Privacy statement

Version 2026-11-04.

Who is responsible

DossierForge is built and sold by Skoft Software, the trade name of Rubèn Plantinga, a sole proprietorship at Loosduinseweg 297a, 2571 AD Den Haag, Netherlands, registered with the Kamer van Koophandel under 42097143. Skoft Software decides what happens to the data described below, which makes it the controller in the sense of the GDPR. The full business identification is on the imprint. Write to hello@dossierforge.com about anything on this page.

Writing to that address means we hold your address and your message. Cloudflare passes your mail on to our inbox at the Cloudflare location that receives it. Cloudflare logs the sender, the recipient and the subject of each mail it passes on to hello@, problem@ and idea@dossierforge.com. Skoft Software can read that log. Cloudflare keeps it for 31 days. The basis is our legitimate interest in answering the people who write to us, under article 6(1)(f) of the GDPR.

We delete a settled exchange 90 days after its last message. We delete the whole thread and never just archive it. Before then, we set apart what a sale's records, a request to use your rights or a dispute still needs. A mail that is itself an invoice, an order confirmation or an agreed change to an order is kept for seven years after the sale or after the end of the subscription it belongs to. For a sale declared through the EU VAT one-stop shop, it is kept for ten years. Keeping it is our legal duty, under article 6(1)(c) of the GDPR. A support message about a purchase is not such a record. A request to use your rights is kept with our check of your identity and our answer until it is settled and no complaint about it is pending. Showing how we answered it is our legal duty, under article 6(1)(c) of the GDPR. A dispute is kept until it is settled. The basis is our legitimate interest in making or defending a legal claim, under article 6(1)(f) of the GDPR. Deleted mail stays in the bin for up to 30 days. Google's retention policy says it then takes about two months to leave its systems and can stay in its backups for up to six months.

How this site works

Fonts, styles and images load from this domain. The site uses no analytics or tracking pixels.

The free scope check sends one request to this site when it produces a result. The host counts these requests as completed checks. The host is Cloudflare, which counts each one at the Cloudflare location that receives it. The request contains no answers, product details, cookies, identifiers or referrer.

Cloudflare sees your network address when you visit and keeps operational logs to run and protect the site. Cloudflare handles each visit at the Cloudflare location that receives it, which can be outside the European Economic Area. Skoft Software reads completed-check totals, not those logs. The basis for this handling is our legitimate interest in running and defending the site, under article 6(1)(f) of the GDPR. Cloudflare keeps what it handles for us only as long as it needs it to run and protect our services. It never keeps it after our agreement with Cloudflare ends. What Cloudflare records about its own network it keeps under its own privacy policy, as its entry below says.

Choosing a light or dark theme saves that preference in your browser. It is not sent to a server.

Buying DossierForge

Stripe runs the payment page. On our order form you enter your business name, email address, address, the country where the app will be used and your VAT number if you have one. Our checkout service at checkout.dossierforge.com passes these to Stripe. It runs on Cloudflare and handles your order at the Cloudflare location that receives it. You enter your payment details on Stripe's page. Skoft Software sees all of this in its Stripe account, except the full card details, which stay with Stripe. To keep the checkout service usable, the service turns the network address an order comes from and today's date in UTC into a one-way value, using a secret key only the service holds. Because the date is part of it, the value changes every day. It makes that value at the Cloudflare location that receives the order, which can be outside the European Economic Area. It counts orders per value only in its memory and only in the EU. It deletes that count a minute after it starts. It never stores your network address. The basis for this count is our legitimate interest in keeping the checkout service usable, under article 6(1)(f) of the GDPR.

Before you pay and again before each licence key is issued, a renewal is charged or a product is added, we check your business name, the name the EU VAT register holds for your VAT number and the name on your payment card against the EU sanctions lists. If a check holds your order, Skoft Software receives your order details by email and a person reviews them. Skoft Software also receives by email an order refused while it carries a promotion code, with your business name, email address, the places you gave, the country of your connection and the code, so a person can check whether the code belongs to a customer. For an order a person handles as a sale by invoice, Skoft Software receives by email every detail the order form holds and the country of your connection. We ask in which country the app will be used, because EU sanctions law and our terms rule out supplying it for use in some places. Sanctions law rules out Russia, Belarus, North Korea, Crimea, Sevastopol and the parts of the Donetsk, Luhansk, Kherson and Zaporizhzhia regions that Russia occupies. Our terms also rule out Iran and Syria. A connection does not show which part of those four regions it comes from, so our terms also rule out a connection from anywhere in them.

