Privacy Policy

Data collected and purposes

1. Website visitors (portguardnac.com)

• Technical data: IP address, browser, pages visited
• Purpose: security and aggregate traffic analysis
• Legal basis: legitimate interest (Art. 6(1)(f) GDPR)
• Retention: 30 days in system logs

2. Contact and demo requests

• Data: name, email, company, message
• Purpose: responding to commercial enquiries
• Legal basis: pre-contractual measures (Art. 6(1)(b) GDPR)
• Retention: 24 months from last contact

3. Trial download requests

• Data: full name, email address and company. With your request we store only its date and time, the version of the consent wording you accepted, whether you ticked the optional product-news box, and whether your download link has been used.
• Purpose: providing the 30-day trial (generating and emailing your personal download link), following up with you about the trial (setup help, trial expiry) and preventing abuse of the download form. If you tick the separate optional box, we also send you occasional product news and offers.
• Abuse prevention: to limit automated submissions, a pseudonymised (hashed) form of your IP address is recorded for each form submission. It is kept separately from your request, is not linked to your name, email or company, and is deleted after 24 hours.
• Legal basis: providing the trial and the related follow-up: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR), with your agreement recorded on the form; abuse prevention: legitimate interest (Art. 6(1)(f) GDPR); product news and offers: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time without affecting the trial.
• Processor: download-link emails are delivered by our email service provider acting as a data processor under Art. 28 GDPR.
• Retention: 24 months from your request, then deleted automatically, unless you become a customer, in which case the data becomes part of the customer relationship and is kept for its duration plus the period required by law. Download links expire after 24 hours.

4. Partner applications

• Data: legal business name, company registration or VAT/tax ID, registered address, country, website if provided, primary contact name, role, work email and optional phone; partner type, target markets, estimated annual volume, tier of interest and any message you provide. We also record the version of the application notice you acknowledged and the submission date.
• Purpose: checking business eligibility, contacting the applicant, and deciding whether to offer a partner agreement. Submitting an application does not itself create an account or a reseller agreement.
• Legal basis: steps requested before a contract where the applicant is an individual professional (Art. 6(1)(b) GDPR); otherwise our legitimate interest in evaluating B2B partner applications and preventing duplicate submissions (Art. 6(1)(f) GDPR).
• Retention: applications are retained for up to 24 months after submission. If a partnership is established, the resulting account and contractual records follow the registered-partner retention period below.

5. Registered partners (partner portal)

• Data: company name, contact name, email, address, VAT number
• Purpose: managing the contractual relationship, issuing the license
• Legal basis: performance of the contract (Art. 6(1)(b) GDPR)
• Retention: duration of the contract + 10 years (tax obligations)

6. Partners' end customers

• Data: company name, domain/hostname (technical)
• Purpose: generating and verifying the software license
• Legal basis: legitimate interest of the license holder
• Retention: duration of the license + 12 months

7. Website assistant (AI chat)

• Data: the questions you type into the assistant and its replies; a hashed, non-identifying form of your IP address used only for abuse prevention. No account, name or email is required to use it — please do not enter sensitive personal data in the chat.
• Purpose: answering product questions and improving the assistant and documentation; preventing spam and abuse
• Legal basis: legitimate interest in providing support and securing the service (Art. 6(1)(f) GDPR)
• Processor: messages are processed by our AI provider (Anthropic PBC) as a data processor under Art. 28 GDPR, solely to generate the reply
• Retention: chat transcripts are retained for up to 12 months, then deleted

8. Installed appliances (installation registry)

• Data: an installation ID assigned by us; a one-way hardware digest (SHA-256 of machine and board serial numbers and network MAC addresses), used only to recognise a repeated registration of the same appliance; software version; licence status, tier and evaluation stage; evaluation start date; dates of registration and of the last heartbeat. We do not collect hostnames, internal IP addresses, users, connected devices or configuration, and we do not store the IP address the request comes from. Appliances released before the registry report the same licence status with their daily update check; for those, the country derived from the IP address was recorded until October 2026 and is no longer collected.
• Purpose: counting installations and running evaluations. The registry sends no instructions to the appliance: the 30-day evaluation is enforced locally on the appliance, whether or not the registry is reachable
• Legal basis: legitimate interest in knowing the size and state of the installed base (Art. 6(1)(f) GDPR)
• Processor: the registry is hosted by Cloudflare, Inc. as a data processor under Art. 28 GDPR
• Retention: deleted automatically 12 months after the last heartbeat
• Opt-out: set PORTGUARDNAC_TELEMETRY=off in the portguardnac service of the appliance; software updates are not affected

Disclosure to third parties

Data is not sold or transferred to third parties. Any technical service providers (hosting, email delivery, the AI provider powering the website assistant, and Cloudflare for the installation registry) act as data processors under Art. 28 GDPR.

Data subject rights (Art. 15-22 GDPR)

• Access, rectification and erasure of your data
• Restriction of or objection to processing
• Data portability
• Withdrawal of consent (where applicable)

Requests to: [email protected] — response within 30 days. To stop product news, use the unsubscribe link in any message or write to the same address.

Complaints

You may lodge a complaint with the Maltese supervisory authority:
Office of the Information and Data Protection Commissioner (IDPC)
https://idpc.org.mt

Cookies

This site uses only technical cookies necessary for the portal to function (authenticated session). It does not use profiling cookies, third-party cookies or behavioural tracking systems. See the Cookie Policy.