Privacy policy

We take the protection of your personal data seriously – precisely because our service itself works with sensitive findings and leak alerts. This policy informs you about which data we process, for what purpose, on what legal basis and for how long.

1. Controller

Ayzix IT Solution, Sebastian Scherf
Weyroth 96, 55543 Bad Kreuznach, Deutschland
E-mail: kontakt@zentrale-datenschutzstelle.de

“Zentrale Datenschutzstelle” is a private-sector service and not a public authority or public body.

2. Hosting and server location

Our systems are operated on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in Germany. No processing takes place outside the European Union unless expressly mentioned in this policy (payment processing, leak database). A data processing agreement under Art. 28 GDPR is in place with the hosting provider. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and efficient operation) and Art. 6(1)(b) GDPR in relation to customers.

3. Server logs

When you visit our website, the web server automatically processes: IP address, date and time, URL accessed, referrer, browser type and operating system, amount of data transferred and status code. These logs serve security, error analysis and defence against attacks (Art. 6 (1) (f) GDPR) and are deleted after 14 days at the latest, unless they are needed to investigate a security incident. Application logs contain no passwords, no document contents and no leak results.

4. Cookies and visitor statistics

We use technically necessary cookies without consent because the customer area does not work without them (§ 25(2) no. 2 TDDDG, Art. 6(1)(b) and (f) GDPR). Everything else – the visitor statistics described below – we use only if you expressly consent on your first visit.

Language and country selection

On your first visit we determine your country from your IP address in order to show the website in the appropriate language. The lookup takes place exclusively on our server using a locally stored country database (DB-IP.com, licence CC BY 4.0); the IP address is neither stored for this purpose nor passed on to third parties. Your choice in the language menu is stored for one year in the cookies zds_lang and zds_land (technically necessary, no consent required). The legal basis is Art. 6(1)(f) GDPR.

Visitor statistics with Microsoft Clarity (only with consent)

To understand how our website is used and to make it easier to understand, we use, with your consent, the Microsoft Clarity service of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Clarity records how you interact with our public pages: pages visited and their address, time spent, clicks, mouse movements and scrolling behaviour, device type, browser, operating system, screen size, approximate location (derived from the IP address) and a pseudonymous identifier. Usage statistics, heatmaps and session replays are created from this data. Input in form fields is masked before transmission.

Clarity is loaded exclusively on public pages. Not recorded are the customer area, the administration, the password check, pages with confirmation, invitation or reset links, two-factor sign-in and result pages of the phone number check. For this, Clarity sets the cookies _clck (identifier, up to 1 year) and _clsk (links page views within one session, 1 day); Microsoft may additionally set the cookies CLID, MUID, ANONCHK, MR and SM use.

The legal basis is your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). Microsoft may transfer data to the USA; Microsoft Corporation is certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR), and EU standard contractual clauses apply in addition. Microsoft also processes the data for its own purposes, such as improving its services; further information: privacy.microsoft.com and Clarity's cookie list. Clarity deletes the data after 13 months at the latest.

Withdrawal: You can withdraw your consent at any time with effect for the future by clicking in the page footer on “Cookie settings” and select “Only necessary”. Clarity will then no longer be loaded and its cookies will be removed. Declining has no disadvantages whatsoever for the use of our website.

5. Registration and customer account

An account is required to use the customer area. We process account type (private individual/business), first and last name, e-mail address, a password (exclusively as an Argon2id hash, never in plain text), for businesses additionally company name, domain, role and optionally VAT identification number, as well as the time and IP address of consent to the terms and conditions and privacy policy. The e-mail address is confirmed via a single-use, time-limited link. Optionally, you can enable two-factor authentication (TOTP); the associated secret is stored in encrypted form. Legal basis: Art. 6(1)(b) GDPR (contract or pre-contractual measures). Failed login attempts are logged for 30 days to protect against misuse (Art. 6(1)(f) GDPR).

