Privacy Notice

This notice describes how Skansar Technologies ("Skansar", "we") processes personal data in connection with the DefenceOS platform, in compliance with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and the ePrivacy Directive (2002/58/EC).

Skansar Technologies is in the process of being incorporated in the Grand Duchy of Luxembourg, and DefenceOS is currently operated as a non-commercial pilot. This notice will be re-issued under the registered entity name once incorporation is complete and the platform transitions out of pilot.

1. Controller

Skansar Technologies is the controller for personal data processed through DefenceOS. Our Data Protection Officer can be contacted at dpo@skansar.com.

2. Categories of personal data

• Company identifiers you submit during onboarding (VAT ID, legal name, address, CAGE, UEI).
• Account-manager contact details (name, designation, business email).
• Authentication data (credentials verified server-side; an opaque session identifier bound to your browser and referenced from an HttpOnly, Secure, SameSite=Strictdos_session cookie, resolved against a server-side session store).
• Usage logs (routes visited, actions taken, IP address, user agent) generated when you use the platform.
• Documents you upload for qualification and compliance purposes.

3. Purposes and legal bases

• Provisioning the platform and executing the supplier-onboarding contract — Art. 6(1)(b) GDPR.
• Complying with export-control, sanctions, and defence-sector regulatory obligations — Art. 6(1)(c) GDPR.
• Maintaining platform security, preventing abuse, and operating audit logs — Art. 6(1)(f) GDPR (legitimate interest).
• Optional features you consent to — Art. 6(1)(a) GDPR.

4. Recipients

Personal data may be disclosed to buyers you explicitly share documents with, to EU competent authorities when compelled by law, and to sub-processors providing hosting and security services. A full sub-processor list is available on request. Named sub-processors with visible-to-users data flows include:

• Google LLC (Google Search Console) — search-analytics service for the app.skansar.com subdomain. Data categories: aggregated search queries that referred visitors to the site, impression / click counts, crawler diagnostics. No individual visitor identifiers are shared; no cookie or tracker is set on visitors' browsers. Legal basis: legitimate interest in operating and diagnosing the site (Art. 6(1)(f) GDPR). Location: Google LLC (United States), transferred under the EU–US Data Privacy Framework. Retention: 16 months (Google's Search Console default). The Search Console meta tag is present on the site so Google can verify domain ownership; it does not itself transmit visitor data.

5. International transfers

DefenceOS processing occurs within the European Economic Area. Where a transfer outside the EEA is unavoidable, we rely on Standard Contractual Clauses (Commission Decision 2021/914) and perform a transfer-impact assessment.

6. Retention

Onboarding records and uploaded documents are retained for the duration of the supplier relationship plus ten (10) years to meet defence-industry retention expectations. Audit logs are retained for seven (7) years. Session data is retained for the duration of the session plus thirty (30) days.

7. Your rights

As a data subject you have the right to:

• Access your personal data (Art. 15).
• Request rectification (Art. 16).
• Request erasure, subject to our legal retention obligations (Art. 17).
• Restrict processing (Art. 18).
• Receive your data in a portable format (Art. 20).
• Object to processing based on legitimate interest (Art. 21).
• Withdraw consent at any time where processing is based on consent (Art. 7(3)).
• Lodge a complaint with a supervisory authority (Art. 77).

To exercise any of these rights, contact dpo@skansar.com. We will respond within one month.

8. Automated decisions

DefenceOS surfaces AI-assisted outputs — a natural-language chat and page/section summaries produced by third-party foundation models, and a tool-using agent that runs read-only queries over your accessible data. These outputs are advisory and always subject to human review before any decision that produces legal effects. Each surface is labelled at the point of use per Article 50 of Regulation (EU) 2024/1689 (the AI Act). The full registry of AI systems — including inputs, outputs, human-oversight expectations, and known limitations for each — is published at /legal/ai-systems. You may request information about the reasoning behind any output that affects you, or contest an output that affected your organisation, using the appeal contact on that page.

9. Security

Technical and organisational measures — the SBOM, build-provenance and image signing artefacts, the coordinated vulnerability disclosure endpoint, and the application-layer hardening posture — are documented at /legal/security-artefacts. Vulnerabilities can be reported via security.txt.

10. Changes

Material changes will be notified to account managers at the email on file at least thirty (30) days before they take effect. A dated change log for this document is maintained below.

• 2026-08-14 (v0.4-draft) — Section 4 sub-processor list now names Google LLC (Google Search Console) with data categories, legal basis, transfer mechanism, and retention. Added alongside enabling the Search Console meta tag on the site root; no cookie is set on visitors' browsers and no browser-side request leaves the origin, but the data-processor relationship is disclosed for transparency.
• 2026-08-08 (v0.3-draft) — Section 2 authentication description updated to reflect the shipped dos_session HttpOnly cookie and server-side session store. Section 8 automated-decisions description brought into line with the current AI System Registry (retired references to withdrawn systems — risk-prediction, anomaly, counterfeit — replaced with a pointer to the registry). Section 9 anchor moved from the generic Support page to the new Security Artefacts page.
• 2026-04-25 (v0.2-draft) — jurisdiction confirmed as Grand Duchy of Luxembourg.