ES
Consigue Shieldix

Legal

Política de privacidad

Esta página solo está disponible en inglés. El texto en inglés es el oficial.

Borrador. Este texto está en preparación y todavía no se aplica. This text was prepared with the help of software and must be reviewed by a qualified lawyer before publication.

shieldix.uk, the Shieldix plugin and Shieldix Cloud are provided by Nexys S.r.l., registered office Galleria Arrigo Protti 2, 34121 Trieste (TS), Italy, VAT number (Partita IVA) IT01447020320 (“Nexys”, “we”, “us”).

For the processing described in this policy, Nexys S.r.l. is the data controller under Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”), except where this policy says that we act as a processor for our customers (see “Our role for the data of your website’s visitors”).

Questions about your data and requests to exercise your rights: [PRIVACY CONTACT EMAIL], or by post to Nexys S.r.l., Galleria Arrigo Protti 2, 34121 Trieste (TS), Italy. [DATA PROTECTION OFFICER, IF ONE IS APPOINTED]

Representatives for people outside the EU: [REPRESENTATIVES IN THE UK (ARTICLE 27 UK GDPR), SERBIA, TURKEY AND UKRAINE, IF REQUIRED — LAWYER TO CONFIRM]

  • Nexys S.r.l.
  • Registered office: Galleria Arrigo Protti 2, 34121 Trieste (TS), Italy
  • VAT number: IT01447020320 (P.IVA 01447020320)
  • Companies register: Registro delle Imprese di [REGISTRY], REA no. [REA NUMBER]
  • Share capital: [SHARE CAPITAL, WITH “I.V.” ONLY IF FULLY PAID UP]
  • Certified email (PEC): [PEC ADDRESS, IF IT IS TO BE PUBLISHED]
  • Contact: the contact form or [CONTACT EMAIL]

Requests to shieldix.uk pass through Cloudflare, which protects and speeds up the site on our behalf, and reach our server at [HOSTING PROVIDER AND COUNTRY]. The server logs [SERVER LOG FIELDS] and keeps the logs for [SERVER LOG RETENTION]. We use them to deliver the site, to find faults and to protect the site against attacks and abuse, on the basis of our legitimate interest (Article 6(1)(f) GDPR) in a working and secure website.

On your first visit to an address without a language in it, the site picks a language from the country of your IP address, as Cloudflare reports it, and from the languages your browser asks for. The site does not store the country or the address for this.

If you choose a language in the language menu, the site remembers it in a cookie. The site uses no analytics and no advertising, and loads no fonts or scripts from other servers. Cookies: see the cookie policy.

Your name, email address and message are sent to us by email, and we keep them as long as we need to answer you and to follow up ([CONTACT MESSAGE RETENTION]). We use them to answer you: when you ask about our services, on the basis of steps taken at your request before a contract (Article 6(1)(b) GDPR), otherwise on the basis of our legitimate interest in answering the people who write to us (Article 6(1)(f) GDPR).

To allow at most 3 messages an hour from one address, the site keeps a keyed hash of your IP address (for IPv6, of its /64 network), not the address itself, until one hour after your last message. It also keeps a site-wide count of messages for the last hour, with no address in it, to limit how many messages all visitors together can send. This protects the site against spam (Article 6(1)(f) GDPR).

The site shows a WhatsApp chat button (two clicks). It sets no cookies and loads no scripts, images or fonts from WhatsApp or Meta: it is a plain link, and nothing is sent to WhatsApp unless you choose “Open WhatsApp”.

If you do, WhatsApp opens, and WhatsApp Ireland Limited (Meta) processes your use of WhatsApp, including your phone number and your messages, as an independent controller under its own privacy policy, which also governs its transfers of data outside the EEA.

We receive your phone number, your WhatsApp profile name and your messages. We use them only to answer you, on the basis of Article 6(1)(b) GDPR when you ask about our services and Article 6(1)(f) GDPR (our legitimate interest in answering the people who write to us) otherwise, and keep them for [CONTACT MESSAGE RETENTION]. [HOW WE USE WHATSAPP: WHATSAPP BUSINESS APP, OR A PROVIDER THAT PROCESSES THE MESSAGES FOR US]

The plugin runs on your WordPress site. Its firewall events and activity log stay in your site’s database and are deleted after 30 days. Nothing is sent to us unless you connect the site to Shieldix Cloud.

From your server, the plugin contacts:

  • api.wordpress.org and the WordPress.org download and code servers: official checksums, original files to restore, and whether a plugin was closed;
  • Google and Bing: their published lists of crawler addresses, to recognise fake search engine bots;
  • WPVulnerability.net, only if you turn on vulnerability checks: the slugs of your plugins and themes and your WordPress version.

