Privacy statement
Who we are
AxonScan is a service of Axon Factory, a trade name of M. de Jager Holding B.V., Kweeklust 7, 2203 ZB Noordwijk, the Netherlands, Dutch Chamber of Commerce 60613319. Axon Factory is the controller of the data you enter when you order and of the other processing on this page, except the payment itself (see Mollie below). Questions about your data go to support@axonfactory.ai.
Which data, what for and on which legal basis
| What for | Which data | Legal basis |
|---|---|---|
| Carrying out the order: the scan, the report, the email at the start and at delivery, the rescan, and handling anything that goes wrong. | Domain, company name, Chamber of Commerce number, invoice address (postcode and house number; we look up the street and city at PDOK), email address and the language of the report. | Performance of the contract (art. 6(1)(b) GDPR). If you order on behalf of an organisation, our legitimate interest in performing the contract with that organisation (point f). |
| Measuring through which channel orders come in. | The source of the link you came in on (a short code, for example for a LinkedIn post), with the order. | Legitimate interest (point f): knowing which channels work. We do not build profiles with it. |
| Recording who requested a scan and that they confirmed being authorised, and being able to handle reports about a scan. | Domain, version and hash of the text you saw, time, and a pseudonymised (hashed) version of your IP address and email address. | Legitimate interest (point f): being able to show that a scan was done at the request of someone authorised. |
| Limiting misuse with a cap on the number of orders per email address and per connection. | The pseudonymised (hashed) version of your email address and IP address. | Legitimate interest (point f): preventing AxonScan from being used to scan other people's domains. |
| The free preview: confirming your email address, running the scan, showing the result and limiting misuse. | Domain, the language of the page, the origin of the link (a short code), your confirmation of authority, a pseudonymised (hashed) version of your email address and IP address, and the summary of the result (score, counts per level and two titles). We only use your email address itself for the confirmation email. If you choose news, we keep it until we pass it on to the contact list after your confirmation (see News). | At your request, before entering into a contract (art. 6(1)(b) GDPR): giving you the preview you asked for. Limiting misuse with the hashed data and the limits: legitimate interest (point f). For news: consent (point a). |
| Comparing your website's score in the report with other scanned websites, and showing what changed at a next scan. | For the comparison: only the score, the date, the rule set version and a pseudonymised (hashed) version of the domain, so that every website counts once. No company name, no KVK number, no email address and no link to the order. Free previews and our own test domains do not count. For the comparison with your previous scan we only use the data we keep anyway (see the retention periods). | Legitimate interest (point f): giving customers an indication of how their website compares with others. The report only states a percentage, never which websites they are, and only once there are enough scans. |
| Exactly two reminders: on day 21 about the free rescan and on day 50 about the call and the refund. Every reminder has a stop link. | Email address, domain, order number and the end dates of the rescan and the refund. | Performance of the contract: the rescan and the refund are part of your order. |
| Booking and holding the introductory call, and refunding afterwards. | What you enter when booking in Microsoft Bookings, such as name, email address and order number, and the date of the call, which we note with the order. | Performance of the contract: the refund offer is part of your order. |
| Invoicing, refunding with a credit note, and the accounts. | Company name, Chamber of Commerce number, invoice address, email address, amount and order number. | Performance of the contract and a legal obligation (points b and c): the statutory tax retention period. |
| Excluding a domain through the abuse page, with a confirmation email to an address on that domain. | The domain and the email address you enter. We only use the address for that one email and do not store it. Of the link we only store a hash. | Legitimate interest (point f), at your request: making sure only someone from the domain can exclude it. |
| Answering questions and reports, also about a scan you saw in your log files. | Your email address, your name and what you write to us. | Legitimate interest (point f): answering your message. If you are a customer, also performance of the contract. |
| News about Axon Factory's services, only if you tick it separately with your order or with the free preview. For the preview it only applies if you leave it ticked when you start the scan. | Email address and company name, with the time of your choice and the version of the text you saw. We pass them on to Axon Factory's contact list. | Consent (point a). You can withdraw it at any time, in every news email or through support@axonfactory.ai. What we did before stays lawful. |
The scan results are about the technical settings of the domain: DNS records, certificates, headers, the names of cookies (never their value) and the hosts the home page connects to. We do not process personal data of visitors of the scanned website.
Where we write "hashed", we mean pseudonymised: the data is not stored readably, but can be traced back to you with additional information. It therefore remains personal data, and the periods and rights on this page apply to it too.
