The short version
- No tracking. No advertising, analytics or social-media cookies, no tracking pixels, and nothing loaded from another company's servers, not even fonts.
- Kept in the EU. Everything this site collects is stored and processed in Germany. The one exception: emails we send you about an order, such as your sign-in details, are delivered through an email service that may process them in the United States, under the safeguards the GDPR requires.
- Not sold, not shared. We do not sell personal data, and we do not share it with anyone for their marketing. If you order a router, the carrier that delivers it receives what the delivery needs.
- What we do see. Like any website, our server sees the network address and browser of each visit. We use that to deliver the site, keep it secure, apply the free tools' daily limits and count visits in aggregate.
- Your rights. You can ask to see, correct or delete anything we hold about you by writing to our data protection officer at greece@nbs-communications.com.
Who is responsible
This site, protect.seadirect.net, and the SeaDirect Protect services presented on it are operated by NBS Maritime OOD (НБС МЕРИТАЙМ ООД), a company registered in the Commercial Register of the Republic of Bulgaria under UIC 127595228, with its address at 1 Primorski Blvd., 9000 Varna, Bulgaria. NBS Maritime OOD is the controller of the personal data described in this notice: we decide why and how it is processed, and we answer for it.
Data protection officer
Milen Denev
greece@nbs-communications.com
NBS Maritime OOD, 1 Primorski Blvd., 9000 Varna, Bulgaria
Write to this address for anything in this notice, including every request under "Your rights" below.
This notice covers this public website: its pages, its free tools and its forms, and the router orders placed on it or in the client portal. Customers of SeaDirect Protect are also covered by their contract and data processing agreement, which govern the data their own networks and machines send to the platform.
What we collect and why
We collect only what the site needs to work, to stay secure, and to answer you when you ask us something. For each purpose, the table gives the legal basis the GDPR requires us to name.
| What | Why | Legal basis |
|---|---|---|
| Visit data: your network (IP) address, browser and device type, the page you asked for, the site that linked you here, and the time | To deliver the page, keep the site and its visitors secure, detect and block abuse, and fix faults. | Our legitimate interest in running a secure website (Art. 6(1)(f) GDPR). |
| Audience counts: how many visits each page had, from which countries, browser families and referring sites, per day | To understand which pages are read, without following anybody. Counts are computed on our own server from the visit data above; no cookie or script is involved. To count one person once per day, a one-way scrambled value of the address and browser is used and thrown away at the end of that day. | Legitimate interest (Art. 6(1)(f)). The counts themselves are not personal data. |
| Daily limit counters: a count of free-tool lookups per network address | To keep the free tools free by limiting each address to a handful of lookups a day. | Legitimate interest (Art. 6(1)(f)). Held in memory only and reset every day. |
| What you type into a free tool, and files you upload to the file scan | To answer your lookup. See the free tools. | Legitimate interest (Art. 6(1)(f)) in providing the tool you chose to use. |
| What you send through the contact form | To answer your request and prepare what you asked for. See the contact form. | Steps taken at your request before a possible contract (Art. 6(1)(b)), and our legitimate interest in keeping business correspondence (Art. 6(1)(f)). |
| What you send through the event report form | To investigate a security event you tell us about. See the event report form. | Legitimate interest in keeping our customers and ourselves secure (Art. 6(1)(f)), and, where a report becomes an incident we must report to an authority, a legal obligation (Art. 6(1)(c)). |
| What you send with an order | To accept, invoice and deliver your order, set up your account, and keep the accounting records the law requires. See orders. | Performing the contract with you and the steps you asked for before it (Art. 6(1)(b)), and our legal obligations under accounting and tax law (Art. 6(1)(c)). |
| Emails you send us | To reply, and to keep a record of what was agreed. | Pre-contractual steps (Art. 6(1)(b)) or legitimate interest (Art. 6(1)(f)). |
Where we rely on legitimate interest, we have weighed it against your interests and rights, and you can object at any time (see your rights). We make no decisions about you by automated means that have legal or similarly significant effects. The only automatic decision the site takes is to stop answering free-tool lookups from an address that has used its daily allowance.
