Política de privadesa
Darrera actualització: 22 August 2026
Who we are
Security Solved is an online marketplace that introduces clients to security professionals. We are the data controller for the personal data described in this policy.
Amb qui contracteu
- Entitat mercantil
- Registre pendent
- Domicili social
- Registre pendent
- Número de registre mercantil
- Registre pendent
- Número d'IVA
- Registre pendent
- Inscrita al Registre Mercantil
- Registre pendent
- Contacte
- Formulari de contacte
The service is operated from the Czech Republic. Your data is stored on servers in the Czech Republic — the database and any documents you upload never leave them. Your data is also processed in transit by our network provider outside the EU. See Subprocessors below, which explains why and on what legal footing.
What we collect
- Your account — email address, a hashed password (never the password itself), your language preference, and whether you have verified your email. If you sign in with Google, we store the identifier Google gives us, not your Google password.
- Your profiles — whatever you choose to publish: for security professionals a headline, biography, service categories, service area and an optional photo. For clients a display name and location. This is deliberately public: it is what the marketplace shows.
- Your activity on the platform — jobs you post, applications you send, and the messages you exchange with other members. Messages are stored so both sides can read the conversation. We do not read them routinely, but they are not end-to-end encrypted and are visible to us technically. The title you give a job is public — it is shown to anyone browsing, including visitors who are not signed in, alongside the category and the date you posted. The rest of the post, including the description and location, is visible only to signed-in members. Please keep addresses and other private detail out of the title.
- Documents you upload — certifications or licenses a security professional chooses to submit. These are stored outside the public web root and are never listed publicly. Please upload only licenses and professional certificates. Do not upload criminal-record checks, medical records, or other sensitive documents — we do not need them, and we ask you not to submit them.
- Payment records — the amount, currency and status of platform fees you pay, plus the reference Stripe gives us. Stripe holds your card details. We never see or store them.
- Technical and security records — for sensitive actions such as signing in, paying a fee, or a moderation decision, we record your IP address, browser user agent, and what was done, in an audit log. We also record which addresses we sent email to, and when, to stop the platform being used to send unwanted mail. If you send feedback, we store the page you were on and your browser user agent alongside your message. We also record the date you were last active, no more than once a day, so that a professional profile left unattended for a long time stops being listed — see How long we keep it below.
Why we collect it
- To run your account — signing you in, verifying your email address, letting you reset a forgotten password.
- To operate the marketplace — publishing your profile or job, showing it in search, and letting clients and security professionals contact each other.
- To take payment for platform fees — the one-off fee for publishing a job, and profile verification if you choose it. Note we are not involved in payment for the security work itself, which you arrange directly.
- To email you about things you asked for — verification links, password resets, and confirmation when you pay.
- To email you about activity on the platform — alerts for new jobs matching your categories, a notice when you have unread messages, and a reminder before your listing expires. You can turn these off at any time. Links to do so are in every such email.
- To keep the platform safe — detecting abuse, handling reports about members, moderating content, and preventing our email being used to send unwanted mail to others.
- To answer you — when you use the contact form or send feedback.
Legal bases
We rely on different legal bases depending on what we are doing:
- Performance of a contract (Art. 6(1)(b)) — running your account, publishing your profile and jobs, taking payment for platform fees, and delivering the email you asked for, such as verification and password resets.
- Legitimate interests (Art. 6(1)(f)) — keeping the platform secure, preventing abuse and fraud, handling reports about members, and the automatic request metadata processed by our network provider. We also rely on this for activity emails such as job alerts and unread-message notices, which you can switch off at any time.
- Legal obligation (Art. 6(1)(c)) — keeping records we are required to keep, including records relating to payments.
We do not use your data for advertising, we do not sell it, and we do not use it for automated decision-making that produces legal effects.
Subprocessors
We keep this list short deliberately. These are the third parties that process personal data on our behalf:
- Stripe (EU/US) — payment for platform fees, including your card details, which we never see.
- Resend (Ireland, EU) — delivery of our outgoing email: the recipient address and message content.
- Cloudflare (globally, at the location nearest you) — our network connection: your request as it travels to us, including your IP address.
- Google (EU/US) — only if you choose to sign in with Google: your email address and a Google account identifier.
Hosting is our own. The database and any documents you upload are stored on our own server in the Czech Republic and are not held by a third-party cloud provider.
