EFFECTIVE DATE: REVISED DATE:
WHO WE ARE
For the purposes of data protection laws, we are the “Data Processor” in respect of the personal information collected through our website located at https://probely.com/ (“Site”).
THE PII AND OTHER SENSITIVE DATA WE COLLECT
We automatically collect the following PII from users that visit our Site:
- IP address
- web browser type and version
- operating system
- a list of URLs starting with a referring site, your activity on Our Site, and the site you exit to
When setting up an individual account on the Site, it is mandatory to provide, and we will record, the following PII:
- email address
- company name
In addition, when you become a paying customer, we will consequently record the following PII, regarding the billing information:
- VAT number
In addition to the above, we collect and process, on an anonymous basis, data related to the use of our Site, such as the pages visited, the time spent on each page, etc.
In order to provide the service to our customers, our product also collects the following information:
- Target URL and settings (including testing credentials if provided)
- Vulnerability details including Requests/Responses for each vulnerability found
- Product logs, including the URLs tested and full requests (temporarily, up to 60 days)
OUR USE OF PII
All personal data is stored securely in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679) (GDPR). For more details on security see section 6, below.
We are the owners of the anonymous data related to the use of our Site and may use such anonymous data for statistical or commercial purposes.
Under GDPR we will ensure that your personal data is processed lawfully, fairly, and transparently, without adversely affecting your rights. We will only process your personal data if at least one of the following bases applies:
- you have given consent to the processing of your personal data for one or more specific purposes;
- processing is necessary for the performance of a contract to which you are a party or in order to take steps at the request of you prior to entering into a contract;
- processing is necessary for compliance with a legal obligation to which we are subject;
- processing is necessary to protect the vital interests of you or of another natural person;
- processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
THE COOKIES WE COLLECT AND THE USE WE GIVE THEM
A cookie is a small amount of data, which often includes a unique identifier that is sent to your computer or mobile phone (referred to here as a “Device”) browser from a website’s computer. It’s stored on your Device’s hard drive. Each website can send its own cookies to your browser if your browser’s preferences allow it, but to protect your privacy your browser only permits a website to access the cookies it has already sent to you, not the cookies sent to you by other sites. Cookies give us usage data, like how often you visit, where you go on the Site, and what you do.
Similarly, to cookies, we may also use “web beacons”. Web beacons are used as a mechanism to help us track your visits to our site and whether or not you open our emails. The pages of our Site and the emails we send you may contain web beacons. In addition, we may use several third-party services that embed web beacons on our site for similar tracking purposes. These third-party services are used to provide additional features to users, such as the ability to share content on our site with your social network.
In the table below, you can find the cookies and web beacons that we currently install on your browser or Device, their purpose and max lifespan:
- __cfduid Used by Cloudflare (CDN) to identify trusted web traffic (1 yr)
- _ga Used by Google Analytics to distinguish users (2 yrs)
- _gid Used by Google Analytics to distinguish users (1 day)
- _gat Used by Google Analytics to throttle request rate (1 min)
- _gcl* Used by Google Adsense (3 mo)
- NID; DV; 1P_JAR Used by Google to store preferences (6 mon)
- CONSENT; ck Stores the user’s cookie consent (1 yr)
- intercom-* Used by Intercom to track user’s actions and for customer support (270 days)
- tkn_expires_p; tkn_p; p_plus_ttl_production; p_plus_auth_production Used by Probely app for identifying user sessions
- __stripe_* Used by Stripe to provide fraud prevention
- rp Used by Probely for identifying where you first visited us from (8 mon)
- nQ** Used by Albacross to track user visits (1 yr)
- _ut Used to track a visitor’s source (from advertising) (1 yr)
- _hs; hs-; hubspot*; messagesUtk Used by Hubspot to track user’s actions and for customer support, marketing, and sales (13 months)
Please be aware that users have the opportunity to set their Devices to accept all cookies, to notify them when a cookie is issued, or not to receive cookies at any time. Each browser is different, so check the “Help” menu of your browser to learn how to change your cookie preferences. To learn more about cookies, what they do, and how to manage the information they collect about you and your usage of the Site, please consult informative sites such as https://www.allaboutcookies.org.
