Privacy Policy and Legal Notice

On the public site, nothing you don’t type in yourself. There are no analytics, no tracking and no third-party advertising. Bookings go through Calendly, described below.

Fly.io, which hosts the site in Frankfurt, processes your IP address in short-lived server logs to deliver pages and protect against abuse. Cloudflare provides the site’s DNS. Legal basis: our legitimate interest in running a secure site (GDPR Art. 6(1)(f)).

The contact and GTM Build pages embed a scheduler provided by Calendly. It loads only on those pages. When you book, the name, email address and any notes you enter are processed by Calendly on our behalf so we can hold the meeting. Legal basis: taking steps at your request before entering into a contract (GDPR Art. 6(1)(b)).

Calendly may set its own cookies inside the embedded scheduler and processes data under its own privacy policy.

If you ask for a free template by email, we keep your email address and which template you asked for, and send it through Resend, our email provider. We may send you the occasional follow-up note about our services. Legal basis: your request (GDPR Art. 6(1)(b)) and our legitimate interest in following up with someone who asked us for something (Art. 6(1)(f)). Reply “stop” or use sdxstudio.co/opt-out and we won’t email you again.

We contact managed security service providers about our own services. For that we use business contact details only (name, job title, employer, work email and sometimes a business phone number), from public sources and business data providers. Legal basis: our legitimate interest in offering a relevant service to a business (GDPR Art. 6(1)(f)). We are the controller of those details.

We also run outreach for the security providers we work for, finding the right business contact at companies showing public signs that they may need security services, such as an open security role or new compliance work. There we act as the provider’s processor under a data processing agreement. The provider is the controller of your details and owes you its own privacy notice.

To object, reply to any message from us or add your email at sdxstudio.co/opt-out. We keep that address on a suppression list so you are not contacted again, by us or for any of our clients. To ask what is held about you, write to seif@sdxstudio.co, or to the provider that contacted you. You can complain to the Belgian Data Protection Authority (gegevensbeschermingsautoriteit.be).

The site sets no cookies of its own. The embedded scheduler on the contact and GTM Build pages may set cookies that belong to Calendly.