Entwurf – vor Veröffentlichung anwaltlich prüfen

Privacy Notice

Governing language. This English version is the only binding version. The German text is a non-binding convenience translation; where the two differ, the English version prevails.

Information pursuant to Articles 13 and 14 of the General Data Protection Regulation (GDPR) for the website https://unafortis.com and the licensing platform https://licensing.unafortis.com

1. Controller

UnaFortis OÜ
Kotkapoja tn 2a-10, 10615 Tallinn, Estonia
Registry code: 17624383
Email: privacy@unafortis.com · Telephone: ⟦TELEFON⟧

Data protection officer: ⟦DATENSCHUTZBEAUFTRAGTER – if appointed; otherwise delete this line (question P-01)⟧

2. What this notice covers – and what it does not

We, UnaFortis OÜ ("UnaFortis", "we"), make the software Mitigate and sell licences for it directly and through partners. This notice describes the personal data we process on our website, in our licensing platform and in the course of our business relationships (partners, direct customers, prospects).

Mitigate itself sends us no data. Mitigate runs entirely in the customer's environment – including the bundled AI language model and the contributor portal on the customer's internal network. It contains no telemetry, no usage statistics, no licence server and no update check that reports anything to us; the licence is verified offline against a signed file. Case, report and evidence data that a customer processes with Mitigate therefore never reach us, and our licensing platform has no field in which they could be stored. The customer (or a service provider engaged by the customer) is solely responsible for that data.

3. Licensing platform (licensing.unafortis.com)

The licensing platform is a closed portal for our staff and our partners' staff. There is no public registration; accounts are created by invitation only. End customers have no account.

3.1 User accounts and sign-in

3.2 Sessions, IP addresses and logs

• Sessions: On sign-in we store a session with the IP address, a hash of the browser identifier (user agent) and timestamps. A session ends after 8 hours of inactivity and at the latest after 12 hours; the record is deleted 7 days after it ends.
• Rate limiting: To protect against password guessing, counters per IP address or organisation are stored briefly and deleted when their time window has passed.
• Audit log: Security- and business-relevant events (e.g. sign-in and sign-out, invitations, licence issuance, purchase confirmations, changes to company details) are recorded with the time, the acting account, its email address, its organisation and the IP address. The log cannot be altered. Retention: ⟦AUFBEWAHRUNGSFRIST AUDIT-LOG⟧ (see question P-04 – the code currently provides no deletion).
• Web server access log: Our web server (Caddy) records for each request the IP address, time, method, requested path (without parameters; invitation tokens are redacted), status code, size and technical request headers such as the browser identifier. The log files are rotated at 20 MB and deleted after at most 14 rotations and at the latest after 90 days.
• Error logs: On unexpected errors the application records the internal account ID and the method and path of the request.

Purpose: operation, security and accountability of licence issuance (every licence confers a right to use paid software and cannot be changed afterwards). Legal basis: Art. 6(1)(f) GDPR; our legitimate interest lies in defending against attacks and in being able to show who issued which licence.

3.3 Cookies

The licensing platform sets exactly two cookies and embeds no third-party scripts, fonts, tracking or analytics services:

Both cookies are HttpOnly, Secure and SameSite=Lax. Storage on your device is based on § 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG) or the corresponding Estonian implementation of Art. 5(3) of the ePrivacy Directive (strictly necessary for a service you requested); further processing is based on Art. 6(1)(b) and (f) GDPR. (Question P-05: confirm that uf_locale qualifies as strictly necessary.)

3.4 Company and contact data of partners and customers

For each organisation with which we or our partners conduct licensing business, the platform stores: legal name, trading name if any, country, address, contact person (name, email, telephone), VAT number, and for partners additionally a billing email and billing address, the partner discount, and status (e.g. approved, suspended) with date, reason and the acting person.

• Data of our partners and direct customers we process as controller to prepare and perform contracts (Art. 6(1)(b) GDPR), to meet commercial and tax retention obligations (Art. 6(1)(c)) and to vet new partners before approval – commercial register, VAT number, website (Art. 6(1)(f)).
• Data of our partners' customers is entered into the platform by the respective partner. To that extent we process it on the partner's behalf under a data processing agreement (Art. 28 GDPR); the partner is the controller. (Question P-06: confirm the allocation of roles.)

3.5 Licences

A licence file contains: licence number, the end customer's company name, number of seats, issue and expiry date, a random value, the internal identifier of the issuing organisation and – for a sale through a partner – the partner's company name. This is personal data only where the company name designates a natural person (e.g. a sole trader). The file is digitally signed and cannot be changed afterwards; the platform keeps it together with the identity of the person who issued it.