Who receives the data
We do not sell data. These parties receive data, each only what they need. Processors work on behalf of Axon Factory, under a data processing agreement.
| Who | What for and which data | Where and with which safeguard |
|---|---|---|
| Microsoft Azure | Hosting of the website, the database, the scans and the reports. Processor. | West Europe region (the Netherlands), within the EEA. |
| Resend | Sends the emails: at the start and the delivery, when a paid scan has to wait, the two reminders, the confirmation email when excluding a domain, and the confirmation email of the free preview. Receives the email address and the content of the email. Processor. | United States. Safeguard: the EU-US Data Privacy Framework or standard contractual clauses. |
| Microsoft 365 and Microsoft Bookings | The support and abuse mailbox, and booking the call. Receives what you email us or enter when booking. Processor. | Within the EU. For anything that does leave the EEA: the EU-US Data Privacy Framework or standard contractual clauses. |
| Mollie, through AxonHub | The payment and the refund. Mollie is an independent controller for this; Mollie's privacy statement applies to what Mollie does with your payment details. AxonHub is Axon Factory's own invoicing system and makes the invoice and the credit note with your company details and invoice address. | The Netherlands, within the EEA. |
| Founders | Axon Factory's bookkeeping. Receives the invoices and credit notes. Processor. | The Netherlands, within the EEA. |
| Anthropic | Writes the short summary at the top of the report. Only receives the codes and levels of the findings: no domain, email address, company details or website content, and therefore no personal data. | United States. No personal data goes there. Safeguard in the contract: standard contractual clauses. |
| PDOK (Dutch Land Registry) | Looks up the street and city from your postcode and house number. Only receives those two. | The Netherlands, within the EEA. |
| Axon Factory's contact list | Only if you choose news: your email address and company name (for the free preview the domain instead of the company name), with the time and the version of the text. Axon Factory manages this list itself. | Within the EEA. |
Transfers outside the EEA
We store your data within the EEA. Resend sends the emails from the United States; the EU-US Data Privacy Framework or the European Commission's standard contractual clauses apply to that. Anthropic in the United States receives no personal data. With Microsoft 365 and Bookings the data stays within the EU; for anything that does leave the EEA, the same safeguard applies. You can request a copy of the safeguard through support@axonfactory.ai.
How long we keep data
- The report, the evidence and the raw scan data
- 60 days after the delivery of each report; the report of a rescan has its own term of 60 days. Of a scan that failed: 60 days after it ended.
- The data for the comparison with other scans (score, date, rule set, hashed domain)
- 12 months after the scan, then deleted. A new paid scan of the same domain replaces the previous one. If you exclude the domain via the abuse page, we delete it at once.
- Your email address with the order
- Until there is nothing left to deliver: 60 days after the last delivery, and not while the rescan is open. After that only a pseudonymised (hashed) version remains, until the order is deleted.
- The order (domain, company details, invoice address, source of the link, date of the call), the authorisation log and AxonHub's messages about the payment
- 12 months, then deleted
- An order that was not paid
- 30 days
- The free preview
- The raw scan data 48 hours after the scan. After 30 days we delete the domain, the hashed email and the hashed IP address from the preview, and the link stops working; only counts remain, for up to 12 months. We keep your confirmation of authority (domain, time, text version, hashed email and hashed IP address) for 12 months if a scan ran, as with an order; without a scan we delete it after 30 days.
- Excluding a domain
- A request that was not confirmed: 7 days. A confirmed exclusion: as long as it stands, with only the domain. We do not store the email address.
- Sent emails at Resend
- Resend's retention period.
- The appointment in Microsoft Bookings and emails to support
- As long as needed to handle the call and the refund.
- Your choice for news on the contact list
- Until you unsubscribe.
- Invoices and credit notes
- 7 years (statutory retention period), in AxonHub and at Founders
A daily job deletes in AxonScan what is past its term.
Your rights
You have these rights over your personal data:
- Access: knowing which data we hold about you and getting a copy.
- Rectification: having incorrect or incomplete data corrected or completed.
- Erasure: having your data deleted, except what we have to keep, such as invoices.
- Restriction: having the processing paused, for example while we assess your request.
- Portability: getting data you provided yourself, which we use for the contract or with your consent, in a common file format.
- Objection: objecting to processing based on legitimate interest. We then stop, unless there are compelling grounds that take precedence.
- Withdrawing consent: for news you can always do so, without it changing anything about your order.
- Complaint: if you disagree with how we handle your data, you can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Email your request to support@axonfactory.ai. We respond within one month. After 60 days we only hold a hashed version of your email address; we then ask for your order number to find your order.
AxonScan assesses the settings of a domain, not a person. We take no decisions about you based solely on automated processing, and we do not build profiles.
Cookies
This site has no tracking or advertising cookies and no analytics. We only use a functional cookie that links your order to this browser, so you can see the status and your report. The source of the link is only kept in your browser, until you close the tab.