GDPR Compliance

01 Our Commitment to GDPR

SwarmHawk is headquartered in the Czech Republic, an EU member state, and the General Data Protection Regulation (GDPR) — Regulation (EU) 2016/679 — applies directly to our operations. We take GDPR compliance seriously as both a legal obligation and a core business value.

This page provides a structured overview of how SwarmHawk complies with GDPR requirements, both as a data controller (when processing user account data) and as a data processor (when scanning domains on behalf of business customers).

02 Roles: Controller vs. Processor

SwarmHawk as Data Controller

When you create an account and use our platform, SwarmHawk acts as the data controller for the personal data you provide (email, name, organisation). We determine the purposes and means of processing that data.

SwarmHawk as Data Processor

When your organisation uses SwarmHawk to scan your own domains and those domains may involve personal data (e.g. employee subdomains, email addresses in WHOIS records), SwarmHawk acts as your data processor. In this capacity:

• We process personal data only on your documented instructions
• We do not use your data for any purpose other than providing the Service
• We assist you in fulfilling data subject requests relating to data we process on your behalf
• We notify you without undue delay if we become aware of a breach affecting your data

Enterprise customers can request a Data Processing Agreement (DPA) by contacting hello@swarmhawk.com. The DPA covers all Art. 28 GDPR requirements and includes our standard contractual clauses for sub-processors.

03 Data We Process & Legal Bases

We apply data minimisation: only data necessary for the stated purpose is collected. Fields marked optional in forms are genuinely optional and not required to receive the core service.

04 Your GDPR Rights

As a data subject under GDPR, you have the following rights. We respond to all requests within 30 days (extendable by 2 months for complex requests, with notice):

To exercise any right, use the form in Section 9 or email hello@swarmhawk.com. If you are unsatisfied with our response, you have the right to lodge a complaint with the Czech Office for Personal Data Protection (ÚOOÚ):

05 Sub-Processors

We use the following sub-processors to deliver the Service. All are bound by data processing agreements and appropriate transfer safeguards:

We will notify affected customers at least 30 days before adding a new sub-processor that processes personal data, giving customers the opportunity to object.

06 International Transfers

Some sub-processors are based in the United States, a country that does not benefit from a blanket EU adequacy decision. We protect these transfers using:

• Standard Contractual Clauses (SCCs) — European Commission Decision 2021/914 (Module 2: controller-to-processor, Module 3: processor-to-processor)
• Transfer Impact Assessments (TIAs) — Conducted for each US-based sub-processor, assessing US surveillance law risk and supplementary measures
• Data minimisation — We send only the minimum necessary data to each sub-processor (e.g. Anthropic receives domain names and scan output only, not user account information)

Copies of our SCCs are available on request at hello@swarmhawk.com.

07 Data Breach Response

Our incident response procedure for data breaches complies with GDPR Art. 33–34:

1. Detection & Containment — Our security monitoring identifies anomalies; on-call engineers assess and contain the incident
2. Assessment — We assess the nature, scope, and likely consequences for data subjects within 24 hours of discovery
3. Supervisory Authority Notification — We notify the ÚOOÚ within 72 hours if the breach is likely to result in a risk to individuals' rights and freedoms
4. User Notification — We notify affected users without undue delay if the breach is likely to result in a high risk to their rights and freedoms, including the nature of the breach, data categories affected, likely consequences, and measures taken
5. Documentation — All breaches (regardless of notification threshold) are documented in our internal breach register

To report a suspected security issue, contact security@swarmhawk.com. For responsible disclosure, we offer a coordinated disclosure programme.

08 SwarmHawk as a Tool for Your GDPR Programme

Beyond our own compliance, SwarmHawk helps your organisation meet GDPR obligations by monitoring domains under your control:

• Email security (SPF, DKIM, DMARC) — Weak email authentication enables spoofing and phishing, a common route for GDPR-reportable data breaches
• SSL certificate monitoring — Expired certificates can expose user data in transit; GDPR Art. 32 requires appropriate encryption
• Blacklist & breach monitoring — Detects if your domain or IPs appear in threat feeds, indicating a possible compromise requiring GDPR Art. 33 notification
• Subdomain takeover detection — Dangling DNS records can be hijacked to harvest user credentials from your domain, constituting a personal data breach
• WHOIS data exposure — Flags when registrant personal data (email, address) is publicly exposed unnecessarily
• NIS2 compliance dashboard — For organisations subject to NIS2 (which intersects with GDPR for incident reporting), SwarmHawk provides automated evidence of continuous monitoring

For a GDPR-focused integration guide, see our API Documentation.

09 Submit a Data Subject Request

Use the form below or email hello@swarmhawk.com to exercise your GDPR rights. We will verify your identity and respond within 30 days.

10 DPO & Contact

SwarmHawk has appointed a Data Protection Officer (DPO) who can be reached for any GDPR-related query: