Privacy Policy

This Privacy Policy outlines the commitment of SentraDMARC ("SentraDMARC," "we," "us") to protecting the personal data of our users. SentraDMARC provides web security and compliance services, specializing in the management of DMARC policies to protect domains from common threats such as phishing and spoofing.

This policy applies to all personal data processed by SentraDMARC in its capacity as a Data Controller. This includes data collected from visitors to our website (sentradmarc.com), individuals who use our free tools like the Analyzer, registered users of our free trial and paid services, and individuals who contact us for support or other inquiries. This policy also explains our role as a Data Processor when we handle data on behalf of our clients.

In adherence with data protection best practices, including recommendations from supervisory authorities such as the French Data Protection Authority (CNIL), this policy is structured in a layered format. We provide summary tables and clear headings to allow you to quickly find the information most relevant to you. Each summary is followed by a more detailed explanation for those who require a deeper understanding. Our goal is to ensure this information is concise, transparent, intelligible, and easily accessible, in line with the principles of the General Data Protection Regulation (GDPR).

2.1 Identity of the data controller

For the purposes of the GDPR and other applicable data protection laws, the Data Controller responsible for the processing activities described in this policy is:

• Company: SentraDMARC
• Website owner: SentraDMARC
• Contact: contact@sentradmarc.com

2.2 Contact information for privacy matters

For any questions, concerns, or requests related to your personal data and the exercise of your privacy rights, please contact us through our dedicated email: contact@sentradmarc.com. Using this dedicated address ensures that your inquiry is directed to the team responsible for data protection matters for a timely and appropriate response.

2.3 Data Protection Officer (DPO)

The GDPR requires the appointment of a Data Protection Officer (DPO) for organizations whose core activities consist of processing operations that require regular and systematic monitoring of data subjects on a large scale.

SentraDMARC's services involve the automated analysis of potentially millions of DMARC reports on behalf of our clients to generate security policies. These reports may contain personal data of end-users, such as IP addresses. This activity could be construed as regular and systematic monitoring on a large scale.

In recognition of these obligations and our commitment to the highest standards of data governance, SentraDMARC has conducted the necessary internal analysis. We have designated an internal team, reachable at contact@sentradmarc.com, to handle all data protection responsibilities and ensure our ongoing compliance.

To ensure this policy is clear and easy to understand, we have defined some key terms:

• Personal Data: Any information relating to an identified or identifiable natural person ('Data Subject').
• Processing: Any operation or set of operations performed on Personal Data, whether by automated means or not.
• Data Subject: The individual to whom the Personal Data relates (Client or End-User).
• Client: The individual or entity that registers for and uses SentraDMARC's services.
• End-User: An individual who interacts with a website owned or operated by one of our Clients.
• Data Controller: The person or entity who determines the purposes and means of processing.
• Data Processor: The person or entity who processes data on behalf of the Data Controller.

The distinction between "Client" and "End-User" is fundamental to this policy, allowing for a clear explanation of our different roles and responsibilities.

SentraDMARC operates in two distinct legal capacities under the GDPR: as a Data Controller and as a Data Processor.

4.1 SentraDMARC as a Data Controller

We act as a Data Controller for our own business purposes (website visitors and direct Clients).

• Client Account Information: Name, email, hashed password for account management.
• Billing Information: Payment details (handled by Stripe).
• Website Visitor Data: Technical data (IP, browser) and cookies.
• Free Tool Usage Data: Domain/policy data submitted via free tools.
• Communication Data: Names and contact details from support/sales inquiries.

4.2 SentraDMARC as a Data Processor

We act as a Data Processor when processing Personal Data on behalf of our Clients (e.g., DMARC Reports).

• How it Works: Clients configure DNS to send reports to our endpoint.
• Data Processed: IP addresses within reports are processed to provide analysis.
• Client's Responsibility: The Client (Data Controller) is responsible for the lawful basis for End-Users' data.
• Data Processing Agreement (DPA): Governed by a legally binding DPA.

6.1 How the Builder Works

The Builder is a tool designed to automatically generate an optimized Policy for a Client's domain by analyzing DMARC reports. This identifies legitimate email sources to recommend secure policies.

6.2 Automated Decision-Making (GDPR Art. 22)

Our automated processing does not fall under Art. 22 because:

• No Legal/Significant Effects: Recommendations are technical and provided to the Client, not the End-User.
• Human Intervention: The process requires Client review and approval via our "interactive review wizard."

6.3 Safeguards

We implement safeguards including purpose limitation (specific to each Client), data minimization through aggregation, and a rule-based engine rather than generative models.

We use cookies on sentradmarc.com for functionality, performance analysis, and marketing.

We prioritize keeping your data within the EEA. Core data is stored with OVHcloud in the EU. Transfers outside the EEA use recognized legal mechanisms (SCCs).

We use TLS for transit and encryption at rest. Access is restricted via need-to-know policies. We perform regular vulnerability scans and systems are backed up for resilience.

You have the rights to: Information, Access, Rectification, Erasure, Restriction, Portability, and Objection.

Children's Privacy: Our services are not intended for individuals under 16. We do not knowingly collect personal data from children under this age.

Changes to This Policy: We may update this policy periodically. Material changes will be noted by updating the "Last updated" date above.