About Cloudflare. Your connection reaches us through Cloudflare's network, which means it decrypts and re-encrypts your request at whichever of its locations is nearest you — potentially outside the EU. We rely on our legitimate interest in keeping the service reachable and protected from attack (Art. 6(1)(f)). Cloudflare is certified under the EU-US Data Privacy Framework, which covers transfers to the United States.
About Google sign-in. Signing in with Google is entirely optional — signing in with an email address and password works just as well, and if you never use the Google option, Google receives nothing from us. If you do use it, we ask Google for the minimum that identifies you: your email address and an account identifier, and nothing else. We do not request access to your contacts, calendar, files, or any other Google service, and we cannot see them.
We do not use any analytics or advertising provider.
How long we keep it
- Your account and profile — for as long as your account exists. When you delete it, we remove or anonymize your personal data as described below.
- Jobs you post and applications you send — a job stops accepting responses when it expires or you close it, but the record stays on your account until you delete your account. Applications are kept so both sides keep a record of who responded to what.
- A professional profile left unattended — if you do not use the site for an extended period, your profile stops appearing in search. Nothing is deleted: signing in again puts it back, unless you took it down yourself or it was removed by a moderator.
- Documents you upload — deleted when you delete the qualification, or when you delete your account.
- Messages — kept so the person you were talking to keeps a readable conversation, even after you delete your account or the job it was about is gone. Your own messages stay, attributed to "Deleted member" instead of your name. If both sides of a conversation have deleted their accounts, the conversation is deleted entirely.
- Payment records — kept for as long as tax and accounting law requires us to, which is longer than your account. These records show that a fee was paid. They do not contain your card details.
- Security and audit records — 24 months, then deleted. If a record relates to an ongoing investigation or dispute, we keep it until that concludes.
- Email delivery records — the address and time we sent to, kept briefly to enforce our own sending limits, then deleted.
When you delete your account, we erase your profile, your uploaded documents, and the personal details on your account. Some records are retained in anonymized form: audit entries keep what was done but no longer identify who did it, messages you sent stay in the other person's conversation attributed to "Deleted member", and records we are legally required to keep are retained without identifying you.
Security measures
We take the security of your data seriously, and we have made specific choices to protect it:
- Passwords are stored using Argon2 hashing — we cannot read your password, and neither could anyone who obtained our database.
- The connection to our site is encrypted with TLS, and browsers are instructed to refuse an unencrypted connection to us.
- Third-party scripts are blocked entirely. Our security policy prevents any external code running on our pages, which is how tracking and script-injection attacks usually reach a site.
- Session cookies are restricted so other websites cannot read them, and are not sent when you arrive from another site.
- Uploaded documents are stored outside the public web area and can never be reached by guessing a URL. Access is checked against the specific profile that owns the document — not merely whether you are signed in.
- Sensitive actions are audit logged, so we can investigate if something goes wrong.
- Abuse protection — we limit how often requests and emails can be sent, both at our network edge and within the application, to prevent the platform being used to attack others or to overwhelm it.
No system is completely secure. We aim to protect your data with the measures described above, but no service can guarantee absolute security.
Your rights
Under the GDPR you have the following rights over your personal data:
- Access — ask us for a copy of the personal data we hold about you.
- Correction — have inaccurate data corrected. Most of it you can edit yourself from your profile.
- Deletion — have your personal data erased. You can delete your account yourself from your account settings. See How long we keep it above for what survives and why.
- Restriction — ask us to stop processing your data while a dispute about it is resolved.
- Objection — object to processing we base on legitimate interests. For activity emails you can act on this directly by switching them off, using the link in any such email.
- Portability — receive the data you gave us in a machine-readable format.
- Withdraw consent — where we rely on consent, withdraw it at any time. Withdrawing does not affect processing that already happened.
To exercise any of these, contact us. We will respond within one month. If your request is complex we may need longer, and we will tell you within that first month if so. We do not charge for these requests, and we will not treat you differently for making one.
If you are unhappy with how we handle your data, you can complain to the Czech data protection authority, the Úřad pro ochranu osobních údajů (ÚOOÚ) — uoou.gov.cz — or to the supervisory authority in the EU country where you live.
Cookies
We use only cookies that are strictly necessary to run the site — to keep you signed in, to protect forms against cross-site attacks, and to remember your language choice. We use no analytics, advertising, or third-party tracking cookies, which is why you see no cookie banner: there is nothing to consent to. See our Cookie Policy for the detail.
Contact
Questions about your privacy, or want to exercise any of the rights above? Contact us and we will respond within one month — usually much sooner.