Because nobody likes to read long legal texts.

01Controller & Contact

02Scope of This Privacy Policy

This Privacy Policy covers every piece of personal data we process, whether it happens inside our own infrastructure or through strictly selected service providers acting on our instructions. “Personal data” means anything that can be linked to a real human being (Art. 4(1) GDPR).

We process data only where it’s necessary to provide, secure, and run our services, online or offline. This policy applies to:

• Every online or offline property we operate (website, landing pages, custom-built tools)
• Our official communication channels, including email and social platforms
• Any mobile applications we release now or in the future

In simple terms: if you interact with us through one of these channels, this Privacy Policy applies. If we ever work with your data outside these channels, you’ll know, because we’ll tell you upfront, clearly, and before anything happens.

03Your Rights under the GDPR

Under the General Data Protection Regulation (GDPR), you have several rights regarding how your personal data is handled. You can exercise any of these rights at any time by contacting us at privacy@routerfishers.com.

• Right of access (Art. 15 GDPR): Request information about the personal data we hold about you.
• Right to rectification (Art. 16 GDPR): Correct inaccurate or incomplete personal data.
• Right to erasure (Art. 17 GDPR): Request deletion of your data, unless we must keep it due to legal obligations.
• Right to restriction of processing (Art. 18 GDPR): Request limited processing under specific circumstances.
• Right to object (Art. 21 GDPR): Object to processing based on legitimate interests.
• Right to data portability (Art. 20 GDPR): Receive your data in a structured, machine-readable format or request its transfer to another controller.

04Data We Process & Retention Periods

05Purposes and Legal Bases (Art. 6 GDPR)

• Art. 6(1)(b) GDPR – Contract or pre-contractual steps
  Used when you contact us, request a free security check, or when we work together.
• Art. 6(1)(f) GDPR – Legitimate interests
  Ensuring secure website operation, preventing abuse, running anti-spam systems, maintaining server logs, and enabling efficient communication.
• Art. 6(1)(c) GDPR – Legal obligation
  Applies when accounting, documentation, or law enforcement regulations require us to retain certain data.

We rarely rely on consent because we use zero marketing cookies, no tracking, and no third-party analytics. Privacy is the default.

06Data Residency and Subprocessors

We use carefully selected subprocessors to host infrastructure and provide critical security functionality. Subprocessors only act on our documented instructions and are bound by Data Processing Agreements (Art. 28 GDPR).

07Employee Systems & Internal Security Environment

All employees work on hardened, company-controlled Windows machines. These systems follow strict security baselines, enforced update policies, and multi-layered access controls to prevent unauthorized access.

Every device runs modern endpoint protection and antivirus. For security reasons, we do not publicly disclose vendor names or specific protective technologies. Regardless of the tools in use, all processing is performed exclusively under GDPR-compliant conditions and never outside of the EU/EEA without legal guarantees.

Employee systems never transmit personal data to antivirus vendors, cloud services, or third-party processors unless a legal basis and a data processing agreement exist. The internal security environment is continuously monitored, access is restricted on a strict need-to-know basis, and every workstation is isolated, logged, and audited.

08Law Enforcement & Authorities

We do not share your personal data with authorities unless we are legally obligated to do so. This can happen under Art. 6(1)(c) GDPR where there is a legal obligation, for example in the context of terrorism, criminal investigations, or national security.

As a cybersecurity company, we may occasionally be approached by law enforcement or regulators. If that happens, we:

• Carefully review and validate the request.
• Strictly limit disclosure to the minimum amount of data required by law and directly tied to our services.
• Inform affected customers where legally and practically possible.

We will never give out your data voluntarily or for any purpose other than what the law explicitly requires.

09Data Protection Measures

We take the protection of your data very seriously. To safeguard it, we apply industry-grade and state-of-the-art security controls:

• Managed & secured devices only – all processing is done on company-owned devices with enforced security policies.
• Endpoint protection – every system runs advanced Endpoint Detection & Response (EDR) and modern antivirus software.
• Full logging & monitoring – relevant activity is continuously logged and monitored.
• Isolated environments – your data is processed in hardened, separated environments not directly accessible from the public internet.
• Strict access control – only authorised staff directly involved in your project may access your data, and always on a need-to-know basis.
• Regular updates & hardening – systems are kept up-to-date, hardened, and are regularly assessed against modern threats.

10Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Updates become effective once published on our website.

If we make significant changes, especially involving new subprocessors, you will be notified in advance by email or another prominent notice. You will be informed at least 30 days in advance of such changes taking effect.

You have the right to object to the use of a new subprocessor. Please note that an objection may result in termination of the contract if the purchased services rely on these subprocessors.

We will not appoint a subprocessor that would process personal data from our contractual relationship in a way that violates EU/EEA data protection standards.

This Privacy Policy is open source so anyone can reuse the overall structure and wording style for their own purposes. If you do, you remain fully responsible for your own legal compliance. Always adapt the content, purposes, and legal bases to your specific business and processing activities. Routerfishers is not responsible for how this text is used outside of our own services.