Privacy statement

HackMoat is the controller for the personal data described here. You can reach us at hello@hackmoat.com.

Contact data: name, email address, phone number and company of the people we work with.

Order and billing data: company details, invoice address, VAT number and payment status. Card details are handled by Stripe; we never see or store them.

Engagement data: the testing authorization, scope, findings and reports. During a test we may encounter personal data in your systems. We process it only as far as needed for the test, as a processor on your behalf, under the data processing terms in our agreement.

Website data: technical data such as IP address and browser type, needed to deliver this website securely.

To perform our agreement with you (Article 6(1)(b) GDPR): planning and carrying out the test, giving you access to the client portal and invoicing.

To meet legal obligations (Article 6(1)(c)), such as keeping financial records.

For our legitimate interest (Article 6(1)(f)) in operating a secure website and answering your questions.

We use a small number of service providers: Stripe for payments and Cloudflare for hosting and storage. They process data only on our instructions. Where data leaves the European Economic Area, we rely on the safeguards the GDPR requires, such as the EU Standard Contractual Clauses. We do not sell personal data.

Financial records are kept for seven years, as Dutch tax law requires. Engagement data and reports are kept for the duration of the agreement and deleted afterwards, unless you ask us to delete them earlier or the law requires otherwise. Contact messages are deleted when they are no longer needed.

You have the right to access, correct and delete your personal data, to restrict or object to its processing, and to data portability. Write to hello@hackmoat.com. We respond within one month.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

We protect data with encryption in transit, access control and the same scrutiny we apply to our clients. This website uses only strictly necessary cookies, for example to keep you signed in to the client portal. It does not use tracking or advertising cookies.