1. Introduction and Scope
This Assessor Portal Privacy Notice explains how WASViking LLC ("WASViking", "we", "our", or "us") handles your personal data when an organization that uses the WASViking platform (a "Vendor") invites you to read its security posture through a Posture Share, and when you create the free account of the WASViking Assessor Portal.
It applies to the Assessor Portal only. The personal data of WASViking customers and of visitors to our website is covered by the WASViking Privacy Policy.
2. Who Is Responsible for Your Data
The invitation. A Vendor enters your email address to invite you. WASViking processes that address on the Vendor's behalf, to deliver the invitation and to let the Vendor see and end it. For that data the Vendor is the controller and WASViking acts as its processor, under the WASViking Data Processing Agreement.
Your account. Once you create an account, WASViking is the controller of your account data, described in Section 3.
3. Information We Process
3.1 When a Vendor invites you
Your email address, the Vendor that invited you, who at that Vendor sent the invitation and when. When your address has never signed in, the invitation carries a temporary password made for it. WASViking keeps only a one-way hash of that password, never the value itself, and erases it once your account exists.
3.2 When you create an account
Your email address, your name, your company name, your password (stored only as a one-way hash), your two-factor authentication secret (encrypted at rest), your backup codes (stored only as hashes), your language, your time zone, your notification choices and your acceptance of the Assessor Portal documents (version, time, network address and browser).
3.3 Security records
The time and network address of your sign-ins, failed attempts, temporary locks, and wrong attempts with a temporary password.
3.4 Your activity in a Vendor's shared space
Each visit and each download, with your email address, the time and the network address, and the date, time and network address of the first time you open that Vendor's shared space. Requests you send to a Vendor (for more detail, for a remediation deadline, or for an invitation) are recorded and delivered to that Vendor.
3.5 Notification state
For each Vendor you follow, the last figures you were told (score, declared deadlines and their status, expiry warnings already sent), so that a notification only reports what changed.
3.6 What we do not collect
The Assessor Portal uses no advertising or analytics trackers. It sets only the cookies that are strictly necessary to keep you signed in and to protect its forms. Credential pages use Google reCAPTCHA to prevent abuse, which may process your network address and related technical data.
4. How We Use Your Information
- To deliver invitations and provide the account you asked for;
- To authenticate you and keep the account secure;
- To show you what each Vendor chose to share with you, in your language and time zone;
- To show each Vendor the record of access to its own shared space;
- To send the notification emails you did not turn off, at most one a day;
- To keep evidence of the documents you accepted;
- To comply with legal obligations and to establish, exercise or defend legal claims.
WASViking does not sell your personal data, does not use it for advertising or profiling, and does not show one Vendor's information to another.
5. Legal Basis for Processing
If you are located in the EU or UK, we process your data based on: performance of a contract, to provide the account you asked for (GDPR Art. 6(1)(b)); legitimate interest, to keep the service and the Vendors' information secure and to keep the record of access (Art. 6(1)(f)); and legal obligation, to keep the record of accepted documents where the law requires it (Art. 6(1)(c)).
If you are located in Brazil, the corresponding legal bases under the LGPD are the performance of a contract (Art. 7, V), legitimate interest (Art. 7, IX), compliance with a legal or regulatory obligation (Art. 7, II) and the regular exercise of rights (Art. 7, VI).
If you are a California resident, WASViking does not sell or share your personal information as those terms are defined under the CCPA/CPRA.
6. What a Vendor Sees About You
Each Vendor that invited you sees, in its own access log, your email address, the time, the network address and what you opened or downloaded in that Vendor's shared space, including the first time you opened it and wrong attempts with a temporary password. A Vendor does not see your name, your company name, your password or your two-factor authentication settings, and never sees which other Vendors you follow.
7. Data Sharing and Disclosure
We share your personal data only with: the Vendors that invited you, as described in Section 6; the subprocessors that operate the WASViking platform, listed on the Subprocessors page, under contractual confidentiality and data protection obligations; and authorities, where required by law or to protect the rights and safety of WASViking, Vendors or others.
8. Data Retention and Deletion
Account data is kept while your account exists and is erased when you delete the account on the Profile page. An invitation, and the record of access to a Vendor's shared space, stay in that Vendor's records until the Vendor removes them, the Posture Share is deleted, or the Vendor's own data is erased. Limited records may be retained where reasonably necessary for security, fraud prevention, audit integrity, legal compliance, or the establishment, exercise or defense of legal claims. Residual copies may remain in encrypted backups until they expire through the normal backup retention cycle.
9. Security of Your Information
Accounts are created only from an invitation. Passwords and backup codes are stored only as one-way hashes, two-factor authentication secrets are encrypted at rest, two-factor authentication is mandatory, repeated wrong attempts lock the account for a growing period, a session ends on its own after 8 hours, and you can sign out of every other session from the Security page. The broader controls of the platform are described on the Security Practices page.
10. Your Rights
You can correct your name and company name, change your language, time zone and notification choices, and delete your account yourself in the Assessor Portal. Depending on your location, you may also have the right to access the personal data we hold about you, request correction or deletion, object to or restrict certain uses, request data portability, and lodge a complaint with a supervisory authority. If you are located in Brazil, you may also request confirmation of the existence of processing, anonymization, blocking or deletion of unnecessary or excessive data, and information about the entities your data was shared with.
For requests about the invitation a Vendor sent you, contact that Vendor, which is the controller of that data. WASViking will assist the Vendor in responding.
To exercise your rights, contact us at: [email protected]
Data Protection Officer (Encarregado de Proteção de Dados, LGPD Art. 41): [email protected]
11. International Data Transfers
WASViking LLC is based in the United States. Personal data may therefore be transferred to and processed in the United States and in other locations in which WASViking's authorized service providers operate.
For personal data subject to the GDPR, WASViking uses applicable international-transfer mechanisms recognized under European data protection law, such as the European Commission Standard Contractual Clauses. For personal data subject to the Brazilian LGPD, international transfers are conducted in accordance with Article 33 of the LGPD and applicable ANPD regulations, including Resolution CD/ANPD No. 19/2024.
12. Changes to This Notice
WASViking may update this notice from time to time. When it changes, the Assessor Portal asks you to accept the new version before you continue, and the version you accepted stays on record.
13. Contact Us
For any questions or requests regarding this notice, contact us at:
WASViking LLC
Orlando, FL, USA
[email protected]