Short version: we do not sell your data, we do not run ad trackers, and we keep what we collect to the minimum needed to do business with you.
Who we are
pentest [systems] is a service brand of Plavno (plavno.io), 700 N Fairfax Street, Ste 614, Alexandria, VA 22314, United States. Plavno operates this website and the associated services and is the controller of the personal data described here. Our EU office: 31 Nowogrodzka Street, Apt. 330Z, 00-511 Warsaw, Poland.
We have not appointed a data protection officer. To contact us about anything in this policy, email privacy@pentest.systems.
What we collect and why
Contact and inquiry data
When you email us or book a scoping call, we collect your name, email address, and message content. We use this to respond and, if you become a client, to run the engagement. Legal basis: legitimate interest (GDPR Art. 6(1)(f)); contract performance where applicable.
Website analytics
If you accept analytics cookies, we collect pseudonymous page-view data (pages visited, time on page, referrer, and basic device information such as screen size and browser), linked to a random client ID stored in the _ga cookie. We do not track individuals across sites. Analytics are off for every visitor until they opt in. Legal basis: consent (GDPR Art. 6(1)(a)).
Consent preference
We store your cookie consent choice in your browser's local storage. It stays on your device, is never sent to us, and contains no personal data beyond that preference. Legal basis: legitimate interest under GDPR; not classified as a sale or share under US state laws.
Hosting and server logs
This site is hosted by Vercel Inc., which acts as our processor. When you load a page, Vercel's servers process your IP address, browser user agent, and the URL requested, to deliver the page and protect the service. Legal basis: legitimate interest (GDPR Art. 6(1)(f)). These logs are kept only for the short period set by Vercel's log retention and are not used to identify you.
Engagement data
For clients, we process technical data (IP ranges, hostnames, credentials provided for testing) strictly within the scope agreed in the statement of work. This data is handled under a separate data processing agreement.
What we do not do
- We do not sell personal data to third parties.
- We do not share personal data for cross-context behavioral advertising.
- We do not use tracking pixels, fingerprinting, or cross-site tracking.
- We do not send unsolicited marketing email.
How long we keep data
- Inquiry emails: retained until the inquiry resolves or for up to 2 years if no engagement follows.
- Client engagement data: retained for the duration of the engagement plus 3 years for legal and audit purposes, then deleted or returned per the SOW.
- Analytics data: Google Analytics keeps event-level data for 14 months, then deletes it; only aggregated reports remain. The
_gaand_ga_*cookies expire after up to 2 years (some browsers cap this at 400 days), or when you withdraw consent. - Consent preference: stored in your browser until you change it or clear your browser storage.
International transfers
Vercel (hosting) and Google (analytics, only after you opt in) are based in the United States, and our email runs on a third-party provider. Where personal data leaves the EEA, transfers rely on the EU-US Data Privacy Framework for certified providers and on the Standard Contractual Clauses in each provider's data processing terms.
Your rights
EU / EEA / UK residents (GDPR)
You have the right to access, rectify, erase, restrict, port, and object to processing of your personal data (GDPR Art. 15–22). Send a request to privacy@pentest.systems. We respond within 30 days. You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state where you live or work. Our supervisory authority in Poland is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl. We do not make decisions based solely on automated processing, including profiling, that have legal or similarly significant effects on you (GDPR Art. 22).
US residents
Depending on your state, you may have rights to know, access, delete, correct, and opt out of the sale or sharing of personal information. These rights apply under CCPA/CPRA (California), VCDPA (Virginia), CPA (Colorado), CTDPA (Connecticut), UCPA (Utah), TDPSA (Texas), OCPA (Oregon), and equivalent acts in other states. We do not sell or share personal information for cross-context behavioral advertising. To exercise any right, email privacy@pentest.systems.
Cookie preferences
Manage your cookie preferences at any time:
Third-party services
No analytics load by default. Analytics run only after you opt in via the cookie banner. When enabled, we use Google Analytics 4, which does not log or store IP addresses by default. Google acts as a data processor on our behalf. We use no advertising trackers and no social media embeds, and we do not sell or share your personal information. You can withdraw consent at any time using the preferences control above. Withdrawal stops analytics collection immediately, including on the page you are on, and deletes the Google Analytics cookies (_ga and _ga_*) from your browser.
Security
We apply appropriate technical and organizational measures to protect personal data. Engagement data is handled under encrypted channels and access controls specified in the SOW. We are a security firm; our own data practices reflect that.
Changes to this policy
Material changes will be posted here with an updated effective date. For significant changes affecting client data, we will notify affected parties directly.
Contact
Privacy questions or rights requests: email privacy@pentest.systems.