Cloudflare tells us the country your connection comes from when you order and when the app checks its licence. It does the same when you add a product. When your connection is in Ukraine, it tells us the region too. Cloudflare reads both at the Cloudflare location that receives the request. For every request to updates.skoft.app, Cloudflare gives both to our update service there. We keep the country of the connection you order from with that order at Stripe. When we hold an order because its connection is in Crimea, Sevastopol or the Donetsk, Luhansk, Kherson or Zaporizhzhia region, we keep that region with the order at Stripe. The licence service reads the country and region of a licence check only to refuse a check from Russia, Belarus, Iran, Syria, North Korea, Crimea, Sevastopol or the Donetsk, Luhansk, Kherson or Zaporizhzhia region. It does not keep them. The licence check keeps no key and nothing else about you of its own. Cloudflare logs five in a hundred requests to our checkout service and one in a hundred to our licence service. The details it adds to each logged request can include your network address. Skoft Software can read these logs. Cloudflare keeps them for at most seven days. When you give an EU VAT number from outside the Netherlands, we check it in the European Commission's VAT register (VIES). We keep the result and its reference number with your order. The sanctions checks and the VAT checks are our legal duty, under article 6(1)(c) of the GDPR. Refusing or holding an order for a place only our terms rule out rests on the contract, under article 6(1)(b) of the GDPR, as a step you ask for before the contract is made. Reading a place sanctions law rules out is our legal duty.

Our checkout service links your licence key to your purchase at Stripe, so the key can be issued, renewed and, after a refund, revoked. It does this at the Cloudflare location that receives the request. For Maintain, the link is on each paid invoice. For One-time, it is on Stripe's record of the checkout, on the invoice and on your customer record. Each copy of that link is kept until the sale's tax records end, after seven years or ten under the EU VAT one-stop shop. It is then cleared. The link on your customer record also stays for as long as your key works, so a sanctions hold can still reach the key. If you waive your right of withdrawal to get your key at once, the moment of that waiver and a token that identifies it are stamped on the same Stripe records. They are kept for the same tax period, as proof of the waiver. The records our checkout service keeps itself are listed with their periods in the Cloudflare entry below. Cloudflare sends the licence email. Cloudflare logs the sender, the recipient and the subject of each mail our checkout service sends. Skoft Software can read that log. Cloudflare keeps it for 31 days. Cloudflare also keeps a copy of each of these mails for about seven days. If a mail to you cannot be delivered or is reported as spam, Cloudflare puts your address on a list that stops further mail to it. After a temporary failure your address stays on that list for 24 hours. After most permanent failures it stays for seven days. When the mailbox does not exist or the mail was reported as spam, it stays until we remove it.

The basis is the contract with you, under article 6(1)(b) of the GDPR. Keeping tax records is our legal duty, under article 6(1)(c) of the GDPR. You cannot buy without giving these details.

Invoices and the records behind them are kept for seven years, as Dutch tax law requires, or ten years where a sale falls under the EU VAT one-stop shop.

Some sales are made on an invoice instead of through Stripe. Such a sale is one we agree with you, or an order our checkout passes to a person. Nothing of it goes to Stripe. A person answers you from hello@dossierforge.com. We keep the declaration you gave with your order or in writing, that you buy for your business and that neither your business nor anyone who owns half or more of it or controls it is on an EU sanctions list. We check your business name, the name the EU VAT register holds for your VAT number and the payer's name against the EU sanctions lists. You pay our invoice by bank transfer. We email your licence key once it is paid. Your names are checked again at each invoice and once a month while the key runs. If one of them appears on an EU sanctions list, the ids of your keys go on our list of revoked keys, which is kept in Cloudflare's storage with the ids of refunded keys. The licence check then refuses those keys. Each id is kept until its key's expiry day ends, or for good for a One-time key. The basis is the contract with you, under article 6(1)(b) of the GDPR. The sanctions checks and keeping the invoice are our legal duty, under article 6(1)(c) of the GDPR. The invoice, the mails of the sale and your declaration are kept as the records of the sale, for the periods above.

Who else touches it

These companies receive the data described here. Skoft Software itself is in the Netherlands, inside the EU.

