Privacy policy

Last updated: September 20, 2026

1. Data Controller

This Privacy Policy applies to the website and services operated by Exploit Pack VOF, a company registered in the Netherlands (KvK: 94579121).

Exploit Pack VOF ("Exploit Pack", "we", "us" or "our") is responsible for processing personal data in accordance with the General Data Protection Regulation (GDPR) and applicable Dutch data protection laws.

For privacy-related inquiries, please contact us at support@exploitpack.com.

2. Personal Data We Collect

We collect and process only the personal data reasonably necessary to operate our business, provide our products and services, and meet our legal and compliance obligations.

Depending on your interaction with us, this may include:

  • Identity and contact information: name, email address, telephone number, country and, where applicable, company name and business details.
  • Order and payment information: order history, billing details, transaction references, payment status and related records. Payment card details are processed by our payment providers.
  • License information: license keys, registered email addresses, activation records, license validity and associated user information.
  • Compliance and screening information: identity and company details, intended use of our products, business affiliation and supporting documentation reasonably required to verify customers, assess orders and meet compliance requirements.
  • Technical information: IP addresses, browser information, device data, website activity and security logs, where collected.
  • Communications: correspondence, support requests, demo inquiries and other information you voluntarily provide.

3. How We Use Your Personal Data

We use personal data for the following purposes:

  • Processing orders, payments and license deliveries.
  • Issuing, activating and administering software licenses.
  • Conducting customer screening and verifying the identity, legitimacy and intended use of orders.
  • Preventing fraud, unauthorized access, license abuse and unlawful use of our products.
  • Meeting applicable legal, regulatory, tax and accounting obligations.
  • Providing customer support, responding to inquiries and arranging product demonstrations.
  • Maintaining the security and functionality of our website and services.
  • Sending relevant business communications and, where legally permitted, marketing communications.

We process personal data based on contractual necessity, compliance with legal obligations, our legitimate interests or your consent, as applicable.

Our legitimate interests include fraud prevention, customer verification, protection of our software and intellectual property, and the prevention of unauthorized or unlawful use of our products.

4. Customer Screening and Compliance

Due to the nature of our cybersecurity products, Exploit Pack conducts customer screening and may require additional information or documentation before approving an order, issuing a license, providing access or continuing a business relationship.

Screening may include verification of customer identity, company information, intended use, payment-related risk indicators and, where relevant, sanctions and export-control considerations.

We may use relevant information and third-party verification or fraud prevention services to assess potential risks.

Where an order presents unresolved fraud, compliance or security concerns, we may request additional information, delay delivery or refuse the transaction, subject to applicable law and our contractual obligations.

We retain screening records only for as long as reasonably necessary for verification, compliance, fraud prevention and the establishment, exercise or defence of legal claims, in accordance with applicable data protection law.

5. Sharing and Disclosure of Personal Data

We do not sell personal data.

We may share personal data with third parties where necessary for the operation of our business, including:

  • Shopify: to operate our online store and manage orders.
  • Payment providers: to process payments and help prevent fraudulent transactions.
  • Security and verification providers: where necessary for customer screening, fraud prevention and compliance checks.
  • Business service providers: where necessary for hosting, communications, customer support and business administration.
  • Professional advisers and public authorities: where required by law or necessary to establish, exercise or defend legal claims.

Such parties receive only the information reasonably necessary for their respective purposes and are subject to applicable data protection requirements.

Where personal data is transferred outside the European Economic Area (EEA), we ensure that appropriate safeguards are in place as required by applicable law.

6. Data Retention and Security

We retain personal data only for as long as necessary for the purposes described in this Policy or as required by applicable law.

Order and financial records are retained for the periods required by applicable accounting and tax legislation. License, support and compliance records may be retained for as long as necessary to administer licenses, address disputes, prevent abuse and meet legal obligations.

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration or disclosure.

Access to personal data is restricted to those who require it for legitimate business purposes. No method of electronic storage or transmission can be guaranteed to be completely secure.

7. Cookies and Website Technologies

Our website uses cookies and similar technologies to support essential functionality, security and, where applicable, analytics and marketing.

Strictly necessary cookies may be used without consent where permitted by law. Non-essential analytics and marketing cookies are used only where the required consent has been obtained.

You can manage your cookie preferences through the available consent settings and your browser.

8. Your Rights and Contact

Under the GDPR, you may have the right to:

  • Access your personal data.
  • Request the correction or deletion of your personal data.
  • Request the restriction of processing.
  • Request data portability, where applicable.
  • Object to processing based on legitimate interests.
  • Withdraw consent at any time where processing is based on consent.
  • Lodge a complaint with a competent data protection authority.

These rights are subject to applicable legal conditions and exceptions, including our obligations to retain certain records.

To exercise your rights or ask questions about this Policy, contact:

Exploit Pack VOF
Maastricht, The Netherlands
Email: support@exploitpack.com
Website: https://www.exploitpack.com

9. Changes to This Policy

We may update this Privacy Policy to reflect changes in our business, data processing activities or applicable legislation. The latest version will always be published on our website, together with its revision date.

Where required by law, we will provide additional notice or obtain consent before implementing changes.