cyberincidentreporting.eu

The four EU regimes that put a clock on a cyber incident – NIS2, DORA, the GDPR and the Cyber Resilience Act – read against each other, article by article.

Open the clock finder

Privacy policy

Updated

Operator and scope

cyberincidentreporting.eu is a free reference operated by SEQ SIA (OffSeq), registration number 40203410806, Lastādijas iela 12 k-3, Riga, LV-1050, Latvia. The site has no user accounts, no newsletter and no comments. We receive personal data only when you choose to send it through the inquiry form or by email.

The reporting clock finder

The worksheet runs entirely in your browser. The entity type you select and the events you tick are held in page memory for as long as the page is open. They are not sent to OffSeq, not written to local storage or any cookie, not included in analytics events, and not added to outbound links. Closing or reloading the page discards them, and the worksheet always reopens on its default selection. It is educational: it does not inspect your systems, your incident or your filings.

The inquiry form

Only the email address is required. If you provide them, we also receive your name, the topic you chose and your message. With the request we receive the page address and form placement it was sent from, the time it was sent and the country Cloudflare derives from the connection. We do not include your IP address in the message or store it; Cloudflare uses it briefly to rate-limit submissions and deter automated spam. Clock-finder selections are never attached to the request. Please do not put incident evidence, indicators or other confidential material in the message: the form is a general inquiry channel, not a secure intake.

To tell people apart from automated spam, the form uses Cloudflare Turnstile. It loads only once you start filling in or submit the form and assesses technical browser and connection signals, such as the IP address and browser user agent; we do not pass what you type into the form to it. Cloudflare performs this check as our processor and also uses the signals, as an independent controller, to improve its bot detection (Turnstile Privacy Addendum). Our server receives only the result of the check and does not store it. To catch mistyped addresses, after you submit, our server looks up the email domain (the part after @) in Cloudflare's public DNS; only the domain is sent. The legal basis is our legitimate interest in protecting the form from abuse (Article 6(1)(f) GDPR).

We use these data only to answer your request and, if you ask for one, to prepare a service proposal. The legal basis is steps taken at your request before entering into a contract (Article 6(1)(b) GDPR) and, for questions unrelated to a service, the operator's legitimate interest in answering correspondence it receives (Article 6(1)(f) GDPR). Providing the data is voluntary; without an email address we cannot reply.

Cloudflare's email service delivers the request as an email to the SEQ SIA mailbox, acting as a processor. The message is read and handled by the SEQ SIA staff who answer inquiries. We keep requests for up to 12 months after our last contact with you; if we enter into a contract, correspondence is kept for as long as the contract and applicable law require. Analytics records only a successful-submission event and the form placement, never the data you entered.

Technical requests and traffic measurement

Serving a page through Cloudflare involves technical request data, including an IP address, browser headers, the requested URL and the request time. These data support delivery, security and operation of the site. Cloudflare may set its own security cookies; those are separate from the site application.

The site sends page views, clicks on OffSeq service and contact links and successful inquiry-form submissions to our self-hosted Plausible service at in.ainalytic.net. Events include the site domain, the public page address, limited campaign parameters and the referring site's origin when available. A link-click event adds only the destination path and a static placement label such as header, hero or finder; a form-submission event adds only the form placement. Worksheet selections, results and form fields are never sent. The application does not set analytics cookies or a persistent visitor identifier; the collector receives technical network information with the request. Cookieless measurement is still data processing.

Measurement is disabled when the browser signals Do Not Track or Global Privacy Control, when the local-storage preference plausible_ignore is set to true, and for previews, local development and recognized automation. OffSeq links may carry static referral labels identifying this resource and the link placement; those labels never contain worksheet selections.

We use technical request data to operate and secure the site, and page-view, link-click and form-submission statistics to understand how the resource is used and how much interest there is in OffSeq services. The operator's stated legal basis for these purposes is legitimate interests under Article 6(1)(f) GDPR. Hosting and infrastructure providers process requests on our behalf; the analytics service is self-hosted. Data are kept only as long as needed for those purposes and any applicable legal obligation. The operator's privacy policy explains its retention criteria, providers and transfer safeguards.

If you email support@offseq.com, we handle the address, the message and anything you choose to include in the same way as inquiry-form data. Please do not send incident details or evidence to that address either; it is a general inquiry mailbox, not a secure intake. OffSeq service links and the legal sources cited in the guides take you to sites with their own privacy notices.

Your rights

Subject to the conditions in the GDPR you may request access, correction, deletion, restriction or portability, and object to processing. Contact support@offseq.com. You may also complain to Latvia's Data State Inspectorate (Datu valsts inspekcija) or to the supervisory authority where you live or work. The cookie and browser-storage notice covers what is and is not stored in your browser.