Privacy Policy
Version 1.2 · English translation of the German policy dated 4 July 2026 · Scope: secdrills.com
This English translation is provided for convenience. In case of discrepancies, the German version prevails.
Contents
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) for the processing of personal data on secdrills.com is:
BlueGravitas GmbH
Wiesengasse 20
8570 Voitsberg, Austria
Email: datenschutz@secdrills.com
Web: www.secdrills.com
No separate data protection officer has been appointed, as the conditions of Art. 37 GDPR are not met.
2. Principles of processing
We process personal data only to the extent necessary to operate the website and the platform. The legal bases are:
- Art. 6(1)(b) GDPR — performance of a contract and pre-contractual measures (registration, user account, handling of enquiries, platform operation)
- Art. 6(1)(c) GDPR — compliance with legal obligations
- Art. 6(1)(f) GDPR — legitimate interests (IT security, prevention of abuse and spam, business development)
- Art. 6(1)(a) GDPR — consent (where obtained in the individual case)
3. What data we process
3.1 Registration and user account
Registration is required to use the platform. We process first and last name, business email address, company/organisation, a password stored in encrypted form and the timestamp of registration.
Legal basis: Art. 6(1)(b) GDPR.
3.2 Lead and contact forms
You can get in touch with us through our forms (including the readiness check, the demo request, the page for executives and the contact form). We process the data you provide:
- first and last name
- (business) email address
- company / organisation
- phone number (optional)
- applicable regulation (e.g. NIS2, DORA)
- message / free text (optional)
The processing serves to handle your enquiry, to contact you and for business development. The data is stored in our database (Supabase, see section 5) and transferred to our CRM system Pipedrive for handling.
To prevent abuse and automated submissions (rate limiting/spam protection), your IP address is processed briefly when the form is submitted.
Legal basis: Art. 6(1)(b) and (f) GDPR.
3.3 Platform use and exercise data
When tabletop exercises (TTX) are run on the platform, we process the selected scenarios and configurations, answers and inputs during the exercise, timestamps/session duration and technical metadata (e.g. IP address) for security and stability purposes.
Legal basis: Art. 6(1)(b) and (f) GDPR.
3.4 Email delivery
We send transactional emails (e.g. confirmations of receipt and notifications) through our own sending infrastructure under the sender domain notify.secdrills.com. Every message that is not strictly necessary for the contract contains an unsubscribe link; unsubscribed addresses are kept on a suppression list to prevent further messages.
Legal basis: Art. 6(1)(b) and (f) GDPR.
3.5 Payment data
No payments are processed on the public marketing pages. For paid services within the logged-in platform, payments are processed by the external payment service provider Stripe, Inc. We do not store credit card or bank details ourselves.
3.6 Technical log data
When you visit the website, technical log data is recorded automatically (IP address, date/time, requested URL, HTTP status code). This data serves operation and security only and is deleted after 30 days at the latest.
Legal basis: Art. 6(1)(f) GDPR.
4. Cookies and local storage
We do not use any marketing cookies. Your usage behaviour is analysed only with your prior consent (category “Analytics” in the cookie notice, see section 4.1). Fonts are served locally from our server (no requests to Google Fonts).
As technically necessary storage we only use your browser’s local storage (localStorage):
cm_cookie_consent/cm_cookie_prefs— store your choice in the cookie notice.- Supabase session data — only in the logged-in area, for authentication.
4.1 Google Analytics 4 (only with consent)
For reach and usage analysis we use Google Analytics 4 (GA4), a service of Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. GA4 is loaded only after you have activated and saved the category “Analytics” in the cookie notice. Without this consent, no GA4 script is loaded and no analytics cookie is set.
After consent is given, GA4 sets cookies (including _ga, _ga_<ID>) to recognise returning visitors. Pseudonymous usage data is processed, such as pages viewed, approximate location, device/browser and interactions. Google uses the IP address only briefly for coarse geolocation and does not store it (IP anonymisation active).
You can withdraw your consent at any time with effect for the future by deactivating the “Analytics” category in the cookie notice. No further data is then transmitted to GA4.
Legal basis: Art. 6(1)(a) GDPR (consent) and § 165(3) of the Austrian Telecommunications Act (TKG 2021) (access to information stored on terminal equipment with consent).
The cookie notice offers the optional categories “Analytics” (controls GA4, see section 4.1) and “Marketing”; no services are currently active for “Marketing”, so selecting it does not result in any additional personal data being processed.
