How we handle personal data.

Who is responsible

Softjoy AB in Umeå, Sweden, is the controller for the personal data in Domain Radar. Questions and requests about your data go to [email protected].

Domain holders

Domain Radar measures DNS and email security across whole domain populations, such as all .se and .nu domains. The data comes from public sources (zone data, WHOIS and public DNS) and from threat intelligence shared between security organisations.

• What: the domain name, the holder's name and country from WHOIS, the domain's DNS records and the IP addresses of its servers.
• Why: to measure security and assess risk. The holder's name is kept only to see when one holder registers many domains used for abuse, or lookalike domains. The public site shows aggregate figures only; signed-in customers see results per domain, without the holder's name.
• How long: DNS and WHOIS data is kept without a fixed end date, also after a domain expires, since the history is what shows patterns. Threat intelligence entries are deleted 13 months after they were last reported; monthly counts derived from them are kept.

Portal users

• What: your email address, name and role, when you signed in and the IP address you signed in from. We use it to give you an account and keep it secure. An email address is needed to have an account.
• How long: a customer user's account with no sign-in for 12 months is deactivated, as is an invitation not used within 14 days. A deactivated account is kept until it is deleted, by us or at your request.

Everyone who visits the site

Our server logs record IP addresses, the pages requested and the browser, and are kept for 90 days to run and secure the service. IP addresses behind failed sign-in attempts or blocked traffic are kept for 12 months after the last such event, and while a block lasts. We use only the cookies the site needs: no analytics and no tracking.

Internal records and backups

Administrator changes are logged for 24 months and background job results for 30 days. Nightly backups are kept on our own backup server for 12 months, so deleted data remains in them until they are replaced.

Who receives data

Our servers, database and backups run on our own equipment in Sweden. Email, including invitations and password resets, goes through Google Workspace, set to store data in the EU. We also use public DNS and WHOIS services for the lookups the measurement needs, and a map service for the portal's maps, which sees the viewer's IP address. Where a supplier transfers data outside the EU and EEA, the transfer rests on an adequacy decision of the European Commission or on its standard contractual clauses; you can ask us for a copy.

Automated decisions

Domain Radar calculates risk scores for domains, networks and registrars for analysis. No decision that affects you legally or in a similarly significant way is made automatically.

Legal basis and your right to object

We process the data on the basis of our legitimate interests (Article 6(1)(f) GDPR): researching the security of domain populations, providing and securing the service, and answering the people who contact us. You may object at any time, on grounds relating to your situation. We then stop, unless we have compelling legitimate grounds that override your interests, rights and freedoms, or the data is needed for a legal claim.

Your rights

You may ask what we hold about you and get a copy, and have data corrected, deleted or its use restricted. Write to [email protected]. If you hold a domain, tell us which domain names the request covers. We answer within one month. You can also complain to the Swedish Authority for Privacy Protection (IMY), imy.se.