Privacy notice

Who is responsible

The controller is Sergio Peixoto Unipessoal Lda (trading as CodeBox Technology), NIF PT514270055, R. Padre Francisco Marques N55 3Dt, 4700-120 Braga, Portugal — codebox@codebox.pt. For anything about your data, write to that address.

What we collect

• What you type in the contact form on vigiaot.com: your name, company, email, (optionally) phone, and your message.
• What you type in the request form: your name, role, email and (optionally) phone; the company, plant/site, city and country; for purchases, optionally, invoicing details (legal name, VAT number, address, accounts-payable email); and your message.
• Details of the request: its type, the activation code of the computer and the license number, the app version and plan when the form is opened from iScanner, the language, and the link it came from (e.g. a LinkedIn post).
• For licenses we issue: the license register — customer, site, the computer's activation code, the keys and their dates.

Neither license.vigiaot.com nor the VigiaOT website stores your IP address; Cloudflare, which serves both, processes it to deliver the pages and protect them from attacks. The web server of codebox.pt — which redirects old codebox.pt/vigia links and serves the vulnerability-rule updates the VigiaOT software downloads — keeps the usual access logs (IP address, page, time) for security and operation, for a short period. Beyond downloading those rule updates, the VigiaOT software sends us nothing: it is activated offline and your scan data never leaves your computer. Its vulnerability analysis looks up public databases directly from your computer — the US NVD, CISA's list of known exploited vulnerabilities and, if you turn it on, the EU's EUVD (ENISA). They receive only search terms — manufacturer and product names, or CVE numbers — never the inventory itself: no addresses, serial numbers or site names.

Why, and on what basis

• To answer your message or request, arrange a demo, issue and manage licenses, and send you the key — steps you ask for before or under a contract (GDPR art. 6(1)(b)).
• To keep the license register and the record of what was issued, and to protect the form against abuse — our legitimate interest in running and securing the licensing service (art. 6(1)(f)).
• To issue invoices and keep them as tax law requires (art. 6(1)(c)).

We do not use your data for advertising, and we do not sell or share it for that purpose.

Who processes it for us

• Cloudflare, Inc. — hosting of this site and of the VigiaOT website, the database (stored in the EU), and the Turnstile check that the form is sent by a person; Turnstile processes technical data from your browser for that check only.
• Resend (Plus Five Five, Inc.) — sending our emails to you (EU region).
• EmailJS — delivering messages from the vigiaot.com contact form to our mailbox.
• The web hosting provider of codebox.pt — redirecting old codebox.pt/vigia links and serving the VigiaOT vulnerability-rule updates.

They act as our processors under data processing agreements. Where they handle data outside the EU, this is covered by the EU–US Data Privacy Framework and/or the European Commission's standard contractual clauses.

How long we keep it

• Contact-form messages, and requests that do not lead to a license: up to 24 months after our last contact.
• The license register and the requests behind it: for as long as the license can be used, and up to 5 years after, to answer questions about it.
• Invoicing records: for the period Portuguese tax law requires (currently 10 years).

Your rights

You can ask us for access to your data, its correction or deletion, to restrict or object to its use, and for a copy in a portable format — write to codebox@codebox.pt. Some data we must keep (e.g. invoices) even if you ask us to delete it; we will tell you when that is the case.

You can also complain to the Portuguese data protection authority, CNPD (www.cnpd.pt).

Cookies

Neither website uses tracking or advertising cookies or analytics, and fonts are served by the sites themselves. vigiaot.com remembers the language you choose in your browser (local storage). The license administration area, used only by our staff, uses a sign-in cookie.

Changes

If this notice changes, the new version is published here with its date.