Privacy Policy
1. Data controller
The data controller is LTDEFEND DI TERFAI LYES, with professional address at Via Edmondo De Amicis, 12, 28100 Novara (NO), Italy, VAT number IT02764150039. Privacy requests: privacy@ltdefend.com.
No DPO is currently appointed. If a DPO is appointed, this notice will be updated with the relevant contact details.
2. Scope and categories of personal data
Depending on the features used, LTDefend processes registration and authentication data, company profile data, information entered in cybersecurity assessments, results and reports, technical and security data, transactional communications, plan information and technical payment references.
The data-minimisation principle applies: only data necessary for the stated purposes should be collected and transmitted.
3. Purposes and legal bases
3.1 Account and authentication
Creating and managing the account and providing access to the service: performance of a contract or pre-contractual measures, Article 6(1)(b) GDPR.
3.2 Company profile, assessments and reports
Providing assessments, calculating results and producing reports: Article 6(1)(b) GDPR.
3.3 AI analysis
Producing requested cybersecurity analyses and recommendations: Article 6(1)(b) GDPR. LTDefend minimises data sent to the AI provider and avoids unnecessary personal data.
3.4 Transactional emails
Account verification, password recovery and communications related to the service and payments: Article 6(1)(b) GDPR and, where applicable, Article 6(1)(c).
3.5 Payments and entitlements
Managing purchases, payments and service duration: Article 6(1)(b) GDPR. Tax and accounting obligations are based on Article 6(1)(c).
3.6 Security and abuse prevention
Protecting the service, preventing abuse, diagnosing incidents and ensuring operational continuity: legitimate interests, Article 6(1)(f) GDPR, with a documented balancing assessment where required.
4. Requirement to provide data
Data requested during registration, authentication, assessment, payment and service delivery is required to provide the corresponding features. Failure to provide it may prevent account creation or use of the requested feature. Optional data is identified separately.
5. AI, Security Score and automation
LTDefend uses automated calculations to produce Security Scores, risk levels and cybersecurity metrics and may use AI systems to generate analyses and recommendations.
These outputs are informational and decision-support tools. They do not automatically determine account acceptance, plan access or payment and do not currently produce legal or similarly significant effects under Article 22 GDPR. Any future change of this nature will require a new privacy assessment.
6. Recipients and service providers
LTDefend uses external providers, including Aruba for hosting and infrastructure, Resend for transactional emails, OpenAI for AI features and PayPal for payments. Roles, subprocessors and applicable terms depend on the services actually used and the relevant contractual documentation.
7. International transfers
For each provider, LTDefend assesses the privacy role, data categories, processing locations, applicable DPA or clauses and, where required, the transfer mechanism under Chapter V GDPR. PayPal is not automatically classified as a processor under Article 28 for every flow; its role depends on the service actually used.
8. Data retention
Data is retained for as long as necessary for the stated purposes. Account, company, assessment and report data is retained during the contractual relationship and afterwards only for termination, data-subject requests, security, legal claims and statutory duties. Verification and reset tokens are temporary; logs and backups follow proportionate retention and rotation periods; tax and payment data follows statutory periods. Data is then deleted or anonymised under the applicable policies.
9. Data-subject rights
Where applicable, data subjects may exercise rights of access, rectification, erasure, restriction, objection and portability by writing to privacy@ltdefend.com. LTDefend verifies identity and authority, identifies relevant data, assesses retention duties or third-party rights and records the response.
10. Consent and withdrawal
Processing required for the core service is not artificially based on consent. Where processing relies on consent, consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.
11. Complaint to a supervisory authority
Data subjects may lodge a complaint with the competent supervisory authority. For processing under Italian jurisdiction, the relevant authority is the Italian Data Protection Authority (Garante per la protezione dei dati personali).
12. Cookies and similar technologies
LTDefend uses technical session cookies required for authentication and security. The current configuration does not use first-party marketing or profiling trackers. The PayPal integration is assessed separately. The Cookie Policy is updated if cookies, trackers, third parties, purposes or consent mechanisms change.
13. Security
LTDefend applies technical and organisational measures appropriate to the risks of the service. Public information does not disclose technical details that could reduce the effectiveness of those measures.
14. Changes and versioning
The Privacy Policy and Cookie Policy are notices; viewing them does not automatically constitute consent. Every effective version is identifiable and reproducible. Material changes are published as a new version.
15. Privacy contact
For data-protection requests: privacy@ltdefend.com.