3.6 Emails from the platform

The platform sends five kinds of message: invitation links, password-reset links, the licence file to the customer's stored contact address, expiry reminders (30 and 7 days before expiry) to that contact address and to the administrators of the issuing organisation, and notifications to UnaFortis's own administrators when a partner requests a purchase, when its first payment arrives and when a monthly payment fails. The sender is licensing@unafortis.com. For each attempt we record the kind, recipient address, subject, reference (account or licence number), result and time – never the content or the link. Retention of this mail log: ⟦AUFBEWAHRUNGSFRIST MAIL-LOG⟧ (question P-04). Copies of sent messages remain in the "Sent Items" folder of the mailbox at Microsoft 365: ⟦AUFBEWAHRUNGSFRIST POSTFACH⟧. Legal basis: Art. 6(1)(b) and (f) GDPR.

3.7 Purchases and payments (Stripe)

Partners' purchase requests (number of seats, term, price, status, confirming person) are stored in the platform. A purchase is paid monthly by a subscription with Stripe (⟦STRIPE-VERTRAGSPARTNER⟧), which also handles invoicing, VAT determination (Stripe Tax) and VAT number validation. For this we transmit the billing email address (or, where none is stored, the email address of the person buying), our internal purchase and company identifiers, the number of seats and the price. The billing address and VAT number are entered by the buyer directly at Stripe's checkout, as are payment details (card data, IBAN/SEPA mandate); we do not receive the payment details. From Stripe we receive and store the status of the payment, of the subscription and of each monthly invoice (net amount, VAT, total, period), and the buyer's country and VAT number. Legal basis: Art. 6(1)(b) and (c) GDPR. Stripe additionally processes certain data as an independent controller (e.g. for fraud prevention and financial regulatory obligations); Stripe's privacy policy applies to that processing. (Question P-07.)

4. Website (unafortis.com)

⟦WEBSITE SECTION – please provide: the website's hosting provider, whether server log files are kept and for how long, whether cookies, analytics, map, video, font or form services are embedded, whether there is a contact form or newsletter. The repositories do not contain the website; without this information this section cannot be written truthfully (question P-02).⟧

5. Contact, support and business correspondence

When you contact us by email or telephone, we process your details to handle the request and to perform the contract (Art. 6(1)(b) GDPR) or on the basis of our legitimate interest in responding (Art. 6(1)(f)). Please do not send us any case or report content from Mitigate in support requests; the software's diagnostic output is designed to contain none.

6. Recipients and processors

Agreements under Art. 28 GDPR are or will be concluded with the processors. Where data is transferred to a third country without an adequacy decision, this is based on standard contractual clauses (Art. 46(2)(c) GDPR) or certification under the EU-US Data Privacy Framework (Art. 45 GDPR). (Question P-03: confirm per provider.)

7. Retention

We keep personal data as long as required for the respective purpose. Specifically:

• Sessions: until 7 days after they end (they end at the latest 12 hours after sign-in).
• Web server access logs: at most 90 days.
• Backups: 14 days.
• User accounts: for the duration of the relationship; invitations not yet accepted can be withdrawn and are then deleted. ⟦DELETION CONCEPT FOR ACCOUNTS after the relationship ends – question P-04⟧
• Audit log: ⟦AUFBEWAHRUNGSFRIST AUDIT-LOG⟧; mail log: ⟦AUFBEWAHRUNGSFRIST MAIL-LOG⟧.
• Business records (purchases, invoices, issued licences): in line with statutory retention obligations, in Estonia generally seven years.

8. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21). Please contact privacy@unafortis.com. Where your request concerns data a partner has entered about its customers, we forward it to that partner, who is responsible for it.

You may lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or of the alleged infringement. The authority competent for us is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

9. Obligation to provide data, automated decisions

Account and company data are required to use the platform and to conclude a contract; without them we cannot set up an account or issue a licence. There is no solely automated decision-making, including profiling (Art. 22 GDPR); every purchase is confirmed by a person at UnaFortis and every new partner is approved by a person.

10. Security

The platform is reachable only over TLS (HSTS). The application itself has no access to the internet; email is sent through a separate service, and the licence signing key is held in a further process not reachable from the internet. Passwords, invitation and recovery codes are stored only as hashes, two-factor secrets encrypted, backups encrypted.

Last updated: ⟦STAND-DATUM⟧