Please be aware that blocking all or some cookies may affect the functionality of our Site. Kindly consult the chart above for the relevance of the cookies we use.
PROTECTION OF PII AND OTHER SENSITIVE DATA
As owners of a security product, we take PII security very seriously. The following list is a non-exhaustive list of security controls we implemented to protect our infrastructure, our product, and your PII:
- We only allow communications to our servers, that host our product and site, through a secure channel (HTTPS) using TLS. HTTPS allows for the authentication of the visited website and protection of the privacy and integrity of the exchanged data.
- All of our infrastructure is hosted in a top-tier cloud provider, where security has been scrutinized. We use managed services supplied by the cloud provider to the highest possible extent. We also use their security features and controls, to segregate and monitor our service networks, for audit logs, and for security event management. The frontend, backend, and database servers use private and segregated networks controlled by security groups.
We also follow the best security practices, including (but not limited to):
- Principle of the least privilege (to access our systems and data),
- Encryption of sensitive data at rest,
- Server hardening and security updates,
- Requiring 2-factor authentication to access our systems,
- Central logging
- Secure Software Development Life cycle, including periodic security assessments (manual and using Probely)
Notwithstanding the security measures that We take, it is important to remember that the transmission of data via the internet may not be completely secure and that you are advised to take suitable precautions when transmitting to Us data via the internet.
THIRD-PARTY ACCESS TO YOUR PII
We give or may give in the future certain independent contractors access to PII (“Data Processors”). No Data Processor will be retained without first entering into contracts in which they agree to protect PII using procedures reasonably similar to ours and will only process PII in accordance with our instructions.
We may also disclose PII to attorneys and investors bound to confidentiality restrictions and to law enforcement authorities, courts, and public regulators, whenever such is required by applicable legislation. Finally, we may share PII in connection with a transaction of all or substantially all of our assets.
To provide the services, we rely on different data subprocessors, which process different categories of data. Processors never store data outside of the scope of their specific purpose. These subprocessors are listed below, with a description of the service and the location where data is hosted. This list may be updated by Probely from time to time:
- Amazon Web Services, Inc.
- Hosting and storage
- EU, USA
- Chargebee, Inc.
- Subscription Management, Billing and Invoicing
- EU, USA
- Intercom, Inc.
- Customer Support, Marketing and CRM
- Hubspot, Inc.
- CRM, Marketing
- EU, USA
- Stripe, Inc.
- Payment processing
- Sentry, Inc.
- Error monitoring platform
- Cloudflare, Inc.
- Content Delivery Network / Website security
- Data centers located all around the world. Traffic will be automatically routed to the nearest data center.
- Analytics, Tag Manager, Workspace
- Subscription Analytics
- Amazon Web Services, Inc.
You can access and change any PII we store by contacting us directly at the following e-mail address: [email protected]. The access and correction of your PII are free of charge. You acknowledge, however, that all PII you provide must be accurate and updated.
You may also oppose, at any time and free of charge, the use of your PII for direct marketing or any other form of commercial use. Should you wish to do so after receiving an e-mail or SMS from us, we will provide you with a simple option to opt-out or remove yourself from our marketing directory. You may also withdraw your consent to our processing of your PII whenever such processing is dependent on consent. This may be done simply by sending us an email to [email protected].
Furthermore, you may at any time request that we delete or limit the PII we hold related to you. You may also request the portability of your PII in accordance and within the limits of applicable law. It is your right to also request that we notify third parties with whom we may have shared your PII and also request that they comply with your instructions.
WHERE WE STORE YOUR PII AND FOR HOW LONG
Unless expressly agreed or contracted otherwise, all the PII regarding our users is stored on secure servers located within the European Union. We will inform our users should we eventually change our policy.
Our objective is that our users have a long-lasting relationship with our Site, even if visits are not very frequent. We will store your PII and your account will continue to be active for three years following your last interaction with our Site. Prior to closing your account, we will notify you asking whether you wish to maintain your account active.
After a deletion request, your PII will be retained for up to 3 months as part of backup procedures.