In short
- EU/EEA by default
- Data is processed in the EU/EEA unless something else has been agreed in writing.
- Customer projects have their own agreement
- When we process personal data for a customer, it is under a data processing agreement.
- Only what is true
- We name only standards and certifications we have actually been assessed against.
Two roles
On this website we are the data controller: we decide what happens to the information you send us. That is described in our Privacy.
In customer projects we often process data on the customer's behalf - for example in a system we build, run or support. Then the customer is the controller and we are the processor. That happens only under a written data processing agreement that describes which data is processed, for what, where, for how long, and with which security measures.
EU/EEA by default
We process data in the EU/EEA. If a service outside the EU/EEA is to be used in a project, we agree it with the customer in writing first, and the transfer only happens on a lawful basis for transfers and with documented safeguards.
Suppliers for this website
| Supplier | What they do | Where |
|---|---|---|
| Simply.com A/S | Hosting of the website and the database, sending the site's e-mail, and the mailboxes contact@duelundtech.com and support@duelundtech.com | Denmark (according to Simply's privacy policy) |
We have a data processing agreement with Simply. The suppliers in a customer project are listed in that project's data processing agreement.
Security on this website
- Everything is sent encrypted (HTTPS).
- The site loads no code from others, and the browser is told to run only the site's own.
- Signing in to the administration takes a password and a one-time code, and critical actions must be confirmed again.
- Passwords are stored only as a one-way code (a hash), never as they are.
- Keys and the database are kept outside the public part of the server.
- Everything done in the administration is written to a log that the site itself cannot change or delete; only its IP addresses are removed, after 12 months.
- Enquiries can only be read by the owner and by administrators whose role allows it; the support role sees support requests only.
- The database is backed up every day, and every backup is restored as a rehearsal, so we know it works.
- The forms are protected against spam without CAPTCHA and without cookies.
More about how the site is protected is on the page Security. Security problems are reported under Responsible Disclosure.
Personal data breaches
If we discover a personal data breach, we act under the General Data Protection Regulation: we report it to the Danish Data Protection Agency within 72 hours where the rules require it, and tell you without undue delay if the breach is likely to result in a high risk to you. Where we are the processor, we tell the customer without undue delay.
Standards and certifications
We name only standards and certifications we have actually been assessed against. What applies in a project is stated in that project's agreement.
Changes
When this page changes, it gets a new version number and a new date at the top. Earlier versions are listed at the bottom of the page.
Versions
- Version 1from Current