Legal basis for technically necessary storage: Art. 6(1)(f) GDPR and § 165(3) TKG 2021.
5. Processors and third-party providers
We use the following service providers as processors under Art. 28 GDPR. A data processing agreement (DPA) is in place with each provider.
| Provider | Purpose | Location | Hosting region | Transfer |
|---|---|---|---|---|
| Lovable Labs AB | Development and hosting of the front-end application | 🇸🇪 Sweden / EU | EU (selectable) | No third-country transfer |
| Supabase, Inc. | Database, authentication, back-end infrastructure | 🇺🇸 USA | EU-West (Frankfurt, AWS) | SCCs (EU 2021/914) |
| Amazon Web Services, Inc. | Cloud infrastructure (sub-processor of Supabase) | 🇺🇸 USA | eu-central-1 (Frankfurt) | SCCs (via Supabase DPA) |
| Pipedrive | CRM: management of enquiries and leads | 🇪🇪 Estonia (EU) / 🇺🇸 USA | EU / USA | SCCs (EU 2021/914) |
| Google Ireland Ltd. | Web analytics (Google Analytics 4), only with consent | 🇮🇪 Ireland (EU) / 🇺🇸 USA | EU / USA | SCCs + EU-US DPF |
| Lovable’s AI providers | AI-assisted code generation (platform development) | 🇺🇸 USA (expected) | — | SCCs (via Lovable DPA) |
Note on AI sub-processors
Lovable uses external AI providers for platform development. Data you enter while using the platform (exercise content, user inputs) is not used to train AI models.
6. Transfers to third countries
Some of the providers used are based in the USA (a third country within the meaning of the GDPR) or transfer data there. Transfers take place on the basis of the standard contractual clauses (SCCs) approved by the European Commission under Art. 46(2)(c) GDPR (Implementing Decision (EU) 2021/914).
Supabase: data is held in the AWS region eu-central-1 (Frankfurt, Germany). By default, data does not leave the EU region. The DPA including SCCs is in place.
Pipedrive: transferred lead and contact data is processed in the CRM; transfers to third countries are covered by SCCs.
Google Analytics 4: only with analytics consent can data be transmitted to Google servers in the USA. The transfer is covered by the standard contractual clauses (SCCs) in Google’s data processing terms; Google LLC is also certified under the EU-US Data Privacy Framework.
Lovable’s AI sub-processors: where AI providers are based in the USA, the transfer is covered by the Lovable DPA (including SCCs). A full list of Lovable’s sub-processors can be requested from dpo@lovable.dev.
7. Retention periods
Personal data is stored only as long as necessary for the respective purpose:
- User account: for the duration of the contractual relationship; after termination/deletion a retention period of at most 30 days for backup purposes, then complete deletion.
- Lead and contact enquiries: until the enquiry has been dealt with; in the case of business development until the interest ceases, and at the latest after 3 years (statutory retention periods under tax law remain unaffected).
- Exercise data (TTX results): for the duration of the contractual relationship, unless you actively delete it earlier.
- Log data: at most 30 days.
8. Your rights
Under the GDPR you have the following rights:
Access (Art. 15)
You can request information at any time about the data stored about you.
Rectification (Art. 16)
Inaccurate data can be corrected at any time.
Erasure (Art. 17)
You can request the erasure of your data unless statutory retention obligations prevent this.
Restriction (Art. 18)
You can have processing restricted, for example while the accuracy of data is being checked.
Data portability (Art. 20)
You can request a copy of your data in a common, machine-readable format.
Objection (Art. 21)
You can object at any time to processing based on legitimate interests.
Withdrawal (Art. 7(3))
Consent you have given can be withdrawn at any time with effect for the future.
Complaint (Art. 77)
You have the right to lodge a complaint with the competent supervisory authority.
To exercise your rights, contact: datenschutz@secdrills.com
9. Contact and complaints
For data protection enquiries you can reach us at:
You also have the right to lodge a complaint with the competent data protection authority. In Austria this is:
Austrian Data Protection Authority (Datenschutzbehörde, DSB)
Barichgasse 40–42, 1030 Vienna, Austria
You may also contact the supervisory authority of the EU member state in which you live or work.
10. Changes to this policy
We reserve the right to amend this privacy policy if the technical infrastructure, the providers used or the legal framework change. Registered users will be informed by email of material changes. The date of the last update is given above.