Privacy Notice
Effective: 10 November 2026
This notice explains what personal data we process on itbit.cc (in Hungarian at itbit.cc/hu) and scan.itbit.cc and when providing the ITBit services, for what purpose, for how long, and what your rights are. The contract terms for the ITBit services are in the Terms and Conditions.
1. Controller
| Item | Details |
|---|---|
| Controller | Attila Bognar-Tarjanyi, sole trader, trading as ITBit |
| Registered address | 22 High Street, Clacton-On-Sea, Essex, CO15 1NR, United Kingdom |
| Postal address | 5200 Törökszentmiklós, Kiss János u. 6., Hungary |
| Privacy questions | info@itbit.cc |
We have not appointed a data protection officer, as the law does not require one.
2. When are we a controller, and when a processor?
- We are the controller of the data of our own users, partners and affiliates, of visitors to our own websites, and of the data collected for business outreach under point 7. This notice covers that data.
- We are a processor of the personal data held on the WordPress websites our customers connect to us (for example the data, IP addresses and login attempts of those sites' visitors, members and customers). We access it while backing up, monitoring and restoring the site, solely on the customer's instructions. This includes the web access log of the site's hosting (visitors' IP addresses, requested addresses, times and browser identifiers): where the site has Emergency Entry, we copy it weekly and when a recovery starts, keep the copies for 4 weeks, and use them only for the Sentinel guarantee decision. The site's operator informs its visitors about that processing; our obligations, including how long backups are kept, are set out in Annex 2 of the Terms (Data Processing Agreement). On request we also sign a detailed data processing agreement (info@itbit.cc). If you are a visitor of such a site and want to exercise your rights, contact the site's operator.
3. What data we process, why, and for how long
Legal bases refer to Article 6(1) GDPR: a) consent, b) performance of a contract, c) legal obligation, f) legitimate interests. "For the customer relationship" means until the account is deleted, or an inactive account is closed (3.2).
| Category | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| User account | email address, first name, password (only as an irreversible hash), language | registration, sign-in, contact | b) | for the customer relationship |
| Acceptance of the Terms | time of acceptance and the version accepted | proof of the contract | b), c) | 9 years |
| Profile details (if you give them) | last name, title, job title, phone, company, address, country, date of birth | invoicing, contact | b) | for the customer relationship |
| Purchases and invoicing | product, amount, date, billing details, refunds; card details are handled only by Stripe | performing the contract, invoicing, bookkeeping | b), c) | 9 years under accounting and tax rules, also after account deletion |
| WordPress connection | site address, WordPress username, application password, FTP/SFTP access (encrypted) | providing the services ordered | b) | until the service ends |
| Security scans | address of the site scanned, findings, score | running scans, showing history | b), for free scans f) | single scans 30 days, score history 365 days |
| Sign-in log | IP address, time last used | protecting accounts, detecting abuse | f) | 12 months |
| Two-step sign-in | the authenticator app's secret key (in the sign-in system), recovery codes (only as irreversible hashes) and when they were used | protecting the account: signing in takes the password and the code on your phone | b), f) | until the account is deleted or two-step sign-in is set up again |
| Administrator access to your account | which administrator signed in to your account, when, why and from which IP address; resets of your two-step sign-in | support and troubleshooting, accountability for access | b), f) | until the end of the customer relationship |
| Telegram alerts (if enabled) | Telegram ID | sending security alerts | b) | until switched off or the account is deleted |
| Chat assistant | conversation text | answering questions, support | b) | until the account is deleted |
| Bug reports, support | content of reports and correspondence | handling reports and complaints | b), c) | until the account is deleted; complaints 5 years |
| Affiliate program | referral code, clicks, referrals, commissions; for payouts the account holder's name, bank name and country, IBAN, SWIFT/BIC or PayPal email | calculating and paying commission | b), c) | payout records 9 years; clicks until the account is deleted |
| Source data | referring page, landing page, campaign parameters (UTM), browser type | measuring where customers come from | f) | for the customer relationship |
| Marketing emails | email address, first name, time of consent, email opens | news about services and offers | a) | until you unsubscribe |
| Ad measurement | cookies under point 4 | measuring which ads bring customers | a) | as in point 4 |
| Technical logs | error reports, technical data of the browser and request | finding and fixing errors | f) | up to 90 days |
3.1. Legitimate interests. Where we rely on legitimate interests (protecting accounts and systems, measuring marketing, fixing errors), we have assessed that they do not disproportionately affect your rights. You can object at any time (point 9).
