DE EN
Sign up

Privacy Policy of the Bug Bounty Platform bugbounty.de

This English version is provided for convenience. In case of discrepancies, the German version shall prevail.

This privacy policy describes which personal data is processed when the website www.bugbounty.de is visited, when someone signs up for the platform launch and when someone makes contact by email. Separate privacy information applies to the use of the platform.

1. Controller

Rootsektor IT-Security GmbH
Lottenweg 11
59757 Arnsberg
Germany

Email: info@rootsektor.de
Phone: +49 2932 465265-0

Represented by the managing director Sebastian Michel. Further details are provided in the legal notice.

2. Contact for data protection matters

For questions about data protection and the exercise of data subject rights, Sebastian Michel, Managing Director of Rootsektor IT-Security GmbH, can be reached using the contact details in section 1, in particular by email at info@rootsektor.de.

3. Hosting and server log files

The website is operated on web space provided by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, in data centers in Germany. STRATO processes the data as a processor on the basis of an agreement under Art. 28 GDPR.

The website is delivered exclusively via an encrypted connection (HTTPS). With every request, the server processes the following data for technical reasons and stores it in server log files:

  • IP address of the requesting device
  • date and time of access
  • requested address (URL) and type of request
  • HTTP status code and amount of data transferred
  • previously visited page (referrer), if transmitted by the browser
  • information about the browser and operating system (user agent)

Purpose: delivery of the website, ensuring operation and security, and detecting and preventing attacks and misuse.

Legal basis: Art. 6(1)(f) GDPR. The legitimate interest lies in the secure and stable provision of the website.

Retention period: The server log files are deleted automatically after a short period set by the hosting provider; data whose further storage is required for evidence purposes is excluded from deletion until an incident has been resolved. The data is not combined with other data sources.

4. Storage in the browser

Without using cookies, the website stores the following information locally in the browser (local storage):

  • the choice made in the consent banner (consent to web analytics given or refused) and the time of this choice
  • the selected display mode (light or dark), if it has been changed

This information is not transmitted to the bugbounty.de server or to third parties. It remains stored until it is deleted in the browser. The choice in the consent banner is requested again after 12 months.

Legal basis: Section 25(2) no. 2 of the German TDDDG, because the storage is strictly necessary to respect the consent decision and to provide the display mode explicitly selected. Where personal data is processed in this context, the legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in a functional website that respects the choice of its visitors.

5. Web analytics with Google Analytics 4

The website uses Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics is loaded only after explicit consent via the consent banner. The “Reject all” and “Accept all” buttons are presented with equal prominence. Without consent, Google Analytics is not loaded: no connection to Google is established and no cookies are set.

Purpose: statistical analysis of the use of the website, for example which pages are visited and how visitors reach the website, in order to improve the content.

Data processed: a randomly generated identifier from the cookie, pages visited and interactions, date and time of the visit, the previously visited page (referrer), information about the device and browser (such as device type, operating system, screen resolution and language setting) and the approximate location (country, region, city), which Google derives from the IP address. When Google Analytics is loaded, the IP address is transmitted to Google for technical reasons; according to Google, IP addresses are not logged or stored in Google Analytics 4.

Settings: Google Signals and ads personalization are deactivated. The retention period for event-level and user-level data is set to 2 months.

Google Analytics is not loaded on the pages for confirming and unsubscribing from the sign-up, so that the personal links from the emails are not transmitted to Google.

Cookies:

  • _ga: distinguishes visitors by means of a randomly generated identifier. Retention period: 2 years; the period starts again with every page view.
  • _ga_<ID>: stores the session state; <ID> stands for the identifier of the data stream. Retention period: 2 years; the period starts again with every page view.

Legal basis: consent under Section 25(1) of the German TDDDG for storing information on the end device and accessing it, and under Art. 6(1)(a) GDPR for the further processing.

Data processing: Google processes the data as a processor on the basis of Google’s data processing terms (Google Ads Data Processing Terms).

Transfer to the USA: Data may be transferred to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. The basis is the adequacy decision of the European Commission on the EU-US Data Privacy Framework (Art. 45 GDPR); Google LLC is certified under this framework.

Retention period: The cookies are deleted when the retention period stated above expires, unless they are deleted in the browser beforehand. In Google Analytics, event-level and user-level data is deleted automatically after 2 months; aggregated reports are not affected.

Withdrawal: Consent is voluntary and can be withdrawn at any time with effect for the future via the “Cookie settings” link in the footer. Google Analytics is then no longer loaded, and the Google Analytics cookies are deleted. The lawfulness of the processing carried out until the withdrawal remains unaffected.

Further information is provided in Google’s privacy policy: https://policies.google.com/privacy

6. Google Search Console

Rootsektor IT-Security GmbH uses Google Search Console of Google Ireland Limited to evaluate how the website is presented in Google search results and to identify technical indexing errors. Ownership of the domain is verified via a DNS record or a meta tag in the source code. Search Console is not embedded in the website: visiting the website does not transmit any data to Google via Search Console, and no cookies are set. In Search Console, Google provides information on search queries, impressions and clicks in aggregated form. No consent is required for this.

