Privacy Policy

1. Controller / Responsible Person

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Privacy contact: contact@shadowthreats.com

2. Website Access & Technical Delivery

This website is hosted using Vercel. When you access the website, technical request information required for delivering and protecting the service may be processed, including IP address, request timestamp, requested resource, HTTP status information, browser or user-agent information and related technical metadata.

This processing is used for website delivery, service reliability, troubleshooting and protection against abusive or malicious traffic.

3. Aggregate Website Analytics (Plausible)

This website uses Plausible Analytics to understand overall, aggregate website traffic and visitor trends in a privacy-respecting manner.

The purposes of this aggregate measurement are:

• understanding aggregate website usage and visitor counts,
• identifying which research topics and pages are useful to practitioners, and
• improving the content, navigation and technical performance of the site.

Plausible is configured with the following characteristics on this website:

• No advertising cookies or marketing trackers are used.
• No personal behavioral profiles or cross-site tracking profiles are established.
• Google Analytics is not used.
• Meta Pixel or social marketing trackers are not used.

Plausible states that visitor analytics data is processed and stored within the European Union and that raw IP addresses are not stored.

We describe this measurement conservatively: while Plausible is designed to minimize data collection and avoids persistent device identifiers, technical request metadata may still be processed transiently in memory to produce aggregate counts.

4. Direct Communications

If you contact ShadowThreats by email, we process the information you voluntarily provide, such as your name, email address, professional affiliation and the content of your message.

This information is used to respond to your communication and, where relevant, to evaluate professional contact relating to the ShadowThreats practitioner network.

Access to the practitioner network is invitation- or trusted-referral-based. Contacting ShadowThreats does not create membership or any entitlement to access.

5. Legal Basis for Processing

Direct professional communications are generally processed on the basis of Art. 6(1)(f) GDPR, based on our legitimate interest in responding to relevant professional enquiries and maintaining professional communications.

Where communication is necessary to take steps at the request of a person prior to entering into a contract, Art. 6(1)(b) GDPR may apply.

Technical delivery of the website is likewise based on our legitimate interest under Art. 6(1)(f) GDPR in providing a reliable, performant and secure web presence.

6. Data Retention

Personal data is retained only for as long as reasonably necessary for the purpose for which it was collected and to fulfil applicable legal obligations.

Ordinary professional correspondence is retained only for as long as reasonably necessary for the relevant communication and relationship, subject to applicable legal retention requirements.

Where an ongoing professional or network relationship exists, relevant correspondence may be retained for the duration of that relationship and deleted when it is no longer reasonably required, subject to applicable statutory retention requirements.

7. Categories of Recipients

Personal data is treated confidentially and is not sold or shared with third parties for commercial or advertising purposes. Technical delivery and communication involve processors within the following categories:

• Hosting and technical delivery provider (Vercel Inc.),
• Email service provider (for receiving and processing correspondence sent to our contact address),
• Analytics provider (Plausible Analytics, aggregate measurement without marketing cookies).

8. International Data Transfers

Some technical service providers may process personal data outside the European Economic Area.

Where personal data is transferred to a third country and no applicable adequacy decision provides the required level of protection, appropriate safeguards are used as required under the GDPR, such as the European Commission's Standard Contractual Clauses.

Vercel's data-processing terms provide for appropriate transfer mechanisms where transfers of protected data outside the EEA occur.