• Cloudflare, Inc. serves this site and sends the mail. Cloudflare can handle your data in any of its data centres worldwide, outside the European Economic Area as well as inside it, in the United States among other places. It also runs our checkout service, our licence service, the update server at updates.skoft.app, the feedback relay and the forwarding of mail to hello@, problem@ and idea@dossierforge.com. Each of them handles a request at the Cloudflare location that receives it, which can be outside the European Economic Area. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework, which the European Commission recognises as adequate protection, so the transfer to Cloudflare, Inc. in the United States rests on that adequacy. Where Cloudflare handles your data in its other locations outside the European Economic Area, it stays bound to that framework's protection and must bind any company helping it there to the same. The standard contractual clauses in Cloudflare's data processing addendum take over only if that certification lapses or the European Commission's adequacy decision falls. Write to hello@dossierforge.com for a copy of those clauses; Cloudflare also publishes the addendum on its own site. For data from Switzerland, the transfer to Cloudflare, Inc. rests on Switzerland's recognition of the Swiss-US Data Privacy Framework for certified US companies, decided by the Federal Council on 14 August 2024. Cloudflare is also certified under the Swiss-US Data Privacy Framework. In its other locations outside Switzerland, Cloudflare stays bound to that framework's principles and must bind any company helping it there to the same. The same clauses, adapted to Swiss law, take over if that certification lapses or Switzerland's recognition falls. For data from Japan, Cloudflare's addendum relies on its certification under the Global Privacy Recognition for Processors system. For Skoft Software, Cloudflare handles the requests to our services, what passes through them and the logs we can read in our Cloudflare account. It does so as a processor, under its data processing addendum. What Cloudflare records about its own network for its own purposes, such as security data, it handles as a controller under its own privacy policy at cloudflare.com/privacypolicy. Our checkout service keeps its own records in Cloudflare's storage, which Cloudflare can place in any of its data centres worldwide. A record of each payment event Stripe sends, with what the service did about it, is kept for 30 days. For Maintain, a record of the key last issued for a subscription, with its plan, product count and expiry, is kept until 30 days after the paid period ends. A record that makes sure each purchase gets only one key is kept until 30 days after the paid period ends for Maintain or 30 days after the sale for One-time. The tax evidence of each sale is kept until 1 January of the eighth year after the sale, or the eleventh for a sale declared through the EU VAT one-stop shop. That evidence holds your billing and card country, how you paid, the country whose VAT Stripe charged, whether the sale went through the one-stop shop and the result of the check on your VAT number, but not the number itself. A list of the sales made with one VAT number, filed under Stripe's id for that number rather than the number itself, is kept until the evidence of the last of those sales ends. A marker that a renewal notice was sent for a charge is kept for 90 days. The id of a refunded key is kept until the key's expiry day ends, or for good for a One-time key, which never expires. The id of a key held for a sanctions review is kept until the hold is cleared or the key's expiry day ends, whichever comes first. A One-time key refused after that review stays held for good. The id of a key a person cleared for licence checks and requests to updates.skoft.app from a place the licence service refuses is kept for one year after that person's confirmation. The basis for these records is the contract with you, under article 6(1)(b) of the GDPR. Keeping the tax evidence, the sanctions holds and these clearances is our legal duty, under article 6(1)(c) of the GDPR. Keeping a clearance for a place only our terms rule out rests on the contract, under article 6(1)(b) of the GDPR.
• Stripe runs the payment page and keeps the purchase records. Skoft Software's contract is with Stripe Payments Europe, Limited in Ireland, which passes data to Stripe, LLC in the United States. Stripe, LLC is certified under the EU-US and the Swiss-US Data Privacy Framework, with standard contractual clauses in Stripe's data transfers addendum behind both. For data from Japan, Stripe's privacy policy says it makes written agreements with rights and duties equivalent to Japanese privacy law. Stripe's privacy policy says data from Canada, Quebec included, goes to its data centres in the United States. Stripe handles payment data for Skoft Software. For some purposes, such as preventing fraud and meeting its own duties as a payment provider, Stripe decides for itself what it does with it, under its own privacy policy at stripe.com/privacy.
• Google Ireland Limited provides the Google hosted inbox that hello@dossierforge.com, problem@dossierforge.com and idea@dossierforge.com are forwarded to. Google receives what you write to those addresses and every report you send by pressing Send in the Feedback panel. It also receives the mails our checkout service sends to hello@dossierforge.com about a purchase that a person has to review. It holds the mails of each sale by invoice too. Google keeps mail on servers around the world, in the United States among other places. Its US company, Google LLC, is certified under the EU-US and the Swiss-US Data Privacy Framework. For other countries, Google's published transfer page says it relies on standard contractual clauses where no adequacy decision covers a transfer.
• Linear Orbit, Inc. receives every report you send by pressing Send in the Feedback panel and every mail you write to problem@dossierforge.com or idea@dossierforge.com, so Skoft Software can track each one as an issue. Skoft Software does not publish these issues. Linear handles them for Skoft Software as a processor, under Linear's data processing agreement, which applies with Linear's terms of service. Linear publishes that agreement at linear.app/dpa. Its main processing takes place in the United States. The transfer rests on the EU standard contractual clauses that the agreement incorporates, from Commission Decision 2021/914. Those clauses also cover data from Switzerland and Japan, because the agreement applies them to everything handled under the GDPR. It names no other route for either.
• e-Boekhouden.nl is our bookkeeping service. It keeps the invoice of each sale by invoice, with your name and address. It also keeps the record of your transfer, with the payer's name and account number. It handles this data in the Netherlands, inside the EU.
• Coöperatieve Rabobank U.A. is our bank. It receives the transfer you send for a sale by invoice, with the payer's name and account number. It handles this data in the Netherlands, inside the EU.