For the data of your own visitors that the plugin handles on your site, you are the controller as the owner of your site. The plugin suggests text for your privacy policy and supports WordPress’s tools to export and erase personal data.

Nothing is sent to Shieldix Cloud until an administrator connects the site with a code and agrees to what is sent. Then the plugin sends:

  • When the site is connected: the site’s domain, the version of Shieldix and the events of the last 24 hours.
  • After that, every 5 minutes, new firewall events. Each event holds the time; the type of event, its severity and what the firewall did; the rule that matched, the rule IDs and messages and the anomaly score; how many requests it covers; the request method; the path without its query string; the attacker’s IP address; and the reference number shown on the block page.
  • Once an hour: the versions of Shieldix, WordPress and PHP, and the firewall mode.
  • With every request, as with any connection over the internet: the IP address of your server.

Query strings, form data, cookies, passwords, visitors’ user agents and your content are never sent. The same list is on the Shieldix Cloud page. In the panel you can also add IP addresses and ranges to your never-block list.

We use this data to show your incidents, to run Shieldix AI and the shared list of attackers, and to keep the service secure.

Shieldix Cloud keeps events and incidents for 90 days, also after a site is disconnected; deleting your account deletes them at once. You can disconnect a site at any time, from the plugin or from the panel.

The events a connected site sends are about the visitors of your website, for example the IP address and the path of a blocked request. For these data you, the owner of the website, are the controller, and Nexys S.r.l. processes them on your behalf as a processor under Article 28 GDPR, only to provide Shieldix Cloud to you and on your instructions.

The terms of that processing are in our Data Processing Agreement at [DPA LINK], which is part of the terms of service. It lists the sub-processors we use for Shieldix Cloud. Visitors of your website who want to exercise their rights should contact you; we will help you answer them.

For the shared list of attackers (below) we act as an independent controller, because we decide to combine reports from several sites to protect all of them.

On paid plans, Shieldix AI looks at serious firewall incidents and explains them. Shieldix AI never receives IP addresses: it gets the rules matched, the paths, the counts and the descriptions of the rules.

This analysis is carried out for us by [AI PROCESSOR] as our processor (sub-processor for your website’s data), in [AI PROCESSOR LOCATION AND TRANSFER SAFEGUARDS]. [CONFIRM FROM THE AI PROCESSOR’S CONTRACT THAT IT DOES NOT USE THE DATA TO TRAIN ITS MODELS]

On the result of the analysis, Shieldix AI can block the IP address of that incident on that one site for 24 hours. It never blocks the address of your own server, private addresses or addresses on your never-block list, and it makes at most 20 such blocks a day per site; everything else goes to the site owner as a notice.

An IP address goes on the shared list when, within 24 hours, sites of 3 different customer accounts report it for attacks, or when Shieldix AI rates an attack as urgent. Connected sites with a paid plan download the list and block those addresses. An address stays on the list for 24 hours the first time, then twice as long each time it comes back, for at most 7 days. Private addresses and the server addresses of protected sites never go on the list. Reports of an address are deleted 7 days after the last one.

Legal basis: our legitimate interest, and that of our customers and their visitors, in the security of networks and information (Article 6(1)(f) GDPR and recital 49). We have balanced this interest against the rights of the people behind those addresses: the list holds only the IP address and its time on the list, only addresses that sent attack traffic to several protected sites, only for a short time, and blocking an address only stops requests to protected sites. If you think your address is on the list by mistake, you can object (see “Your rights”).

For your account we keep your email address, language, password (only as a hash), two-step sign-in secret, the time and IP address of your last sign-in, your active sessions with their IP address and browser user agent, and a log of account actions with the IP address. Two-step sign-in is required for every account; after five wrong attempts an account is locked for 15 minutes.

We use these data to provide the service you signed up for (Article 6(1)(b) GDPR) and to keep accounts secure and to investigate misuse (Article 6(1)(f) GDPR).

We keep them while your account exists. You can export your data or delete your account at any time in the panel; deleting it deletes your sites, events, incidents, never-block list, sessions and the log of account actions at once. Payment records stay, as required by law (see “Payments”). [BACKUP RETENTION]

To buy a plan or AI credits you need an account in the shop on shieldix.uk. We keep your email address, your name if you give it, your password (only as a hash), whether you have confirmed your email address, the language you bought in, and your orders and invoices: what you bought, the amount, the currency, the date and PayPal’s references. For a plan we also keep the subscription: plan, billing period, status, the date until which it is paid, and your consent to start the service before the withdrawal period ends, with the time you gave it and the version of the text you agreed to.

