Privacy Policy
MORDELABS CORP, LDA · NIF 518346897 · Av. Visconde de Barreiros, 358, 4.º Dto. Frente, 4470-139 Maia, Portugal · support@morditor.com
This is a translation; in case of discrepancy the Portuguese version prevails.
Esta política explica que dados pessoais a MORDELABS trata como responsável pelo tratamento — os dados das empresas clientes e dos seus utilizadores, e dos visitantes do site — e como trata os dados das máquinas monitorizadas por conta dos clientes.
1. Controller
MORDELABS CORP, LDA, a Portuguese company with tax number (NIF) 518346897, registered office at Av. Visconde de Barreiros, 358, 4.º Dto. Frente, 4470-139 Maia, Portugal. Privacy contact: support@morditor.com (subject "Privacy"). MORDELABS has not appointed a data protection officer, as this is not mandatory for its activity.
2. Data we process as controller
- Account and users: name, e-mail, role, language, password (only an irreversible hash), two-factor secret (encrypted), notification preferences, sessions (IP address, browser or device, dates) and activity log.
- Company and billing: legal name, tax or VAT number, country, region, billing address, VIES check results, orders, invoices, credit notes and payment status. Card details are collected directly by Stripe and never reach MORDELABS.
- Acceptance of the Terms: accepted version, date and time, IP address, browser and user.
- Mobile app: the device's push notification identifier, platform, language and device name.
- Communications: the content of e-mails exchanged with support.
- Website: technical server logs (IP address, requested page, browser, date and time). The website uses no cookies and no analytics or advertising tools (see the Cookie Policy).
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Reviewing the sign-up, creating and managing the account and providing the Service | Performance of the contract and pre-contractual steps — art. 6(1)(b) |
| Sending alerts, licence notices, invitations and other Service e-mails and notifications | Performance of the contract — art. 6(1)(b) |
| Invoicing, accounting and tax obligations (including VIES checks) | Legal obligation — art. 6(1)(c) |
| Platform security, fraud and abuse prevention, activity log and server logs | Legitimate interest — art. 6(1)(f) |
| Evidence of acceptance of the Terms and defence of legal claims | Legitimate interest — art. 6(1)(f) |
| Answering support requests | Performance of the contract and legitimate interest |
We do not send marketing communications without consent and we do not carry out profiling or automated decisions with legal effects.
4. Data of monitored machines
The agent collects technical data from the IT companies' customers' machines: hardware, disks and S.M.A.R.T., network and IP addresses, operating system and updates, names of signed-in accounts, installed software, security status (firewall, disk encryption, antivirus, local administrators), selected security events and the status of monitored services, as well as end users' support tickets. On a technician's request, it reads the list of processes and services live, without storing it.
The agent does not collect personal files, e-mails, messages, browsing history, keystrokes or screen images (except a screenshot the user voluntarily attaches to a support ticket).
This data is processed on behalf of the customer IT company, which is the controller; MORDELABS is a processor under the Data Processing Agreement. If you are an end user of a monitored machine, contact the IT company or your employer to exercise your rights; if you contact us, we will forward the request.
5. Recipients
Data is processed by the MORDELABS team, only as needed (support, maintenance, billing), and by the following service providers, with whom data processing agreements are in place:
| Provider | Purpose | Location | Transfer outside the EEA |
|---|---|---|---|
| Hetzner Online GmbH | Hosting of servers, database and backups | EU (Germany and Finland) | No transfer |
| Sendinblue SAS (Brevo) | Sending transactional e-mails (alerts, notices, invitations, invoices) | EU (France) | No transfer; any sub-processors outside the EU under standard contractual clauses |
| Google (Firebase Cloud Messaging) | Delivering push notifications to the Android app | EU and USA | EU-U.S. Data Privacy Framework and standard contractual clauses |
| Apple (Apple Push Notification service) | Delivering push notifications to the iOS app (when available) | EU and USA | EU-U.S. Data Privacy Framework and standard contractual clauses |
| Cloudflare, Inc. | DNS only (resolving the morditor.com names); no Service traffic passes through Cloudflare | Global | Receives no personal data from the Service; EU-U.S. Data Privacy Framework and standard contractual clauses |
| Stripe Payments Europe, Ltd. | Online payments (card, MB WAY, SEPA Direct Debit, SEPA bank transfer) | EU (Ireland); USA | EU-U.S. Data Privacy Framework and standard contractual clauses |
| Vendus (certified invoicing software) | Issuing invoices and credit notes and reporting to the Tax Authority | Portugal | No transfer |
Data may also be disclosed to MORDELABS' certified accountant, to the Tax Authority and to other authorities when required by law. To verify the VAT number of EU customers, the country and VAT number are sent to the European Commission's VIES system.
6. International transfers
Service data is hosted in the European Union. When a provider processes data outside the European Economic Area (for example, delivering push notifications), the transfer relies on an adequacy decision (EU-U.S. Data Privacy Framework) or on standard contractual clauses approved by the European Commission, with appropriate supplementary measures.
7. Retention
| Data | Period |
|---|---|
| Account, users and settings | While the account exists; deleted when the account is closed, 30 days after the request |
| Activity log | 730 days (2 years) |
| Sessions (IP and browser) and one-time codes | 30 days after they expire or are ended |
| Notifications in the portal and the app | 90 days |
| Sign-up refused by MORDELABS | 30 days |
| Orders, invoices, credit notes and VIES checks | 10 years (tax and accounting obligations), even after the account is closed |
| Acceptance of the Terms | Version and date: with the contract records; IP and browser: deleted when the account is closed or the user is deleted |
| Support e-mails | Up to 2 years after the last contact |
| Website and portal server logs | Automatic rotation, as a rule up to 30 days |
| Encrypted backups | Up to 12 months, then overwritten |
Retention periods for machine data are set out in the Data Processing Agreement.
8. Security
We apply appropriate technical and organisational measures: encrypted communications (HTTPS/TLS), secrets encrypted at rest, irreversibly hashed passwords, two-factor authentication, isolation of each customer's data, digitally signed agent commands and updates, an activity log, encrypted backups and restricted staff access. Details are in Annex III of the Data Processing Agreement.
9. Your rights
You may request access to, rectification, erasure, restriction and portability of your data and object to processing based on legitimate interest. In the portal you can download your data (Account › My data), and owners can export the company data and close the account (Settings › Privacy and data).
For other requests write to support@morditor.com. We reply within one month, which may be extended as provided in the GDPR. You also have the right to lodge a complaint with the Portuguese data protection authority (CNPD, www.cnpd.pt) or with the supervisory authority of your country.
10. Changes
We may update this policy. The current version is always published on this page with its date; material changes are communicated to customers by e-mail or in the portal.