This statement covers hackindex.nl and ordinary business contact with HackIndex: a request, an email or a vulnerability report.
Data seen during an assignment, such as a client's app, code or personal data, is not covered here. That falls under the SLA, the non-disclosure agreement and the data processing agreement with that client.
Version 1.2, 11 November 2026.
HackIndex is responsible for the data on this page. Questions about privacy can be emailed, encrypted with the PGP key if you like. There is no data protection officer, HackIndex is not required to have one.
There are no trackers or ads, and no analytics, videos or maps from other parties. Fonts and scripts come from hackindex.nl itself, so your browser does not connect to other companies during normal use.
Server log: IP address, time, requested page and browser. Needed to investigate outages and abuse. Legal basis: legitimate interest in a secure, working site. Kept for up to 30 days.
Session: your IP address and browser are stored with your session, so a form can be sent securely. Legal basis: legitimate interest. Deleted 5 days after your last visit.
Spam: to limit abuse of the request form and the statistics, an encrypted derivative of your IP address is kept for an hour at most. Your IP address itself is not stored for this.
Statistics: HackIndex counts itself how often pages are viewed, which site or campaign you came from, in which language and on what kind of device. For the request form it also counts which step is reached, only the name of the step and never what you fill in. This happens on its own server, without cookies and without storing your IP address or a fingerprint of your browser, so a visit cannot be traced back to you. Visits from bots and from servers in data centres are not counted: for that your IP address is compared during the visit with public lists of hosting providers, and not kept afterwards. Nothing goes to other parties. Legal basis: legitimate interest in knowing which pages help visitors. The counts are kept for 2 years.
Error reports: if something goes wrong on the server, or your browser blocks something against our security rules, a technical error report is sent to Sentry, our error monitoring within the European Union. It holds no visitor data: your IP address, the contents of forms and the address bar are removed before it is sent, and Sentry stores no IP addresses. Legal basis: legitimate interest in a working, secure site. Kept for up to 90 days.
Cookie | Purpose | Lifetime |
|---|---|---|
__Host-hackindex-session | Keeps your session, so a form can be sent securely | 5 days |
XSRF-TOKEN | Stops another site from sending a form on your behalf | 5 days |
Both cookies are strictly necessary. They need no consent, which is why there is no cookie banner. If you pick a light or dark theme, that choice is only kept in your own browser.
In the form you fill in your name, email address and what you want tested. Company and job title are optional. Without a name and email address HackIndex cannot reply.
The request is encrypted with PGP in your browser before it is sent. Without JavaScript this happens on the server, before anything is stored. The key to decrypt it is not on the server. The notification HackIndex receives only says there is a request, not what is in it.
Legal basis: steps prior to a contract, because you ask for a proposal. A request is deleted automatically 12 months after it came in, unless it leads to an assignment.
If you email HackIndex, your name, email address and what you write are used to reply. Legal basis: steps prior to a contract, or legitimate interest if it is about something else. Email is kept for up to 12 months after the last contact, unless it leads to an assignment.
For an assignment the names, email addresses and phone numbers of contacts are used, plus the company's invoicing details. Legal basis: performing the contract and the legal duty to keep records. Invoices and records are kept for 7 years, as Dutch tax law requires.
If you report a vulnerability, your name and email address are only used to handle the report and keep you informed. Reporting under a pseudonym is fine. Your name is only mentioned if you want it to be. Legal basis: legitimate interest. The report is kept while it is open and for one year after that as a record.
Only parties needed to run the site and email: the hosting provider and the email provider, and for error reports an error-monitoring service (Sentry), all within the European Union and under a data processing agreement. For invoices also the accountant. Your data is not sent to countries outside the European Economic Area, never sold and never used for marketing.
The site only works over HTTPS and uses strict security headers. Requests are stored encrypted, the admin requires two-factor authentication and no more is kept than needed. No automated decisions are made about people.
You may access your data, have it corrected or have it deleted. You may also ask to restrict processing, object to processing based on legitimate interest, and have your data transferred. Email your request and you will get an answer within a month. Extra information is only asked for when it is needed to know the request comes from you.
If you are not happy with how HackIndex handles your data, email first so it can be looked at together. You may also file a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.
If anything changes in what HackIndex processes, this page is updated and gets a new version and date.