We use these data to sell and deliver the plan or the credits and to manage the subscription (Article 6(1)(b) GDPR), and keep orders and invoices for 10 years as the law requires (Article 6(1)(c) GDPR, see “Payments”). [SHOP ACCOUNT RETENTION AFTER THE LAST PURCHASE]

When you buy, the shop sends Shieldix Cloud your email address, whether you confirmed it, your language, a random customer number and the subscription’s number, plan, billing period and paid-until date; later also its renewals, its end and refunds, and the AI credits you bought. Shieldix Cloud uses them to give your site the plan, to open your panel account or add the purchase to your existing one (only for a confirmed email address), and to issue the activation key.

Your activation key is stored in the shop only in encrypted form. Shieldix Cloud keeps a hash of it, and an encrypted copy of its answer to the shop that holds the key for at most 30 days (so a repeated request of the shop gets the same answer). You see the key in My account, and the shop sends it to you once, in full, in the welcome email to your address; that email passes through our email provider ([EMAIL PROVIDER]), our processor, like every email we send. No email to us contains the key. Treat it like a password: anyone who has it can use your plan on a site. If you lose it, get a new one in My account; the old key then stops working.

Right after a purchase, the shop sends you an order confirmation: what you bought, the price, our company details, the consent you gave at checkout (its text, version and time) and the information on your right of withdrawal.

The download links of the plugin are personal and work for 24 hours and for at most 5 downloads. For each link we keep, in your shop account, how many times it was used, until the link expires; the download itself is recorded in the server logs like any other request (see “Visiting this website”).

We send the emails the service needs: confirming your email address, resetting your password, and notices about your sites and your account (for example when Shieldix AI pauses because no analyses are left). For a purchase, the shop sends the welcome email with your activation key and a download link, payment receipts, a reminder 7 days before a yearly plan renews, and notices when a subscription is cancelled, put on hold or ended, or when your key is released or replaced. They are sent through [EMAIL PROVIDER], our processor, on the basis of Article 6(1)(b) GDPR. We do not send newsletters or advertising.

Payments are handled by PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg) as an independent controller under its own privacy policy. We receive the status, amount and currency of each payment and PayPal’s references to your subscription or order; we never see your card or bank details.

We keep payment records and invoices, and the data needed on them, for 10 years, as required by article 2220 of the Italian Civil Code and Italian tax law (Article 6(1)(c) GDPR). The checkout for AI credits asks for the billing details shown on its form; the invoice of a plan holds the name and email address of your shop account. [INVOICE DATA REQUIRED FOR ITALIAN ELECTRONIC INVOICING (NAME, ADDRESS, COUNTRY, VAT OR TAX NUMBER) — ACCOUNTANT TO CONFIRM]

  • Article 6(1)(b) GDPR, contract: your account, Shieldix Cloud for your sites, plans and AI credits, the emails the service needs, and answering questions about our services.
  • Article 6(1)(c) GDPR, legal obligation: invoices and payment records (Italian accounting and tax law), and answers to lawful requests of authorities.
  • Article 6(1)(f) GDPR, legitimate interest: the security of this site and of Shieldix Cloud (server logs, rate limits, the log of account actions), the shared list of attackers, and answering other messages. Where we rely on it, we have balanced our interest against your rights, and you can object at any time.
  • Article 6(1)(a) GDPR, consent: connecting a site to Shieldix Cloud (an administrator agrees to what is sent) and turning on vulnerability checks in the plugin. You can withdraw your consent at any time by disconnecting the site or turning the checks off; this does not affect what was done before.

We do not sell personal data and we do not share it for advertising. Only these recipients get personal data, and only what they need:

  • our processors, bound by a contract under Article 28 GDPR: our hosting provider [HOSTING PROVIDER AND COUNTRY], Cloudflare (protection and delivery of the site), [EMAIL PROVIDER] (emails) and [AI PROCESSOR] (Shieldix AI, without IP addresses);
  • independent controllers, under their own policies: PayPal (payments) and, if you use it, WhatsApp (Meta);
  • [ACCOUNTANT OR TAX ADVISER, FOR INVOICES];
  • public authorities, when the law requires it.

We are in Italy and keep Shieldix Cloud’s data in [COUNTRY OF THE CLOUD SERVERS]. When a provider processes personal data outside the European Economic Area, we transfer it only to a country covered by an adequacy decision of the European Commission (Article 45 GDPR) — for example the United Kingdom, or the United States for companies certified under the EU-U.S. Data Privacy Framework — or under the European Commission’s Standard Contractual Clauses (Article 46(2)(c) GDPR), with additional measures where needed. You can ask us for a copy of these safeguards.

