Right to know
What data they hold about you, why, who they share it with, how long they keep it, where they got it, and whether it feeds automated decisions.
Public trust record
What your data does on this site, and what you can do about it.
Understand what a website collects, how it responds to your choices and where to ask for help. This page explains the checks behind a Vakteye badge and the privacy rights you can exercise.
The website operator pays for Vakteye's service. A badge describes a reviewed assessment within a defined scope and time. Findings are based on observed behaviour and supporting evidence. Unresolved issues can lead to a review or removal of the badge.
This page is for visitors, not site operators.
For legal, security and procurement
The details behind your decision.
Review how Vakteye handles information, what the service covers and which terms apply before you get started.
Data and retention
Read what information is collected, why it is processed and how retention is described.
Read the detailsHosting and subprocessors
Review the published functions and regions, and how to request the named provider schedule.
Read the detailsSecurity and reporting
Find our vulnerability reporting process and the security contact.
Read the detailsNeed to assess access controls, processing locations or retention for your deployment? Request the current supporting information with your scope review.
Data processing termsAsk a procurement questionGDPR rights
Your rights
Six GDPR rights, short. Click any article link for the original text.
Right to refuse
Saying no can't be harder than saying yes. Consent has to be freely given and a real choice.
Right to withdraw
You can change your mind anytime. Withdrawal stops future processing. Anything done before, based on the consent you'd given, stays lawful.
Right to be forgotten
You can ask them to delete your data, unless they have a legal reason to keep it.
Right to object
Direct marketing — they have to stop. Other legitimate-interest processing — you can object, controller may refuse on compelling grounds.
Right to portability
You can get the data you actively provided in a standard format and move it elsewhere. Applies when you consented or signed a contract, and the data is processed automatically. Inferred or derived data isn't covered.
Assurance boundary
What the badge means, and what it doesn't
It means
The reviewed automated assessment scope had no open findings at the reviewed time. If a monitored finding remains unresolved, the badge is reviewed and subject to removal from this page.
It does not mean
That the site is perfect, or that anyone at Vakteye personally vouches for them. We test against the law. That's not the whole picture of a company.
Who pays us
The site does. But the result is decided by the law, not by us. If we softened findings to keep customers happy, the badge wouldn't be worth anything.
Behavioural test surface
What we test
Eight things. Click any item for how we test it.
Does "Reject all" actually reject?
We click reject as a regular visitor and watch whether tracking cookies and pixels stop loading. If they don't, the site broke your choice.
Does data leak before you click anything?
Many sites load third-party trackers right at page-load, before you've said yes or no. We measure what's sent in the first half-second.
Do they tell trackers to ignore your "no"?
Google Consent Mode and Meta Pixel can be configured to report rejection but still send pseudonymised data. We decode the signals.
Are the basics set up safely: HTTPS, cookies, headers?
TLS, secure cookie flags, CSP, HSTS, X-Frame-Options.
Are they leaking your form inputs to ad networks?
We fill test values and watch whether the content is sent to third parties before the form was submitted.
Are they storing private keys in their JavaScript?
Hardcoded API keys and similar secrets in client code are a common leak. We scan with two detectors.
Is the site usable with a screen reader?
We map key accessibility checks to WCAG 2.1 AA and applicable EU/national accessibility obligations where they apply.
Does their privacy policy match what they actually do?
We read the policy and compare against network traffic. A gap becomes a reviewable legal and operational risk, not an automatic legal conclusion.
We don't test everything
An automated scanner can't reach everything. Logged-in flows, payments, and manually configured privacy features are out of scope. If a WAF or browser challenge blocks us, we flag it.
Certificate lookup
Verify any site
Enter a domain or a certificate number.
Escalation paths
What you can do right now
- Saw something sketchy on a Vakteye-badged site?
Report it to us. We'll re-scan within 24 hours.
- Saw something sketchy on any site?
File with IMY (the Swedish Data Protection Authority).
- Want a stronger ally?
noyb files regulatory complaints with data protection authorities on your behalf, free.
- Want to learn more?
EDPB: how cookie banners hide the Reject button (2023).
Why it matters
Why we built this
EU law says your personal data is yours. But the gap between what privacy policies promise and what code actually does is too large. Annual audits catch it too late. A badge that can't be revoked says nothing. We measure what the law requires on your scan cadence, and publish the reviewed result.
Last reviewed: 2026-07-14
Found something wrong on this page? Email trust@vakteye.com