6. Order data: findings, cases, monitored items

To provide our service, we process the data you send us with the order or that we collect in the course of research: names, e-mail addresses, domains, phone and fax numbers, addresses, findings (source, URL, data categories, risk classification, status), cases (type, other party, communication, deadlines, event history) and evidence. The principle of data minimisation applies: we collect only what is necessary for the respective order. Legal basis: Art. 6(1)(b) GDPR. Insofar as you store data of third parties (e.g. senders of advertising faxes), we process it on the basis of Art. 6(1)(f) GDPR to safeguard your legitimate interests in asserting your rights.

7. Leak check (Have I Been Pwned)

To check e-mail addresses and verified domains against known data leaks, we use the API of the service “Have I Been Pwned” (Superlative Enterprises Pty Ltd, Australia). The query is made exclusively server-side using our own API key; the e-mail address or domain to be checked is transmitted to the service. We store the results (leak name, date, data classes) in encrypted form and show them only to the authorised user and the responsible case handler. Cached responses are deleted after 7 days at the latest. Domain checks require proof of domain ownership. Legal basis: Art. 6(1)(b) GDPR; for third-country transfers we rely on the provider's standard contractual clauses (Art. 46(2)(c) GDPR).

Password check: Checking a password against the “Pwned Passwords” database takes place entirely in your browser. Only a five-character prefix of the SHA-1 hash is sent to api.pwnedpasswords.com (k-anonymity); the comparison takes place locally. Neither the password nor the full hash, the prefix, the result or your IP address are stored or logged by us.

8. Payment processing (Stripe)

Paid packages are billed via Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. When booking, you are redirected to Stripe Checkout, where you enter payment details directly with Stripe. We do not store any credit card or bank account data. We transmit to Stripe your e-mail address, name or company name, internal customer, organisation and package identifiers, as well as billing address and, where applicable, VAT identification number. From Stripe we receive status and invoice data (subscription status, invoice number, amount, payment status). You manage invoices, payment details, package changes and cancellation in the Stripe Customer Portal. Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR (retention under tax and commercial law). Stripe may transfer data to third countries and relies on EU standard contractual clauses for this. Further information: stripe.com/de/privacy.

9. Document uploads, virus scan and text recognition

You can upload evidence (PDF, PNG, JPG, EML). Every file is checked server-side for its actual file type, scanned locally with ClamAV for malware before release and stored in a private repository outside the web directory. Retrieval is only possible after a permission check via short-lived, signed links. Advertising faxes are analysed locally with Tesseract (text recognition) to capture sender, fax number, date and reference; the recognised text is stored in encrypted form. No external OCR or cloud services are used. Legal basis: Art. 6(1)(b) GDPR.

10. Data access request with power of attorney: proof of identity and proof of representation

At your request, we assert your data subject rights not merely as a messenger but act ourselves towards credit agencies, address brokers and company databases with a power of attorney granted by you. For this, we additionally process:

• Power of attorney: Your declaration, your name, place and date, your signature drawn in the browser and – as proof of signing – time, IP address and browser identifier. From this we generate a deed as a PDF and store its checksum.
• Proof of identity: the copy of your ID document that you uploaded. The bodies contacted may request proof if there are reasonable doubts about your identity (Art. 12 (6) GDPR). We expressly ask you to black out all details that are not required; only name, date of birth, address and validity are needed.
• For companies additionally: proof of your authority to represent the company (e.g. commercial register extract) and your role in the company.

We transmit the power of attorney and proof of identity exclusively to the bodies you have selected and exclusively together with the respective access request. Every transmitted copy bears a visible imprint stating purpose and recipient and is thus marked as a copy (§ 20(2) German Identity Card Act). It is not used for any other purpose.

Erasure: We delete ID documents and proofs of representation as soon as all contacted bodies have replied, at the latest 90 days after the start of the round, and immediately upon revocation – the file is then permanently removed within 7 days. We keep the power of attorney as proof of our engagement.