The licence check in the application

The installed application sends its licence key to license.skoft.app for validation. The service stores no key it receives. Skoft Software can link a key to your purchase at Stripe, as Buying DossierForge describes. Cloudflare logs one request in a hundred to the service. The log holds the web address requested and details Cloudflare adds, which can include your network address. Skoft Software can read that log. Cloudflare keeps it for at most seven days. The request is handled at the Cloudflare location that receives it, which can be outside the European Economic Area.

When you add a product to a Maintain licence from the app, the app sends its licence key and the number of products you want your licence to cover to our checkout service at checkout.dossierforge.com. The service uses the key to find your purchase at Stripe. It checks your purchase against the EU sanctions lists, as Buying DossierForge describes. It then opens Stripe's page, where you confirm and pay. It does not store the key. It handles the request at the Cloudflare location that receives it, which can be outside the European Economic Area. The request is counted and logged as an order is. The new number of products is kept with your subscription and its invoices at Stripe, for as long as the records behind those invoices. The basis is the contract with you, under article 6(1)(b) of the GDPR. The sanctions check is our legal duty, under article 6(1)(c) of the GDPR. The service also reads the country of the request. When the request comes from Ukraine, it reads the region too. A request from a connection in Russia, Belarus, Iran, Syria, North Korea, Crimea, Sevastopol or the Donetsk, Luhansk, Kherson or Zaporizhzhia region opens no Stripe page. Your customer and subscription at Stripe, the product counts and the place go by email to hello@dossierforge.com instead. A person checks where you use DossierForge. Nothing is charged while the person checks. Holding such a request for a place sanctions law rules out is our legal duty, under article 6(1)(c) of the GDPR. Holding it for a place only our terms rule out rests on the contract, under article 6(1)(b) of the GDPR.

As with any request to any website, Cloudflare's edge sees the network address the request came from and handles it as the processor described above. That edge is the Cloudflare location that receives the request. The basis is our legitimate interest in answering the request and keeping the endpoint defended, under article 6(1)(f) of the GDPR. Refusing a key held after a sanctions check, or a check from a place sanctions law rules out, is our legal duty, under article 6(1)(c) of the GDPR. Refusing a check from a place only our terms rule out rests on the contract, under article 6(1)(b) of the GDPR. Cloudflare keeps that network address as it does for a visit to this site.