You never have to give us personal data to read this site. The fields marked as required on the forms are the ones we need in order to answer; without them we cannot reply.
The free tools
The free tools answer questions about things, not people. Each one handles what you give it as follows.
- IP address lookup
- The address you look up is checked against our own threat intelligence. To add registry and location details, the address you asked about (never your own) is also sent to public internet registry services (RDAP) and an IP geolocation service. Private and reserved addresses are never sent anywhere. Results are kept in memory for a few hours so a repeated lookup does not ask again. An address can be personal data of whoever uses it: please look up addresses you have a reason to check.
- Vulnerability lookup
- The software name and version you enter are checked against public vulnerability databases. We keep the result so the same question is answered instantly next time, and when a lookup finds known vulnerabilities, the product and version become a public page on this site so others can find the answer. We do not record who asked: the stored lookup contains the software name, version and result, and nothing about you.
- Malware hash lookup
- The file fingerprint (hash) you enter is checked against a copy of the public malware databases held on our own server. It is not sent anywhere.
- File scan
- A file you upload is scanned on our own infrastructure and deleted once the scan has a verdict. We keep the verdict, the file's name and fingerprints, and the network address it came from, so that a repeat scan of the same file is answered at once and so the tool cannot be abused. Please do not upload files that contain other people's personal data.
- User-Agent lookup
- The browser description you enter, or your own browser's if you enter nothing, is analysed on our server and not stored.
The contact form
When you send the contact form we receive what you type and tick: your name, work email, organisation, and optionally your role, phone number, country, the size and sector of your organisation, what you need, a plan you built, and your message. We also record the page you came from, your network address and browser, and the version of this notice you agreed to, so we can recognise and stop abuse of the form.
We use it to answer you and to prepare what you asked for. We do not add you to a mailing list, and we do not use it for marketing you did not ask for. It is read by the people at NBS Maritime OOD who handle your request.
The event report form
The report form lets employees, suppliers and customers tell us about something suspicious. Your name, email and organisation are optional: you can report anonymously. We record what you write, when you say it happened, the system involved, and your network address and browser. The security team uses it to investigate. If a report turns out to be an incident we are legally required to report, the relevant details may be passed to the competent authority.
Orders
When you order a router subscription on this site or in the client portal, we receive what you enter: your name, email address and phone number; whether you order for an organisation or as a private person, and the organisation's name; its VAT or registration number when you give one; your country; the delivery name, address and phone number; and the order itself, meaning the routers and features you chose, the prices and prepayment shown to you, and any message. We also record the network address and browser the order came from and the version of this notice you agreed to, so we can recognise and stop abuse of the form.
We use it to review and accept your order, to issue the proforma invoice and the invoices, to deliver the routers and show you their tracking, to set up your account and send you its one-time sign-in details, and to handle a withdrawal, a refund or a return. The legal bases are the contract with you and the steps you asked for before it (Art. 6(1)(b) GDPR), and our legal obligations to keep accounting and tax records (Art. 6(1)(c)). The network address and browser are kept for our legitimate interest in keeping the form free of abuse (Art. 6(1)(f)). Without the details the form marks as required, we cannot accept or deliver the order.
Who receives it. DHL, the carrier, receives the delivery name, address and phone number and the parcel details it needs, to deliver the routers and to give us the tracking we show you in the portal. It handles them as a carrier in its own right, under its own privacy notice. For a delivery outside the EU, the customs authorities of the destination receive what the customs declaration requires. Emails about your order, including the sign-in details, are delivered through our email provider, as described under where your data is kept. Otherwise your order is shared only as described under who we share it with.
An order that never became a contract. If we decline your order, you cancel it before we accept it, or you withdraw from it, you can ask us to erase what you sent, and we will, except for any invoice or payment record the law requires us to keep. How long we keep order data otherwise is set out under how long we keep it.
