
2. Controller
Hasecon (sole proprietorship, eenmanszaak; being converted into a B.V., a Dutch private limited company; see the Terms and Conditions)
Eemwijkstraat 4, 2271 RE Voorburg-Leidschendam, the Netherlands
Chamber of Commerce (KvK) number: 55122434
Contact: scan@exposentry.io
3. Which personal data we process (as controller)
- Name and email address (on registration)
- Company name and KvK number (for business verification)
- Domain names you have had scanned
- IP address and browser data (when you visit the website, in log files)
- Payment data (processed by Mollie; we do not store full payment details)
- Authentication data for your account
- Name, business email address and organisation when you request the sample report; on download, also whether you consent to being contacted once and, if you wish, your telephone number
- Consent to scan level 3: the accepted text, the email address of the person who gave consent, the time, and the IP address and browser User-Agent at that moment (as evidence of the consent given)
4. Purposes and legal bases
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Performance of the scan service | Performance of a contract (Art. 6(1)(b)) |
| Business (KvK) verification of the Customer | Performance of a contract / legal obligation |
| Invoicing and payment processing | Performance of a contract |
| Sending scan reports by email | Performance of a contract |
| Customer service and communication | Legitimate interest (Art. 6(1)(f)) |
| Sending the sample report at your request | Legitimate interest (Art. 6(1)(f)) |
| Contacting you personally once about the sample report, only if you ticked the box for this on download | Consent (Art. 6(1)(a)); you can withdraw it at any time |
| Security and abuse prevention (logging) | Legitimate interest |
| Recording consent for active tests (scan level 3) | Performance of a contract (Art. 6(1)(b)) and legitimate interest in being able to prove the consent (Art. 6(1)(f)) |
| Legal obligations (bookkeeping) | Legal obligation (Art. 6(1)(c)) |
5. Recipients and sub-processors
We engage the following parties. We conclude a data processing agreement with every sub-processor that processes personal data on our behalf.
| Party | Purpose | Location |
|---|---|---|
| Mollie | Payment processing | EU (the Netherlands) |
| Gmail (Google Workspace) | Sending reports and transactional email | EU |
| Authentication service | Login / account management | EU / self-managed |
| Hosting provider | Hosting the application and scan data | EU |
Transfers outside the EEA. We aim to have all processing take place within the European Economic Area (EEA). If, contrary to our expectations, data is transferred to a country outside the EEA, we do so only on the basis of an appropriate transfer mechanism under the GDPR (such as an adequacy decision, the EU-US Data Privacy Framework, or standard contractual clauses/SCCs). An up-to-date list of sub-processors is available on request.
6. Retention periods
- Account data: up to 1 year after termination of the account
- Scan reports: up to 2 years after creation (unless the DPA with the Customer prescribes a shorter period)
- Invoicing data: 7 years (statutory tax retention obligation)
- Log files: no more than 90 days
- Sample report requests: 30 days, the period for which the download link is valid; if you did not consent to be contacted, we keep the data no longer than that. If you consented to be contacted when downloading, we keep your name, email address, organisation and any telephone number until 12 months after your consent, or after our contact with you if that was later. If you want us to delete your data sooner, or you withdraw your consent, reply to the email or write to scan@exposentry.io.
- Consent to scan level 3: up to 5 years after the consent ends, in line with the statutory limitation period, as evidence of the authorisation. If you close your account, we immediately delete the personal data from that consent record (email address, IP address, User-Agent) and keep only the authorisation record without this personal data.
7. Your rights
Under the GDPR you have the right of access, rectification, erasure, restriction of processing and data portability, and the right to object to processing based on legitimate interest. You can exercise these rights via scan@exposentry.io. We respond within 30 days.
If your request concerns personal data contained in scan data, we process that data on behalf of the Customer. In that case we refer you to the Customer concerned (the controller), or handle the request in consultation with that Customer in accordance with the DPA.
8. Security
We take appropriate technical and organisational measures, including encrypted connections (TLS), authentication and access control, automated monitoring, separate storage of scan data, and regular security updates. A more detailed description of the measures is included in the annex to the DPA.
9. Cookies
We place only functional cookies that are necessary for the website to function and for the login process. No consent is required for necessary cookies. For website statistics we use Plausible Analytics, a privacy-friendly tool that is self-hosted on our own server, places no cookies, processes no personal data, and fully complies with the GDPR without requiring consent. See our cookie policy.
10. Lodging a complaint
If you have a complaint about the processing of your personal data, please contact us first via scan@exposentry.io. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) via autoriteitpersoonsgegevens.nl.