  • Cloudflare: [CLOUDFLARE TRANSFER SAFEGUARDS];
  • [EMAIL PROVIDER]: [EMAIL PROVIDER TRANSFER SAFEGUARDS];
  • [AI PROCESSOR]: [AI PROCESSOR LOCATION AND TRANSFER SAFEGUARDS].

Customers in Norway are in the EEA and covered by the GDPR. For customers in the United Kingdom, Serbia, Turkey and Ukraine, their data come to us in the EU: [TRANSFER RULES UNDER UK, SERBIAN, TURKISH AND UKRAINIAN LAW — LAWYER TO CONFIRM]

  • Server logs of this site: [SERVER LOG RETENTION].
  • Contact form and WhatsApp messages: [CONTACT MESSAGE RETENTION]; the keyed hash for the contact form’s limit: one hour after your last message.
  • Language cookie: 1 year in your browser.
  • Events and incidents in Shieldix Cloud: 90 days.
  • Blocks by Shieldix AI: 24 hours.
  • Addresses on the shared list: 24 hours the first time, at most 7 days; reports of an address: 7 days after the last one.
  • Account data: while your account exists; deleted when you delete it. [BACKUP RETENTION]
  • Payment records and invoices: 10 years (article 2220 of the Italian Civil Code).
  • Shop account and subscriptions: while your shop account exists. [SHOP ACCOUNT RETENTION AFTER THE LAST PURCHASE]
  • Contents of the shop’s messages to Shieldix Cloud about your purchases (they carry your email address): 90 days after delivery.
  • Counters of download links: until the link expires.
  • Firewall events and activity log in the plugin, on your own site: 30 days.

No law obliges you to. Without an email address and a password we cannot open an account, without the events of a site Shieldix Cloud cannot protect it, and without your email address we cannot answer the contact form. Everything else is up to you.

We make no decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR).

The firewall and Shieldix AI block IP addresses that attack a protected website, for a limited time and only on the websites that use Shieldix. This is a security measure that the owner of the website has chosen for it; it is not a decision about you as our customer, and for the person behind the address it only stops requests to those websites. Customers see every block in the panel and can unblock an address or add it to their never-block list at any time.

Under Articles 15 to 21 GDPR you have the right to access your data, to rectification, to erasure, to restriction of processing, to data portability (the panel’s export gives you a copy of your account data), and to object at any time to processing based on our legitimate interest, for reasons relating to your situation. Where processing is based on consent, you can withdraw your consent at any time, without affecting what was done before.

Write to [PRIVACY CONTACT EMAIL]. It is free. We answer within one month; for complex requests this can be extended by two further months, and we will tell you why. We may ask you to confirm your identity, for example from the email address of your account.

You also have the right to lodge a complaint with a supervisory authority: in Italy, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or the authority of the country where you live or work or where an infringement took place. Outside the EU: in the United Kingdom the Information Commissioner’s Office, in Norway Datatilsynet, in Serbia the Commissioner for Information of Public Importance and Personal Data Protection, in Turkey the Personal Data Protection Authority (KVKK), in Ukraine the Ukrainian Parliament Commissioner for Human Rights.

Shieldix is a service for website owners and is not meant for children. You must be at least 16 to create an account and at least 18 (and able to enter into contracts) to buy a plan or AI credits. We do not knowingly collect data of children under 16; if you think we have, write to us and we will delete it.

  • Encrypted connections (HTTPS) between your browser, your site and Shieldix Cloud; requests from connected sites are signed and every answer of Shieldix Cloud is signed as well.
  • Two-step sign-in is required for every account; passwords are stored only as a hash; sessions end after 60 minutes without activity and after 12 hours at most; sensitive actions ask for a new code.
  • Each customer sees only their own data; link codes are stored only as a hash, and site keys are not stored but derived when needed.
  • The panel has a strict content security policy, and data from your sites are always shown as text.
  • Data are minimised: query strings, form data, cookies and visitors’ user agents are never sent; Shieldix AI never receives IP addresses; events are deleted after 90 days.
  • [SERVER HARDENING, BACKUPS AND STAFF ACCESS — TO BE CONFIRMED AFTER DEPLOYMENT]

We will update this policy when the service or the law changes, and show the date of the version in force below. We will tell account holders about important changes by email before they apply.

This version applies from [DATE].