CSAEC Privacy & GDPR Information

This website is operated for CSAEC by CONNEXT EOOD, Dunav 35, Sofia Center, 1000 Sofia, Bulgaria. Privacy enquiries: info@connext-world.com.

Website data

The site has no contact forms or user accounts. Google Tag Manager is installed with Consent Mode defaults that deny advertising, analytics, ad-user-data and personalisation storage until the visitor accepts optional measurement. Loading the tag-management container may create a technical connection to Google. The hosting provider may process IP address, time, requested resource, browser/device data and security logs to deliver and protect the site, generally under GDPR Art. 6(1)(f), and Art. 6(1)(b) where pre-contractual action is requested.

Email and licensing enquiries

Information you send is processed to answer enquiries, prepare quotations, manage licensing or support contractual activity. Do not email sensitive scan data unless an approved secure channel is provided.

Application data

Core checks and results are designed for local processing. No report is automatically submitted to CONNEXT EOOD. Deliberate sharing through email or external software may involve other providers.

Your rights

Subject to law, you may request access, correction, erasure, restriction, portability or objection, withdraw consent where applicable, and complain to the competent supervisory authority.

Retention and security

Technical data should be retained only as necessary for delivery and security. Commercial records may be retained for contractual, legal and accounting obligations. Reasonable safeguards apply, but no internet transmission is risk-free.

Controller/contact: CONNEXT EOOD, Dunav 35, Sofia Center, 1000 Sofia, Bulgaria · info@connext-world.com

Privacy principles for cybersecurity information

Cybersecurity findings can become sensitive even when they do not directly name an individual. A report may disclose device names, account references, network addresses, open services, software versions, vulnerabilities or details about security controls. Organisations should classify this information, limit access and use secure channels when external review is genuinely necessary.

The local-first design of CSAEC helps reduce automatic external disclosure, but it does not remove user responsibility. Saving a report to a shared folder, attaching it to ordinary email, copying it into a ticketing system or using an optional third-party component can create additional processing. Before doing so, identify the recipient, purpose, legal basis, retention period and appropriate protection.

Data minimisation

Share only the information needed for the defined support or licensing purpose. An initial commercial enquiry usually does not require a full scan report. Where technical assistance is requested, consider whether identifiers can be removed, whether a summary is sufficient and whether the recipient needs every finding. Data minimisation supports both GDPR compliance and sound security practice.

Organisational responsibilities

Customers remain responsible for identifying their own role under data-protection law, providing employee notices where required, establishing internal access rights and selecting appropriate service providers. The presence of a privacy notice on this website is not a substitute for the customer’s own records, risk assessment or professional legal advice.

Incident and rights requests

Privacy or personal-data enquiries should be sent to info@connext-world.com with enough information to identify the request. Do not include unnecessary identity documents in the first email. If a security incident is suspected, use the authorised company contact channel and provide sensitive technical evidence only after a suitable exchange method has been confirmed.