7. Sign-up for the platform launch

Data processed: email address, selected target group (researcher, company or public sector organization), language of the website, version of the consent text and the times of the request and the confirmation. As proof of consent, the IP addresses at the time of the request and of the confirmation are also stored in encrypted form.

Purpose: information by email about the launch of bugbounty.de and, depending on the target group, about participation as a researcher, about the services for companies including the basic VDP and managed triage, or about the services and terms for public sector organizations. The data is used only for this purpose.

Double opt-in: After the form has been submitted, an email with a confirmation link is sent to the address provided. The sign-up becomes active only once it has been confirmed via this link. The link is valid for 72 hours. Without confirmation, no further emails are sent. If the address has already been confirmed for the selected target group, a notice with an unsubscribe link is sent to this address instead of the confirmation link.

Legal basis: consent under Art. 6(1)(a) GDPR. Logging the request and the confirmation serves as proof of consent (Art. 7(1) GDPR); the legal basis for this is Art. 6(1)(f) GDPR.

Storage: The data is stored in encrypted form on the web space at STRATO in Germany. An internal mailbox of Rootsektor IT-Security GmbH is notified by email about confirmed sign-ups of companies and public sector organizations; Microsoft 365 is used for this purpose (section 8).

Protection against misuse: The form contains a field that is not visible to humans in order to detect automated submissions. To limit repeated requests, the IP address is stored only as a cryptographic hash for no more than 24 hours. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in protecting the form and the recipients from misuse.

Retention period: The confirmation link is valid for 72 hours; unconfirmed requests are then deleted automatically. Confirmed sign-ups are stored until consent is withdrawn or the purpose no longer applies, at the latest six months after the platform launch. Upon withdrawal, the email address and IP addresses are deleted immediately. As proof of consent and withdrawal (Art. 7(1) GDPR), a pseudonymized entry without the email and IP addresses (cryptographic hash of the address, times, version of the consent text) is kept for three years after withdrawal; the legal basis is Art. 6(1)(c) and (f) GDPR.

Withdrawal: Consent can be withdrawn at any time with effect for the future, via the unsubscribe link in every email or using the contact details given in section 1. Signing up again is possible at any time.

Providing the data is voluntary. Without an email address, target group and consent, signing up is not possible.

8. Sending emails and email mailboxes via Microsoft 365

Microsoft 365 of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland, is used for sending the sign-up emails, for the internal notification and for the email mailboxes, including security@bugbounty.de. Microsoft processes the data as a processor on the basis of an agreement under Art. 28 GDPR (Microsoft Products and Services Data Protection Addendum).

This includes in particular email addresses, the content of emails and technical connection data. A transfer to Microsoft Corporation in the USA cannot be ruled out; the basis is the adequacy decision of the European Commission on the EU-US Data Privacy Framework (Art. 45 GDPR), under which Microsoft Corporation is certified.

9. Contact by email and vulnerability reports

When someone makes contact by email, including reports to security@bugbounty.de, the information provided is processed, such as the email address, the name if provided and the content of the message, including technical details on a reported vulnerability. Reports can also be submitted anonymously.

Purpose: handling the request or report, including follow-up questions, remediation and coordinated disclosure of vulnerabilities.

Legal basis: Art. 6(1)(f) GDPR. The legitimate interest lies in answering requests and in the security of the company’s own systems. If a request relates to a contract or its initiation, the legal basis is Art. 6(1)(b) GDPR.

Retention period: The data is deleted when the handling has been completed and no statutory retention obligations apply, at the latest after six months. Vulnerability reports and the related correspondence are kept until handling and any coordinated disclosure have been completed and for three years thereafter for evidence purposes (Art. 6(1)(f) GDPR).

10. Recipients

Recipients of personal data are the service providers named in sections 3, 5 and 8: STRATO, Google (only with consent) and Microsoft. Data is disclosed to other third parties only where there is a legal obligation to do so. Personal data is not sold.

11. Rights of data subjects

Under the GDPR, data subjects have the following rights:

  • access to the data processed (Art. 15 GDPR)
  • rectification of inaccurate data (Art. 16 GDPR)
  • erasure (Art. 17 GDPR)
  • restriction of processing (Art. 18 GDPR)
  • data portability (Art. 20 GDPR)
  • withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)

Right to object under Art. 21 GDPR: Where processing is based on Art. 6(1)(f) GDPR, the data subject may object to it at any time on grounds relating to their particular situation. The data will then no longer be processed unless there are compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing serves the establishment, exercise or defense of legal claims.

Requests to exercise these rights can be sent to the contact details given in section 1.

12. Right to lodge a complaint with a supervisory authority

Data subjects have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for Rootsektor IT-Security GmbH is:

Die Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia)
Kavalleriestraße 2–4
40213 Düsseldorf, Germany
https://www.ldi.nrw.de

13. No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

14. Version

Version of this privacy policy: November 3, 2026