Privacy policy
This policy covers the alloy-it website. It explains what we collect when you browse it or contact us, and what you can do about it.
Last updated 31 August 2026.
Who is responsible
Melqart Systems is the data controller for this website.
- Entity: Melqart Systems
- Address: [Registered address, city, postal code, country]
- Registration: [Company registration number]
- Data protection contact: [privacy@your-domain]
alloy-it® is a registered trademark, Benelux registration number 1543531.
What we collect and why
We collect as little as we can get away with. There is no account required to browse this site, and we do not buy or enrich contact data from third parties.
Contact and walkthrough requests: your name, work email, company, and the message you write.
- Purpose
- To answer your enquiry and, if it goes further, to hold a sales conversation with you.
- Legal basis
- Legitimate interest (Art. 6(1)(f)) in responding to a business enquiry you initiated.
- Retention
- 24 months after our last exchange, then deleted. Sooner if you ask.
Gated resource requests: your name and work email when you ask for the CRA checklist.
- Purpose
- To send you the resource and, occasionally, a follow-up about CRA readiness.
- Legal basis
- Legitimate interest (Art. 6(1)(f)) in following up on a resource you requested. You can object at any time.
- Retention
- 24 months from the request, then deleted.
Product feedback you submit through the feedback dialog.
- Purpose
- To improve the platform and reply if you asked us to.
- Legal basis
- Legitimate interest (Art. 6(1)(f)) in improving our product.
- Retention
- 24 months.
Analytics: pages viewed, approximate location from IP, device and browser, and which calls to action you clicked.
- Purpose
- To understand which pages help teams get CRA-ready and to fix the ones that do not.
- Legal basis
- Consent (Art. 6(1)(a)). Nothing analytics-related is set until you accept, and you can change your mind at any time.
- Retention
- 14 months in Google Analytics, then deleted automatically.
Server logs: IP address, request time, user agent, and the URL requested.
- Purpose
- To keep the site available and to investigate abuse or attacks.
- Legal basis
- Legitimate interest (Art. 6(1)(f)) in the security and availability of our own service.
- Retention
- 30 days.
Who else sees your data
We do not sell personal data, and we do not share it for anyone else's marketing. The following processors handle data on our behalf under a data processing agreement:
Google Ireland Ltd (Google Analytics, Google Tag Manager)
Website analytics, loaded only after you consent.
EU, with possible transfer to the United States under the EU-US Data Privacy Framework and standard contractual clauses.
Our hosting and email providers
Serving this website and delivering the messages you send us.
European Union.
Your rights
Under the GDPR you have the following rights. Email [privacy@your-domain] and we will respond within one month.
- Access. Ask what personal data we hold about you and get a copy of it.
- Rectification. Have anything inaccurate corrected.
- Erasure. Ask us to delete your data where we have no overriding reason to keep it.
- Restriction and objection. Object to processing based on legitimate interest, including our follow-up emails, and we will stop unless we can show compelling grounds.
- Portability. Receive the data you gave us in a structured, machine-readable format.
- Withdraw consent. Turn analytics consent off at any time. Withdrawing does not affect processing that already happened.
If you think we have handled your data badly, you can complain to [Your national data protection authority]. You can find the right authority through the European Data Protection Board. edpb.europa.eu
The alloy-it platform
This policy covers the website. When you use the alloy-it platform itself, we process the SBOMs, firmware, and product records you upload as a processor acting on your instructions, governed by our terms and a data processing addendum. Contact us at [privacy@your-domain] to put a DPA in place.
Details of how the platform is secured are on the security page.
Changes to this policy
If we change how we handle personal data we will update this page and move the date at the top. Material changes affecting people we already hold data for will be sent by email.