Privacy notice

The controller under the GDPR for this website and for demo requests is Haldir Security GmbH, Munich, Germany. Our company details are in the imprint. For anything about your data, write to hello@haldir.eu.

This notice covers the public website and the book-a-demo form. When a customer uses the Haldir platform, we process their employees' data as a processor under GDPR Art. 28; that processing is governed by the customer's data processing agreement, which lists every sub-processor.

To deliver pages and keep the site secure, our hosting provider processes your IP address, the time of the request, the page requested and your browser's user agent in server logs. The legal basis is our legitimate interest in a working and secure website (GDPR Art. 6(1)(f)). Logs are kept only as long as needed for security and troubleshooting.

The public website loads no analytics, advertising or third-party scripts, and fonts are served from our own domain. It sets no cookies unless you choose a language with the EN / DE switch: one cookie (HALDIR_LOCALE) then remembers that choice for one year, so the site opens in your language. Signing in to the console sets one strictly necessary session cookie. Neither needs consent, because each is strictly necessary for a function you asked for (§25(2) no. 2 TDDDG).

When you ask for a demo, we process:

• your name, work email address and company
• the company size and the topic you chose, and the plan you came from if any
• your IP address, only to limit how many requests one network can send; it is held in the server's memory and not stored with your request

We use these details to answer your request, schedule the demo and prepare it for your company. The legal bases are steps prior to a contract taken at your request (GDPR Art. 6(1)(b)) and your consent (Art. 6(1)(a)), which you can withdraw at any time by writing to hello@haldir.eu. Rate limiting is based on our legitimate interest in protecting the form from abuse (Art. 6(1)(f)).

No newsletter, no sale of data and no sharing with third parties for their own purposes. If we do not start working together, your request is deleted 24 months after you sent it, or earlier when you withdraw your consent or ask us to delete it.

We use processors for hosting and the database, bound by data processing agreements under GDPR Art. 28. They process data in EU regions. Some have parent companies in the United States; for those we rely on the EU-US Data Privacy Framework or standard contractual clauses plus supplementary measures.

Vercel Inc., US

Website hosting, functions pinned to Frankfurt (fra1)

Supabase Inc., US

Database for demo requests, AWS eu-central-1 (Frankfurt)

Under the GDPR you have the right to:

• access the data we hold about you (Art. 15)
• have it corrected (Art. 16) or deleted (Art. 17)
• restrict its processing (Art. 18) and receive it in a portable format (Art. 20)
• object to processing based on our legitimate interests (Art. 21)
• withdraw your consent at any time, without affecting processing that happened before (Art. 7(3))

Write to hello@haldir.eu and we will answer within one month. You can also complain to a data protection supervisory authority, for example the one where you live or the authority responsible for us, the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht).

We do not make automated decisions about you on this website and do not build profiles of visitors.