Licence validation, app update checks at updates.skoft.app, rules requests and security notice checks run automatically. With Maintain, the app asks updates.skoft.app for updated rules. With One-time, it asks the same host for your purchased rules if they are missing from your machine. Every six hours the app asks updates.skoft.app for security notices about its version. Update checks, rules requests and security notice checks do not carry your licence key. When updates.skoft.app refuses one for the place your connection appears to come from, the app asks once more with the id of your licence key. When that second update check finds an update, the app downloads it with the same id. updates.skoft.app reads the id only to see whether a person cleared that key and whether it is held after a sanctions check, as Your rights describes. Cloudflare serves updates.skoft.app for Skoft Software. As with any request, it sees the network address each update, rules and security notice request comes from. It handles each one at the Cloudflare location that receives it. The basis for the update, rules and security notice requests is our legitimate interest in keeping the application updated and secure, under article 6(1)(f) of the GDPR. Reading the country and region of a request to refuse one from a place sanctions law rules out is our legal duty, under article 6(1)(c) of the GDPR. Refusing one from a place only our terms rule out rests on the contract, under article 6(1)(b) of the GDPR, when you hold a licence. For a visitor without a licence, it rests on our legitimate interest in not supplying DossierForge where our terms rule it out, under article 6(1)(f) of the GDPR. For a place sanctions law rules out, reading the id of your licence key is our legal duty, under article 6(1)(c) of the GDPR. For a place only our terms rule out, it rests on the contract, under article 6(1)(b) of the GDPR. Skoft Software keeps nothing of these requests. Cloudflare keeps the network address as it does for a visit to this site. Once you agree to it, the app downloads the scanner vulnerability database from its publisher and refreshes it every two hours. Scanning and document generation run on your machine.

Optional connections in the application

When you run or schedule a vulnerability check, component names and versions go to the public OSV database at api.osv.dev. CVE identifiers go to the public NVD database at services.nvd.nist.gov. For a component taken from a Git repository, the OSV request carries the repository address and commit instead. If you set an NVD API key, it is sent to NVD with those requests. Checks also download the public list of known exploited vulnerabilities from cisa.gov when needed. No product information is sent to CISA.

If you connect GitHub or GitLab, your access token goes to the service you configured. The app reads release information and downloads SBOM files from that service. These services also receive the network address the requests come from.

Sending feedback from the application

Pressing Send in the Feedback panel sends your message, attached screenshots, app version, operating system and processor architecture. You choose whether to include diagnostics and a reply address. Dossier documents are not attached automatically; anything you include in your message or screenshots is sent.

feedback.dossierforge.com receives the report and relays a problem to problem@dossierforge.com and an idea to idea@dossierforge.com. The relay does not store report content. To keep the relay from being flooded, it turns the network address a report comes from (for an IPv6 address, its first half) and today's date in UTC into a one-way value, using a secret key only the relay holds. Because the date is part of it, the value changes every day. It makes that value at the Cloudflare location that receives the report, which can be outside the European Economic Area. It counts reports per value only in its memory and only in the EU. It deletes that count after ten minutes. It never stores your network address. The basis for this count is our legitimate interest in keeping the relay usable, under article 6(1)(f) of the GDPR. The relay keeps no log of your request. Cloudflare's edge still sees the network address a report comes from, as it does for every request. It handles that address as it handles a visit to this site. Both addresses forward to a Google hosted inbox, so Google receives the report. Mail you write to either address yourself goes the same way. Each report and each mail to either address also becomes an issue in Linear, which Skoft Software does not publish. We delete that issue once we have dealt with your report. Linear removes it for good 30 days later. The basis is our legitimate interest in tracking and fixing what you report, under article 6(1)(f) of the GDPR. We delete the report from that inbox once we have dealt with it. Deleted mail stays in the inbox's bin for up to 30 days. Google's retention policy says deleted data generally takes about two months to leave its systems and can stay in its backups for up to six months. Include a reply address if you want a response.

If we contact you first

Skoft Software writes to a small number of businesses whose products the Cyber Resilience Act may reach. If we wrote to you first, we took your name, business email address and role from your company's website, a public business register or a person who introduced us. We record where and when we found them, when we wrote and what you answered.

The purpose is to offer DossierForge to your business. The basis is our legitimate interest in offering DossierForge to businesses it may help, under article 6(1)(f) of the GDPR.

We delete these details 12 months after our last message unless you become a customer. Tell us to stop and we never write to you again. Reply to our message or write to hello@dossierforge.com. We then keep only your address on a list of people not to contact.

Outside the EU

If you are in Switzerland, Swiss data protection law applies alongside the GDPR. The companies above that handle your data outside the EU name their Swiss route there.

If you are in Canada, the purposes are the ones on this page: answering your mail, offering DossierForge if we wrote to you first, selling and delivering your licence, adding products to it, checking it, refusing supply where sanctions law or our terms rule it out, relaying your feedback, keeping the checkout service usable, keeping the relay from being flooded and tracking your reports. Stripe, Cloudflare, Google and Linear handle your information outside Canada, in the United States among other places. e-Boekhouden.nl and Rabobank handle your information for a sale by invoice in the Netherlands. Rubèn Plantinga, the owner of Skoft Software, is the person in charge of personal information and answers questions about these service providers. Write to him at hello@dossierforge.com or at Loosduinseweg 297a, 2571 AD Den Haag, Netherlands. You can ask for access to your information and for its correction there.