Withdrawal: You can revoke the power of attorney at any time without giving reasons in the customer area or informally by e-mail (§ 168 BGB). We then immediately stop any letters not yet sent.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract concluded with you) and Art. 6(1)(c) GDPR, insofar as the body contacted requires proof of identity. Providing the ID document is voluntary; without it, however, we cannot take over dispatch on your behalf – in that case you can send the letters yourself.

11. E-mail dispatch

We send transactional e-mails (confirmation links, password resets, deadline reminders, case notifications, invoice notices) and outgoing requests to other parties via an SMTP server of a German hosting provider with which a data processing agreement is in place. We log recipient, subject, time and delivery status, not the content. Legal basis: Art. 6(1)(b) GDPR.

12. Internal notifications

To respond quickly to new registrations, payments or contact enquiries, our team receives internal notices via the Telegram messenger. These notices contain only event types and, where applicable, the name of an organisation – no findings, leak results, documents or contact details of private individuals.

13. Contact form and e-mail contact

If you write to us via the contact form or by e-mail, we process your details (name, e-mail address, subject, message, IP address, time) to handle the enquiry. Legal basis: Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR. Enquiries are deleted after final processing, at the latest after 12 months, unless statutory retention obligations prevent this.

14. Event history and audit log

Security-relevant actions (sign-ins, status changes, permission changes, downloads, exports, administrative actions) are recorded in a tamper-proof, immutable log with time, acting person, affected record and IP address. This serves the traceability of your cases, security and the fulfilment of our accountability obligation (Art. 5(2), Art. 32 GDPR; Art. 6(1)(c) and (f) GDPR).

15. Recipients and data processing

Recipients of personal data are exclusively: our hosting provider (Hetzner), our e-mail provider, Stripe (payment processing), Have I Been Pwned (leak comparison), Microsoft (visitor statistics, only with consent) and – within the scope of the cases you commission – the respective other parties (e.g. data brokers, directory operators, advertisers) to whom we send access, objection or erasure requests on your behalf. Data processing agreements under Art. 28 GDPR are in place with service providers. No data is passed on for advertising purposes.

16. Retention period and erasure

• Account data: until the account is deleted; then a 30-day grace period, followed by permanent deletion.
• Cases, findings and evidence: up to 3 years after the case is closed, then automated deletion via scheduled deletion jobs; earlier on request.
• Invoice and payment data: 10 years in accordance with § 147 AO and § 257 HGB.
• Consent status (zds_consent): 6 months. Statistics data at Microsoft Clarity: at most 13 months.
• Cached leak responses: 7 days. Failed login attempts: 30 days. Server logs: 14 days.
• Documents deleted by you: 30 days in grace, then permanently removed.
• Proof of identity and representation for the data access request: until the round is completed, at most 90 days, then a 7-day grace period. Power of attorney deeds: 3 years as proof of the instruction.

17. Security

We apply technical and organisational measures under Art. 32 GDPR: transport encryption (TLS, HSTS), encryption of particularly sensitive fields (two-factor secrets, leak results, OCR texts) with AES-256-GCM, Argon2id password hashes, server-side sessions, CSRF protection, Content Security Policy, rate limiting, hardened system services, strict tenant separation, daily encrypted backups and regular restore tests. Because of the particular sensitivity of match and leak data, a data protection impact assessment under Art. 35 GDPR was carried out before operations began.

18. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on Art. 6(1)(f) GDPR (Art. 21). You can withdraw consent you have given at any time with effect for the future. To do so, please contact kontakt@zentrale-datenschutzstelle.de. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular with the State Commissioner for Data Protection responsible for your place of residence or for our registered office.

19. No automated decision-making

The risk classification of findings and leak alerts serves solely for your information and prioritisation. No automated decision with legal effect within the meaning of Art. 22 GDPR takes place.

20. Changes

We will adapt this privacy policy if our services or the legal situation change. The current version is always available at https://zentrale-datenschutzstelle.de/datenschutz.

Last updated: 12.09.2026