Where your data is kept
Everything this site collects is stored and processed on servers in the European Union, in Germany. The one exception is email about an order: the sign-in details for your account and the other emails we send about an order are delivered through Microsoft's email service (Azure Communication Services, contracted with Microsoft Ireland Operations Limited), which may process them in the United States, under the EU-US Data Privacy Framework and the European Commission's standard contractual clauses. Otherwise we do not transfer personal data outside the European Economic Area. If that ever had to change, we would do so only with the safeguards the GDPR requires (an adequacy decision or the European Commission's standard contractual clauses) and we would update this notice first.
How long we keep it
| Data | Kept for |
|---|---|
| Server logs with visit data | Up to 30 days, then deleted, unless needed to investigate a specific security incident. |
| Audience counts | 90 days of daily totals. The scrambled value used to count a visitor once is kept only for the day it is made. |
| Daily limit counters | In memory, until the end of the day. |
| Free-tool results | IP lookup enrichment: a few hours, in memory. Vulnerability and file-scan results: for as long as they help answer repeat lookups. Uploaded files: deleted once scanned. |
| Contact requests and correspondence | 24 months after our last contact with you. If we enter into a contract, for the life of the contract and afterwards as long as the law requires us to keep business and accounting records (up to 10 years under the Bulgarian Accountancy Act). |
| Orders | For the life of the subscription, then five years, the general limitation period under Bulgarian law, so that claims about it can be answered. Invoices, payments and other accounting records: as long as the Bulgarian Accountancy Act requires (up to 10 years). An order that never became a contract: up to 24 months after our last contact with you, and erased sooner if you ask, except an invoice or payment record we must keep. |
| Event reports | As long as the investigation needs, and up to 5 years where a report becomes part of an incident record we are required to keep. |
You can ask us to delete your data sooner; see your rights.
How we protect it
Every connection to this site is encrypted, and so is every connection between our own servers. Access to what you send us is limited to the people who need it to answer you, and is logged. We build and run security systems for a living, and we apply them to ourselves: the servers behind this site are monitored, patched and protected by the same platform we sell. If a breach ever affected your data in a way that put you at risk, we would tell you and the supervisory authority as the GDPR requires.
Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you, and receive a copy (Art. 15).
- Correct it if it is wrong or incomplete (Art. 16).
- Have it deleted (Art. 17), unless we must keep it by law.
- Restrict how we use it while a question about it is resolved (Art. 18).
- Receive it in a structured, machine-readable form, or have it sent to someone else (Art. 20).
- Object at any time to processing based on our legitimate interests (Art. 21). We will stop unless we have compelling legitimate grounds that override yours, or need the data for a legal claim.
- Withdraw consent at any time where we rely on it, without affecting what was done before (Art. 7(3)).
To use any of these rights, write to greece@nbs-communications.com. It costs nothing. We answer within one month; for complex requests we may need up to two more months, and if so we will tell you why within the first month (Art. 12(3)). We may ask you to confirm your identity before we act, so that we never hand your data to somebody else.
Complaints
If you think we have handled your data wrongly, please tell us first so we can put it right. You also have the right to complain to a data protection supervisory authority (Art. 77 GDPR), in particular in the EU country where you live, work, or where you think the problem happened. Our lead authority is:
Commission for Personal Data Protection (Bulgaria)
2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
www.cpdp.bg · kzld@cpdp.bg
Children, other countries, changes
Children. This site is not directed at children, and only adults may place an order. We do not knowingly collect personal data from anyone under 16. If you believe a child has sent us their data, tell us and we will delete it.
Visitors outside the EU. We apply this notice to every visitor wherever they are. Visitors in the United Kingdom and Switzerland have the equivalent rights under the UK GDPR and the Swiss Federal Act on Data Protection. For visitors in California: we do not sell or share personal information as the California Consumer Privacy Act defines those terms, and we do not use it for targeted advertising.
Changes. When this notice changes, its version and date at the top change with it, and the cookie notice asks every visitor again. If a change affects how we use data you have already given us, we will tell you before it applies.