RD SecurityDE (Deutsch)
Why nowSelf-checkServicesSOC 2 & ISO 27001PricingFAQBook a scoping call (opens Google Calendar in a new tab)
Book a scoping call (opens Google Calendar in a new tab)

~/privacy

Privacy Policy

This website sets no cookies and uses no analytics or tracking. Here is what is processed, and why.

Last updated: 3 November 2026 · Deutsche Fassung

Contents
  1. 1. Who is responsible
  2. 2. This policy at a glance
  3. 3. Hosting and technical log data
  4. 4. Domain name system
  5. 5. Cookies and similar technologies
  6. 6. Fonts, analytics and third-party content
  7. 7. Self-check and report question tool
  8. 8. Contacting us and booking a call
  9. 9. Business customers and penetration testing
  10. 10. Links to other websites
  11. 11. Transfers outside the European Economic Area
  12. 12. Recipients
  13. 13. Your rights
  14. 14. Your right to object
  15. 15. Do you have to provide data?
  16. 16. Automated decisions
  17. 17. Security
  18. 18. Changes

1. Who is responsible

The controller under the General Data Protection Regulation (GDPR) is:

RiveDrive UG (haftungsbeschränkt)
c/o tuesday coworking
Belziger Str. 69-71
10823 Berlin
Germany

Email: crew@rivedrive.com
Phone: +49 176 72438600

We offer our services under the name RD Security. You can find our legal representative in the Impressum. Please send privacy questions to the email address above.

2. This policy at a glance

  • This website sets no cookies and uses no browser storage.
  • It has no analytics, advertising, tracking, social media plug-ins or embedded third-party content.
  • Its fonts and files come from this website, not from third-party font or script services.
  • When you visit, our hosting provider processes technical data such as your IP address to deliver the site.
  • If you email or call us, we process what you send or tell us in order to reply.
  • If you book a call, Google processes your booking details on our behalf.
  • The self-check and the report question tool run in your browser. Your answers are not sent to us.

This policy covers this website and business contact with us. When we test a client’s systems, we act under a separate agreement, described in section 9.

3. Hosting and technical log data

This website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. Vercel is our processor for delivering the website and states that it is the controller of service-generated usage data.

What is processed: when you open a page, your browser sends technical data that the hosting infrastructure needs. This includes your IP address and a location derived from it, the date and time, the page requested, the response status, the referring page where your browser sends one, and your browser and system details.

Why: to deliver the website, keep it stable and secure, and investigate faults and attacks.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is operating a secure, working website.

How long: logs are kept for a limited period. Vercel sets the period and states that it then deletes or anonymises them. We do not use them for marketing and do not combine them with other data to identify visitors. If a log is needed as evidence of an attack, we keep the relevant part until the matter is resolved.

Vercel may process data in the USA and other countries. See section 11. More information is available in Vercel’s privacy policy.

4. Domain name system

The name servers for our domain are operated by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. When a device looks up our domain, the requesting name server’s IP address, which may be your internet provider’s or sometimes your own, reaches Cloudflare. Cloudflare sets how long it keeps this data, as described in its privacy policy.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is making our domain reachable and reliable. See section 11 for transfers.

5. Cookies and similar technologies

This website does not set cookies and does not store information on your device through local storage, session storage or similar technologies. It therefore does not ask for consent under § 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG), and it shows no cookie banner.

6. Fonts, analytics and third-party content

Our fonts and scripts are delivered from this website. Opening our pages does not make your browser contact font, analytics, advertising or social media providers.

7. Self-check and report question tool

The self-check on our home page and the report question tool on our SOC 2 and ISO/IEC 27001 page run entirely in your browser. Your answers are not sent to us and we cannot see them. We do not store them. The booking button in the self-check result opens our booking page without passing on your answers.

Your browser may restore form selections when you reload a page, and that stays on your device. The copy button places your question list on your device’s clipboard only when you press it.

