Intellix IT Solutions
Data processing

How we actually process your data — flow by flow.

A practical companion to the Privacy Notice. Each flow below lists what we capture, where it lives, how long it stays, what we use it for, and who (if anyone) it is shared with. No marketing fluff; if it's not below, we don't do it.

Last updated: February 2026

§ Contact form / lead enquiry

When it happens
You fill in a form on the site (contact, NIS2 enquiry, audit request, scan PDF request, brochure unlock, post-launch review request, etc.).
What we capture
  • Your name, work email, organisation, optional phone.
  • The free-text message and the interest tag attached to the form.
  • The consent text shown and a server-side timestamp.
  • Your IP and User-Agent string — recorded once, only with the lead, to evidence consent and to deter automated abuse.
Where it lives
MongoDB collection `leads` — encrypted at rest, EU jurisdiction (Cloudvoro infra) or UK (Intellix infra) depending on which entity you contracted with.
What we use it for
  • Replying to your enquiry (manual, by a senior engineer).
  • Sending the requested PDF report or brochure (where applicable).
  • Detecting and blocking spam / automated abuse via IP rate-limiting.
  • No marketing use without your separate, explicit opt-in.
How long we keep it
24 months from the date of last contact, then permanently deleted.
Who it's shared with
Email is delivered via SMTP through our email provider (see Subprocessors). No data shared with marketing, sales-intelligence or data-broker platforms.
Legal basis
GDPR Art. 6(1)(a) consent (contact form) + Art. 6(1)(f) legitimate interests (abuse prevention).

§ Free Attack Surface Scan

When it happens
You submit a domain to /intellix/free-attack-surface-scan and click Scan now.
What we capture
  • The domain string you entered.
  • Your IP address, country derived from that IP, User-Agent string, timestamp.
  • The optional industry label you selected for benchmarking.
  • The computed grades per control family (DNS, TLS, headers, email-auth, platform) and the total finding count.
Where it lives
MongoDB collection `scan_log`. The scan itself is read-only against your domain — no logins attempted, no input injection, no fuzzing.
What we use it for
  • Computing and returning your A–F grade in real time.
  • Comparing your grade against the rolling-90-day industry average and showing your percentile.
  • Detecting abusive scanning patterns — IP rate-limits and automatic blocks for accounts that bulk-scan or distribute requests.
  • Improving the scan engine — we look at aggregate patterns of misconfiguration to refine the rules.
How long we keep it
Raw scan_log rows: 90 days, then automatically purged. The anonymised aggregate (industry-average grade per vertical) persists indefinitely on /intellix/industry-benchmarks — your domain, IP and identity are NEVER published.
Who it's shared with
Nobody outside Intellix / Cloudvoro. The scan engine runs entirely on our infrastructure; no third-party scanner is called.
Legal basis
GDPR Art. 6(1)(f) legitimate interests — the service is operated for the benefit of the SME community we serve, with strict anonymisation thresholds (minimum n=5 per industry before any aggregate is published).

§ Free-scan PDF brief request

When it happens
After running a scan, you fill in your details to receive the PDF report.
What we capture
  • Everything in the Contact form flow above, plus the scanned domain, your grade and the findings count automatically attached.
Where it lives
MongoDB collection `leads`, tagged `scan-full-report`.
What we use it for
  • Emailing you the PDF brief, once.
  • Allowing one senior engineer to follow up by email if you indicated you would like a deeper conversation.
  • No automated marketing sequence; no enrolment into any nurture cadence.
How long we keep it
24 months.
Who it's shared with
Email-delivery sub-processor only (see Subprocessors page).
Legal basis
GDPR Art. 6(1)(a) consent.

§ Visitor analytics (first-party only)

When it happens
Any page view on the public site.
What we capture
  • The page path, document referrer, country (derived from IP at request time), timestamp.
  • We do NOT store the raw IP in the visit row — only the derived country code.
  • We do NOT set a cross-session identifier or fingerprint.
Where it lives
MongoDB collection `visits`. TTL index on `created_at_ttl` automatically deletes rows after 12 months.
What we use it for
  • Understanding traffic patterns (which pages are read, which countries we reach, which referrers send traffic) at aggregate level.
  • No individual visitor profile is constructed.
How long we keep it
12 months, auto-deleted by MongoDB TTL index.
Who it's shared with
Nobody. No third-party analytics provider receives this data.
Legal basis
GDPR Art. 6(1)(f) legitimate interests; no cookie required for this processing because it is strictly-necessary first-party analytics with no cross-session identifier.

§ Administrator authentication

When it happens
A staff member logs into /loginmanage.
What we capture
  • Staff email, bcrypt password hash (we never store the plaintext password).
  • WebAuthn passkey public keys + sign counters (private keys remain on the device).
  • TOTP secret encrypted at rest; recovery codes stored as bcrypt hashes.
  • An HttpOnly authentication cookie with 24-hour expiry.
Where it lives
MongoDB collections `users`, `webauthn_credentials`, `totp_secrets`. All access encrypted in transit and at rest.
What we use it for
  • Authenticating staff users for CMS access.
  • Brute-force detection — repeated failed attempts trigger an account lockout.
  • Every authenticated admin action is recorded in an immutable audit log.
How long we keep it
User record retained for the duration of the employment + 6 months. Audit log: 12 months. Failed-login records: 30 days.
Who it's shared with
Nobody.
Legal basis
GDPR Art. 6(1)(b) contract (employment) and Art. 6(1)(f) legitimate interests (security).

§ Industry Benchmarks publication

When it happens
Continuous — derived from the scan_log over a 90-day rolling window.
What we capture

No new data. Uses the scan_log entries described in (free-scan) above.

Where it lives
Aggregate values (industry → average grade) computed on the fly. No PII, no domains, no IPs stored in the aggregate.
What we use it for
  • Publishing live anonymised industry averages on /intellix/industry-benchmarks.
  • Helping each scanned domain see its percentile against peers.
How long we keep it
Aggregate persists indefinitely — but contains no PII. Raw scan rows underpinning a snapshot are deleted at 90 days.
Who it's shared with
Anyone with internet access (the page is public).
Legal basis
GDPR Art. 6(1)(f) legitimate interests, with strict k-anonymity (minimum 5 unique domains per industry before publication).

Data Processing Agreement (DPA)

For B2B clients who require a signed Data Processing Agreement under Art. 28 GDPR, we provide a counter-signable DPA template on request. The template covers our role as processor, the sub-processor list, security measures, breach-notification timing (24h for confirmed personal-data breaches), and a written exit / data-portability commitment.

Request: email hello@cloudvoro.com with "DPA request" in the subject and the contracting entity name. Turnaround: 2 working days.

Contact the Data Protection Officer

hello@cloudvoro.com. Response within 5 working days; 30-day maximum under GDPR Art. 12(3).

Privacy Notice Terms of Service Cookie Policy Subprocessors