Privacy policy

Last updated: 28 October 2026

Who is responsible for your data

Enclave Guard SLU, Avinguda Diagonal 532, 08006 Barcelona, Spain, is the controller of the personal data described in this policy. For anything about your data, write to info@enclaveguard.com. We have not appointed a data protection officer.

What this policy covers

This policy covers three situations: when you browse enclaveguard.com, when you send us a request or a message through one of its forms, and when we carry out a free Exposure Review or a Full Exposure Report that you ask for. Work we do for clients under a contract is covered by that contract and its data processing terms.

When you only browse

This website does not use cookies, analytics or advertising trackers, and it does not build profiles of visitors. To deliver the pages, our hosting provider, Cloudflare, processes technical data such as your IP address, browser type and the page requested, and keeps short-lived security logs. We use this data only to serve the site and protect it from attacks. The legal basis is our legitimate interest in running a secure website (Art. 6(1)(f) GDPR). If we turn on Cloudflare Turnstile to block spam on pages with a form, it will also process technical data from your browser, on the same legal basis. Our cookie policy gives the details.

When you use a form

We collect what you type into the form: your name, work email, company, company domain, role, phone number and message. For an Exposure Review, we also collect the names and roles of up to 3 executives, and for a Full Exposure Report, the names of your key suppliers. Optional fields stay optional.

We use these details to answer your request or message, to carry out the review or report you asked for, to arrange your briefing and, if you ask, to send you a quote. We do not use form data for newsletters or marketing campaigns. If we ever want to, we will ask for your separate consent first.

The legal basis depends on what you ask for. To prepare a review, a report or a quote you requested, it is the steps you asked us to take before a possible contract (Art. 6(1)(b) GDPR). To answer other messages, and to process the work contact details of you and the executives you name, it is our legitimate interest in answering business enquiries (Art. 6(1)(f) GDPR and Art. 19 LOPDGDD). The fields marked as required are needed to answer you. Without them we cannot handle your request.

Data about other people in an Exposure Review

To show an organisation what is exposed, we search public sources, collections of leaked data and underground forums and marketplaces for information about the organisation, its domain and the executives named in the request. The results can include personal data of its executives and staff: names, work email addresses, job titles, and the fact that a credential appeared in a leak, sometimes with a partial password. We do not look for, and do not keep, sensitive data or data about criminal offences. If we come across it, we discard it.

We process this data only to tell the organisation what is exposed and how to reduce the risk, and we share the findings only with the people who requested them. The legal basis is the legitimate interest of the organisation, and of the people concerned, in preventing fraud and attacks that use this information. EU law recognises this purpose as network and information security (Art. 6(1)(f) and Recital 49 GDPR). We have weighed this interest against the rights of the people concerned and documented that assessment.

Our safeguards: passive research only (we never log in to accounts, test passwords or touch any system); leaked passwords are never shown in full; findings go only to a requester whose email address belongs to the organisation's domain; and we keep the findings only for the period stated below.

Informing every person individually would take disproportionate effort and would warn attackers who hold the same data, so we publish this information here instead (Art. 14(5)(b) GDPR). When you request a review, you confirm that you are authorised to do so for that organisation, and we ask you to tell the executives you name.

If you are an executive or employee and think your data may be in a review, you can ask us for access or erasure, or object, at info@enclaveguard.com.

How long we keep your data

If a request or message does not lead to a contract, we keep it for up to 12 months after our last exchange and then delete it. We keep the findings of a free review or a report for after the briefing, unless you ask us to delete them sooner. If you become a client, your contract applies, along with the periods the law requires for tax and accounting records. After these periods we delete the data, or keep it blocked, out of normal use, only for as long as we may be held liable, and then delete it.

We do not sell personal data. We share it only with: the organisation that requested an Exposure Review or report (the findings about it); the providers below, which work for us under a data processing agreement and only on our instructions; and authorities when the law requires it. The providers are:

website hosting: Cloudflare
our email provider
the exposure-intelligence platform we use for reviews and reports: Cyber Intelligence House
spam protection on forms, if we turn it on: Cloudflare Turnstile

Transfers outside the European Economic Area

Some of these providers may process data outside the European Economic Area. When they do, the transfer relies on a European Commission adequacy decision, such as the EU-US Data Privacy Framework, or on the Commission's standard contractual clauses. You can ask us for a copy of the safeguards that apply at info@enclaveguard.com.

Your rights

You can ask us for access to your data, and you can ask us to correct it, delete it, restrict its use or send it to you in a portable format. You can also object to processing based on our legitimate interest. Write to info@enclaveguard.com with "Data protection" in the subject. We may ask you to prove your identity. Exercising your rights is free. We answer within one month, which we may extend by two months for complex requests, telling you why. You can also write to our postal address above. We do not take decisions about you based solely on automated processing.

If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es). You do not need to contact us first, but we would be glad to help.

How we protect it

We apply technical and organisational measures suited to the risk (Art. 32 GDPR), including encryption in transit for this website and its forms. Only the people who need your data to answer you or to do the work you asked for can see it.

Changes to this policy

We update this policy when our practices or the law change. The date at the top shows the current version.