Privacy Policy
Last updated: 28 August 2026 · GDPR compliant · Includes country-specific sections for France, Germany, Singapore and Hong Kong
Who we are
Sitetals.com is operated by QUIKFORGE LIMITED (trading as Sitetals), a company incorporated in Hong Kong (BR No. 79555262). Registered office: Unit 2A, 17/F, Glenealy Tower, No.1 Glenealy, Central, Hong Kong S.A.R. Director: Olivier Jobert. Contact: legal@sitetals.com
What data we collect and why
- Domain names you submit for scanning — to perform the compliance check you requested. Legal basis: contract performance (Art. 6(1)(b) GDPR).
- Email address — when you order a report, to deliver your access key and invoice. Legal basis: contract performance.
- Company name and billing address — collected at the time of purchase to issue a VAT-compliant invoice. Legal basis: legal obligation (Art. 6(1)(c) GDPR).
- Payment data — processed by Stripe. We do not store card numbers. Legal basis: contract performance.
- Contact-form messages — if you write to us, we process your email address and message to reply. Providing a name is optional; any name you give is used only to address our reply and is never added to invoices (invoices show your company name and billing address only). Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
- Technical logs — we operate on a data-minimised basis and do not retain visitor IP addresses or server access logs. Requests are processed transiently to serve pages and protect the service from abuse, but no IP-based access log is stored. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
Responsible Disclosure Outreach — Notice under Article 14 GDPR
As part of our compliance research programme, we send informational notifications to website operators whose sites show potential EU compliance issues. This involves processing generic business email addresses (e.g., info@, contact@) that are publicly listed on the operators' own websites or in their security.txt files. These notifications concern websites in France and Singapore only; for websites on German (.de) domains we send no notifications — scan only, no outreach. Because this data is not collected directly from the persons concerned, this section serves as the information notice required by Article 14 GDPR.
Source of the data: publicly accessible corporate websites, legal-notice pages, and security.txt files.
Categories of data processed: generic business email addresses only. We never process personal named email addresses unless they appear in a security.txt file in the context of a defined security-contact role.
Legal basis: Art. 6(1)(f) GDPR — Legitimate Interest. We have conducted a Legitimate Interest Assessment (LIA) which concludes that our interest in promoting transparency about EU data protection compliance, and the interest of the business operator in being informed of potential regulatory risks, is not overridden by the data subjects' privacy rights, given the following safeguards:
- Only one email is ever sent per domain — no follow-ups, no reminders
- Only generic business addresses are used (never personal named addresses unless listed in
security.txt) - No email tracking pixels or link-click trackers are used in outreach emails
- An immediate, permanent opt-out is provided in every email and at optout@compliance.sitetals.com
- All compliance checks were performed by passive, unauthenticated public HTTP requests only
Retention periods for these addresses are set out under "Data retention" below. You may also lodge a complaint with a supervisory authority in connection with this processing — see "Your rights (GDPR)" below.
Your right to object — Article 21(4) GDPR
Applicable to the Responsible Disclosure Outreach described above.
Because this data was not collected directly from you, we are required by Article 21(4) GDPR to draw your attention specifically and separately to the following:
You have the right to object at any time to our processing of your business email address for the purpose described above. We will always honour an objection to this processing: we do not apply a balancing test against you and will not continue processing on the basis of overriding legitimate grounds. An objection results in the immediate and permanent cessation of all processing of your data for outreach purposes.
To object: reply to the email with "Unsubscribe" / "Abmelden" / "Désabonner", or contact optout@compliance.sitetals.com. Full details of our methodology are published at sitetals.com/methodology.html.
What we do NOT collect
- No analytics tracking (no Google Analytics, no Matomo, no tracking pixels)
- No advertising cookies
- No third-party scripts that transfer data outside the EU
- No social media tracking buttons
Cookies
We use only one cookie — a first-party cookie to remember your cookie consent choice. No tracking, no analytics, no third-party cookies. See our Cookie Policy.
Data retention
Outreach notification email addresses — the generic business addresses used for the Responsible Disclosure Outreach described above — are removed from our outreach lists immediately on an unsubscribe request. Where there is no response, the address is deleted no later than 12 months after the email is sent. One exception: where a recipient has objected to the processing, we keep a minimal record — the email address only — for 3 years after the objection, solely as evidence that the objection was received and acted on. This corresponds to the applicable civil limitation period for demonstrating that the request was honoured (in Germany, § 195 of the Civil Code (BGB); in France, art. 2224 of the Civil Code). This record serves no other purpose.
Free scan results are retained for 90 days for operational purposes, then automatically deleted.
Paid reports are made available for download for up to 24 hours after generation, then deleted from our servers. Reports for large/enterprise plans may be available for up to 24 hours to allow download during business hours.
Email addresses and invoicing data are retained for the duration of the contractual relationship plus 10 years to meet legal accounting and record-keeping obligations.
Contact-form messages are retained until the enquiry is fully resolved, then for a maximum of 3 years (applicable civil limitation periods).
Your rights (GDPR)
You have the right to access, rectify, erase, restrict processing of, and port your personal data. The exercise of these rights is free of charge (Art. 12(5) GDPR); requests are responded to within 30 calendar days (Art. 12(3) GDPR). To exercise these rights, contact: legal@sitetals.com. You also have the right to lodge a complaint with the supervisory authority competent for you (Art. 77 GDPR) — see the country-specific sections below.