3.2. Inactive accounts. If you do not use your account for 12 months, we warn you by email; if you still do not sign in within 30 days, the account is deactivated and deleted 30 days later. Accounting records are still kept for 9 years.
3.3. Account deletion. When you delete your account, we cancel your active subscriptions and promptly delete your data, including the backups of your websites. The exception is what accounting rules require us to keep for 9 years: records of purchases, refunds and affiliate payouts, and the identifying details they need (name, email address, billing details).
4. Cookies and local storage
We use cookies and local storage needed for the site to work without consent; everything else only if you click "Accept all" in the banner shown on your first visit. You can change your choice at any time with the "Cookie settings" link at the bottom of the page.
| Name | Type | Purpose | Category | Lifetime |
|---|---|---|---|---|
| sb-…-auth-token | local storage | keeping you signed in | necessary | until sign-out |
| cookie-consent-accepted, cookie-consent-marketing | local storage | remembering your cookie choice | necessary | until you change it |
| language and interface settings | local storage | remembering your language and display choices | necessary | until cleared |
| itbit_ref (cookie), affiliate_ref (local storage) | cookie and local storage | recording which affiliate link brought you (without consent: only for the current visit, in browser memory) | consent required | 30 days |
| itbit_source_tracking_v1 | local storage | the source data in point 3 | consent required | until consent is withdrawn |
| Google Ads (_gcl_au, _gcl_aw and other Google cookies) | third-party cookie | measuring ad performance (conversion tracking) | consent required | up to 90 days |
Google Ads runs in Google Consent Mode: until you consent, it sets no cookies and sends no identifiers. Google's processing is described in the Google Privacy Policy, and how Google uses data from partner sites on this page.
5. Who has access to the data?
We do not sell personal data. The providers below process data on our behalf, as processors, only for the stated purpose.
| Provider | Task | Data | Seat / where processed |
|---|---|---|---|
| Supabase Inc. | database, backend, sign-in | all data listed in point 3 | USA; data stored in Ireland |
| Hostinger | website hosting | technical data of visits | Lithuania |
| Stripe | card payments, subscriptions | name, email, payment data | Ireland / USA |
| Resend | sending email | email address, name, message content | USA |
| Anthropic | AI: chat assistant, remediation plans, malware analysis, security review of third-party scripts and updates | chat messages; excerpts of scanned websites' files | USA |
| cloud storage (Google Drive), ad measurement (Google Ads) | backups; with consent, cookie identifiers | Ireland / USA | |
| Lovable | running the CRM and the email templates | name, email, profile, source data, purchases, consents | Sweden |
| Telegram | sending alerts (if enabled) | Telegram ID, alert text | United Arab Emirates |
| Sentry | error logging | technical data, IP address | USA |
| ipapi.co | country lookup from the IP address (language and currency) | IP address; not stored | USA |
| Wordfence (Defiant Inc.) | vulnerability database, Wordfence licences | site address; email address for licence requests | USA |
| Serper, Jina | searching and reading public websites under point 7 | content of public websites | USA |
Beyond these, we disclose data to authorities or courts only where the law requires it, and accounting data to our accountant. In the partner program, the agency that manages your website sees the reports about it.