If you are in Quebec, your information is communicated outside Quebec: to Skoft Software in the Netherlands and to the companies above, in the United States among other places. The written agreements that bind them are Google's terms of service and the data processing agreements of Stripe, Cloudflare and Linear. For a sale by invoice, e-Boekhouden.nl keeps the invoice under its terms of use, which Skoft Software accepted for its bookkeeping. Rabobank receives only the transfer you send.

If you are in Japan, the purposes are the ones on this page. Japan recognises the EU as giving equivalent protection. The companies above that handle your data outside the EU name their route for data from Japan. You can ask us to disclose, correct, stop using or delete your information by writing to hello@dossierforge.com.

Your rights

You can ask for a copy of what we hold about you, have it corrected, have it deleted, have what we do with it restricted, receive it in a portable form, or object to it. One email to hello@dossierforge.com is enough. We answer within one month and in practice within the same week.

The feedback relay refuses a report automatically when too many come from one network address within ten minutes (for IPv6, from addresses that share their first half), or from all senders together in one hour or one day, counted in UTC. The app keeps your report and names the address to email it to instead. No profile of you is built from any of this.

Some decisions about an order or a licence key are also taken automatically, to follow EU sanctions law or our terms. Article 40 of the Dutch GDPR Implementation Act allows the ones sanctions law requires, for a name on an EU sanctions list and for Russia, Belarus, Crimea, Sevastopol, North Korea and the parts of the Donetsk, Luhansk, Kherson and Zaporizhzhia regions that Russia occupies. Our terms rule out Iran, Syria and a connection from anywhere in those four regions, because a connection does not show which part it comes from. The decisions for those places rest on the contract we offer, under article 22(2)(a) of the GDPR. For both, a person can review each decision. You can give your view and contest it. An order is refused when the billing address or the place where the app will be used is in Russia, Belarus, Crimea, Sevastopol, North Korea, Iran or Syria. Nothing is charged for it. An order whose billing address or place of use is in the Donetsk, Luhansk, Kherson or Zaporizhzhia region is held until a person checks where you are and where you use DossierForge. An order, or a product added to a Maintain licence, that comes from a connection in Russia, Belarus, Iran, Syria, North Korea, Crimea, Sevastopol or one of those four regions is held the same way. Nothing is charged while it is held. An order that gives Cuba as the billing address or the place of use is not refused. A person handles it by email as a sale by invoice. Nothing of it reaches Stripe. The sanctions check that Buying DossierForge describes also runs each time the EU sanctions lists change for a purchase made through our checkout. A person checks the names of a buyer by invoice at each invoice and once a month instead. If a name on your purchase matches or comes close to a listed name when you order an upgrade, when you add a product, when you follow a link to pay, when a key is issued, before a renewal is charged or after such a change, your licence key is held until a person has checked the match. No new key is issued and the renewal is not charged while the hold lasts. We email you when a hold stops something you paid for. The licence check in the app refuses a held key. It also refuses a check that comes from a connection in Russia, Belarus, Iran, Syria, North Korea, Crimea, Sevastopol or the Donetsk, Luhansk, Kherson or Zaporizhzhia region, unless a person cleared that key as described below. After a refused check the app stops using the licence until you enter the key again. Every request to updates.skoft.app, for a download, an update, the rules or a security notice, is refused for a connection in the same places, unless it carries the id of a key a person cleared and that key is not held. Write to hello@dossierforge.com to have a person look at any of these decisions, to give your view or to say one is wrong. That person checks the facts and can change a decision that was wrong. When a hold is cleared, a key you are still owed is emailed to you and a held key passes the licence check again. If you use the app outside the places the licence check refuses, or in the part of those four regions that Ukraine's government controls, but your connection appears to come from one of them, the person can clear your key for that for one year. If a refused check stopped the app using the licence, enter your key again first. The key then passes the licence check. The app gets its updates, rules and security notices again. Without a licence, the person can send you the current installer another way.

If you think we have this wrong, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, at autoriteitpersoonsgegevens.nl.

Changes

This statement carries the date it took effect.