The right to erasure is subject to applicable legal retention obligations (Art. 17(3) GDPR — e.g. accounting law, limitation periods) that may require us to retain certain data for a defined period notwithstanding your request; where such an obligation applies, we will inform you of it in our response.
We do not rely on consent as a legal basis for any processing. Where processing is based on legitimate interest, you have the right to object at any time (Art. 21 GDPR) — for the outreach programme, see the dedicated Article 21(4) section above.
Data transfers outside the EU
This website is hosted on a Hostinger VPS located in Paris, France, within the European Economic Area. QuikForge Limited acts as controller and Hostinger International Ltd. as processor under Hostinger's Data Processing Agreement (rev. 2026-04-15). Although the primary hosting takes place within the EEA, certain ancillary processing by Hostinger (for example content-delivery caching, backups or support access) may occur outside the EEA; such residual transfers remain governed by the EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914) incorporated in that agreement. Payment processing is handled by Stripe, Inc. (USA), certified under the EU-US Data Privacy Framework.
Data Controller
QUIKFORGE LIMITED is the data controller within the meaning of Article 4, point 7, of the GDPR. Data-protection enquiries and requests from data subjects or supervisory authorities can be addressed to legal@sitetals.com and will be handled in accordance with applicable data-protection law. QuikForge Limited is not required to designate a Data Protection Officer under Article 37 GDPR and has not designated one; data-protection requests are handled directly by the data controller within a maximum of 30 days. Separately, a Data Protection Officer is designated under section 11(3) of Singapore's Personal Data Protection Act 2012 — see the Singapore section below.
France — GDPR / Loi Informatique et Libertés
For users in France, data protection is governed by the GDPR (RGPD) and the Loi Informatique et Libertés. The competent supervisory authority is the CNIL (Commission Nationale de l'Informatique et des Libertés); you may lodge a complaint at cnil.fr. A French-language version of this policy is published at sitetals.com/fr/privacy.html; both versions describe the same processing operations.
Germany — GDPR (DSGVO)
For users in Germany, data protection is governed by the GDPR (DSGVO) and the Bundesdatenschutzgesetz (BDSG). Complaints may be lodged with the data protection authority of the competent federal state (Landesdatenschutzbehörde): private-sector data protection in Germany is supervised by the 16 state authorities, not the federal BfDI. A German-language version of this policy is published at sitetals.com/de/privacy.html; both versions describe the same processing operations.
Singapore — Personal Data Protection Act (PDPA)
Sitetals provides compliance scanning services for websites operating in Singapore under the Personal Data Protection Act 2012 (PDPA). For users and website operators in Singapore, the relevant supervisory authority is the Personal Data Protection Commission (PDPC). If you have concerns about how we handle your personal data, you may lodge a complaint at pdpc.gov.sg. A dedicated Singapore version of this policy is published at sitetals.com/sg/privacy.html.
Data Protection Officer (DPO). Pursuant to section 11(3) of the Personal Data Protection Act 2012 ("PDPA"), QUIKFORGE LIMITED has designated Olivier Jobert as its Data Protection Officer. In accordance with section 11(5) of the PDPA, the DPO's business contact information is published here: legal@sitetals.com. We respond to access and correction requests as soon as reasonably possible, and where a request cannot be answered within 30 days we will notify you of the time by which we will respond.
We collect and process personal data in accordance with the PDPA's data protection obligations, including the purposes for collection, notification, and access/correction obligations. All data collected in connection with Singapore-jurisdiction scans is handled consistently with our general privacy practices described above.
Hong Kong — Personal Data (Privacy) Ordinance (Cap. 486)
Sitetals.com is operated by QUIKFORGE LIMITED, a data user established in Hong Kong. We handle personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO") and the six Data Protection Principles ("DPPs").
Personal Information Collection Statement (DPP1). When you use our service we collect the data described in "What data we collect and why" above (domain names, email address, company and billing details, and payment data processed by Stripe; we do not retain visitor IP addresses or server access logs). The purposes of collection are: performing the compliance scan you request, delivering reports and invoices, meeting accounting and legal obligations, and securing our service. Providing this data is voluntary, but without it we cannot provide the service or issue an invoice. Personal data may be transferred to the classes of transferees described in "Data transfers" above (our hosting provider and our payment processor); we do not sell personal data or transfer it for any other party's marketing.
Use and retention (DPP2, DPP3). We use personal data only for the purposes stated above or a directly related purpose, and retain it no longer than necessary, per the periods in "Data retention" above.
Security (DPP4). We apply reasonable technical and organisational safeguards against unauthorised access, processing, erasure, loss or use.
Openness (DPP5). This Privacy Policy sets out the kinds of personal data we hold and our main policies and practices for handling it.
Your access and correction rights (DPP6, ss.18–22). You may request access to, and correction of, the personal data we hold about you. A reasonable fee may be charged for complying with a data access request, as permitted by the PDPO. To make a request, contact our Privacy Compliance contact at legal@sitetals.com. You may also lodge a complaint with the Office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD) at pcpd.org.hk.