8. Contacting us and booking a call

Our website links to our email address. Pressing such a link opens your own email program, and no data is sent until you send a message. You can also call us on the number in the Impressum.

What is processed: your email address or phone number, your name and company if you give them, your message and its metadata.

Why and on what basis:

  • To answer enquiries about or perform a contract, including scoping calls and proposals: Art. 6(1)(b) GDPR.
  • To handle other enquiries and business correspondence: Art. 6(1)(f) GDPR. Our legitimate interest is replying to you.
  • To keep records the law requires: Art. 6(1)(c) GDPR.

Email provider: we use Google Workspace, provided in the EEA by Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland, as our processor. Data may also be processed in other countries. See section 11.

How long: we delete enquiries once they are resolved and no longer needed. Business correspondence and accounting records are kept for as long as commercial and tax law requires, generally six to ten years (§ 257 German Commercial Code, § 147 German Fiscal Code).

Booking a call: our “Book a scoping call” buttons open a booking page in Google Calendar, part of Google Workspace. When you book, Google processes the name, email address and any other details you enter on our behalf, and the appointment appears in our calendar. We use this data to hold the call and prepare a proposal (Art. 6(1)(b) GDPR) and delete the calendar entry once it is no longer needed, unless it forms part of the business records described above. The booking page is a Google website, so Google may also process technical data such as your IP address there and may use cookies, as described in Google’s privacy policy. If you prefer, email us instead.

Please don’t send sensitive material by ordinary email. That includes credentials, vulnerability details and customer data. Ask us for an encrypted channel first.

9. Business customers and penetration testing

If you become a customer, we process the business contact details of your staff to prepare and perform the contract and for invoicing, under Art. 6(1)(b) and (f) GDPR, and to meet legal duties under Art. 6(1)(c) GDPR. Our legitimate interest is working with your staff.

Personal data we access while testing your systems is processed on your behalf under a data processing agreement (Art. 28 GDPR). For that processing, you are the controller, and the agreement and our legal terms apply rather than this policy.

Our pages link to external sources. Those sites receive data from you only if you follow a link, and their own privacy policies then apply.

11. Transfers outside the European Economic Area

Vercel, Cloudflare and Google may process data outside the EEA, including in the USA. Where this happens, transfers rely on an adequacy decision of the European Commission, in particular the EU-U.S. Data Privacy Framework for providers certified under it (Art. 45 GDPR), or on standard contractual clauses (Art. 46 GDPR). You can check a provider’s certification on the Data Privacy Framework list and can ask us for details of the safeguards.

12. Recipients

We share personal data only with the processors and providers named in this policy, with professional advisers such as tax advisers and lawyers who are bound to confidentiality, and with authorities where the law requires it. We do not sell personal data.

13. Your rights

Under the GDPR you have the following rights, subject to their legal conditions:

  • Access to your data (Art. 15)
  • Correction (Art. 16)
  • Deletion (Art. 17)
  • Restriction of processing (Art. 18)
  • Data portability (Art. 20)
  • Objection (Art. 21, see section 14)
  • Withdrawal of consent, with effect for the future, where processing is based on consent (Art. 7(3)). We currently do not rely on consent for this website.

To use these rights, email crew@rivedrive.com.

You can also complain to a data protection authority (Art. 77 GDPR). The authority responsible for us is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59-61
10555 Berlin
Germany
mailbox@datenschutz-berlin.de

14. Your right to object

Where we process your data under Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation (Art. 21(1) GDPR). We will then stop unless we can show compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims. If we ever use your data for direct marketing, you can object at any time without giving reasons (Art. 21(2) GDPR).

15. Do you have to provide data?

You can read this website without actively giving us any data. The technical data in section 3 is needed to deliver the pages. We need your contact details only if you want us to reply to you or enter into a contract with us.

16. Automated decisions

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

17. Security

This website is delivered over encrypted HTTPS and uses security headers, including a Content Security Policy. No online service can be guaranteed completely secure.

18. Changes

We update this policy when our website or the law changes. The date at the top shows the current version.