5.1. ITBit administrators in your account. For troubleshooting, support or investigating abuse, an ITBit administrator can sign in to your account and see and change what you can. They cannot accept the Terms on your behalf. Every such sign-in is logged (who, when, why), each lasts at most 12 hours, and on request we show you who was in your account and when (point 9).
6. Transfers outside the European Economic Area
The controller is based in the United Kingdom, so your data also goes there; the European Commission has found the UK's level of protection adequate. For transfers to the USA, providers either take part in the EU–US Data Privacy Framework or process data under the European Commission's Standard Contractual Clauses (SCCs). The same applies to other providers outside the EEA. We send copies of these safeguards on request.
7. Business outreach to companies
This point is for people we contacted with a business offer rather than at their own request (Article 14 GDPR).
- Who do we contact? Only businesses that run a WordPress website. Searches are started manually, and we send each offer ourselves, one by one.
- What data? The business name, website address, the business email address and contact name published on the website, and the website's publicly visible security characteristics (a passive, external check, without signing in).
- Where from? The business's own website and public search results. We use the providers listed in point 5 (Serper, Jina, Anthropic) to collect and organise them.
- Purpose and legal basis: offering our security services, based on legitimate interests (Article 6(1)(f), Recital 47 GDPR). Our assessment: the contact goes to a business address the business itself published, on a topic related to its activity, and every email has a one-click unsubscribe. The full assessment is available on request.
- The offer link: when an email contains an offer, its link is unique to each recipient. If you open it, we record when and how many times you clicked, your browser's identifier and your IP address; the IP address is stored only as a one-way code that can't be turned back into the address. This tells us whether the offer interested you and whether it's worth writing once more; the browser identifier lets us tell real clicks apart from mail systems that check links automatically. Legal basis: legitimate interests, as above. Click data is deleted under the retention rule below.
- Unsubscribing and objecting: use the unsubscribe link at the bottom of every email, or write to info@itbit.cc. We will not contact you again; your address is kept only on a suppression list, so that we never contact you again later.
- Retention: the data is deleted automatically 12 months after our last contact, or 12 months after collection if we never contacted you. An offer link and its clicks are deleted 12 months after the link was last used (sent, follow-up, click), and the data of any single click after 12 months at the latest. If you become a customer, point 3 applies.
8. Security
Data is transmitted over encrypted connections (TLS). Website access details and backups are stored encrypted, passwords only as irreversible hashes. Row-level security in the database means every user sees only their own data. Every account, administrators' included, can only be signed in to with two-step sign-in (the password plus the authenticator app's code or a single-use recovery code); the database and the backend enforce this. Keys are rotated regularly. In case of a personal data breach we follow Articles 33–34 GDPR: we notify the authority within 72 hours and, where the breach poses a high risk, you too.
9. Your rights and remedies
Send requests to info@itbit.cc; we answer free of charge within one month. If you write from an address other than your account's, we may verify your identity.
- Access: you can ask what data we hold about you and receive a copy.
- Rectification: we correct inaccurate data; you can also edit your profile in your account.
- Erasure: you can delete your account yourself in your account settings; exceptions are listed in 3.3.
- Restriction: you can ask us only to store your data while a dispute is resolved.
- Portability: we provide data processed on the basis of contract or consent in a machine-readable format.
- Objection: you can object to processing based on legitimate interests; if you object to direct marketing, we always stop.
- Withdrawing consent: you can withdraw consent (cookies, marketing emails) at any time; this does not affect earlier processing.
We do not make automated decisions that have legal effects on you.
If you feel we have breached your rights, please write to us first. You can also complain to the data protection authority where you live — in Hungary the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH, 1055 Budapest, Falk Miksa utca 9–11., ugyfelszolgalat@naih.hu, naih.hu), in the United Kingdom the Information Commissioner's Office (ico.org.uk) — or go to court.
10. Changes to this notice
If this notice changes substantially (new data, purpose or processor), we email registered users before the change takes effect. The current version is always on this page.