GDPR Compliance
Last updated: January 6, 2025
Our Commitment to GDPR
FirewallDNS is fully committed to compliance with the General Data Protection Regulation (GDPR). We have implemented comprehensive measures to protect the personal data of our European Union users and uphold their data rights.
1. Legal Basis for Processing
We process personal data under the following legal bases:
- Contract Performance: Processing necessary to provide our DNS security service
- Legitimate Interests: Security analysis, fraud prevention, and service improvement
- Legal Obligation: Compliance with applicable laws and regulations
- Consent: Marketing communications (opt-in only)
2. Your GDPR Rights
Right to Access (Article 15)
Request a copy of all personal data we hold about you, including DNS logs, account information, and processing purposes.
Right to Rectification (Article 16)
Request correction of inaccurate personal data or completion of incomplete data.
Right to Erasure (Article 17)
Request deletion of your personal data ("right to be forgotten") when data is no longer necessary.
Right to Restrict Processing (Article 18)
Request limitation of processing while we verify accuracy or assess legitimate interests.
Right to Data Portability (Article 20)
Receive your data in a structured, machine-readable format (JSON/CSV) for transfer to another provider.
Right to Object (Article 21)
Object to processing based on legitimate interests, including profiling and direct marketing.
3. Data Processing Activities
| Data Category | Purpose | Retention |
|---|---|---|
| Account Data | Service provision | Account lifetime + 30 days |
| DNS Query Logs | Security & analytics | 30 days |
| IP Addresses | Service authorization | Account lifetime |
| Filter Settings | Service customization | Account lifetime |
4. International Data Transfers
When transferring data outside the European Economic Area (EEA), we ensure adequate protection through:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Processing only in jurisdictions with adequacy decisions
- Additional technical and organizational measures
- Regular assessment of third-party safeguards
5. Data Protection Measures
- Encryption: TLS 1.3 in transit, AES-256 at rest
- Pseudonymization: Where possible, we separate identifiers from data
- Access Controls: Role-based access with audit logging
- Data Minimization: We collect only what's necessary for service delivery
- Regular Audits: Annual third-party security assessments
6. Data Breach Notification
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay, as required by Articles 33 and 34 of the GDPR.
7. Exercising Your Rights
To exercise any of your GDPR rights, you can:
- Use the self-service options in your dashboard
- Email our Data Protection Officer at dpo@firewalldns.com
- Submit a formal request through our GDPR portal
We will respond to all valid requests within 30 days. Complex requests may take up to 90 days, and we will inform you of any extensions.
8. Supervisory Authority
You have the right to lodge a complaint with a supervisory authority if you believe your data protection rights have been violated. You may contact your local Data Protection Authority or our lead supervisory authority.
9. Data Protection Officer
Our Data Protection Officer can be contacted at:
Email: dpo@firewalldns.com
Subject: GDPR Inquiry