Privacy Policy
This policy explains how Venture CO Group Kft. handles personal data in ventSSO (https://sso.ventureco.app), the single sign-on service through which you sign in to the Venture applications.
1. Who we are
The controller of your personal data is Venture CO Group Kft., registered seat: 1036 Budapest, Pacsirtamező utca 65. VI. em. 4. ajtó, company registration number: 01 09 437392.
You can reach us about data protection by post, at the registered seat (1036 Budapest, Pacsirtamező utca 65. VI. em. 4. ajtó).
2. What data we process, and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Name, e-mail address, preferred language | Your account; signing you in; telling the applications who you are | Art. 6(1)(b) — performing our contract with you |
| Password (stored only as an Argon2id hash) | Signing you in | Art. 6(1)(b) |
| Two-factor settings (an encrypted TOTP secret, hashed recovery codes) and passkeys (public keys only) | Protecting your account | Art. 6(1)(b) and (f) — the security of your account |
| Linked sign-in providers (Google, or another provider we may offer later: the provider's identifier for you) | Signing in with that provider | Art. 6(1)(b) |
| Sign-in events: IP address, device fingerprint, approximate country | Detecting unusual sign-ins (e.g. a new device) and asking for an extra confirmation | Art. 6(1)(f) — preventing account takeover |
| Sessions and tokens: which applications you use, when they were issued and last used, your roles in them; for a web session also the IP address and the browser's user agent | Keeping you signed in; giving the applications your roles | Art. 6(1)(b) |
| Memberships in organizations and groups, access requests and reviews | Managing who may use which application | Art. 6(1)(b) and (f) |
| Your acceptance of this policy and of the Terms of Service | Proving which version you accepted and when | Art. 6(1)(c) and (f) |
| The security log (see section 4) | Proving what happened in the service and detecting misuse | Art. 6(1)(f) |
We do not sell personal data, we do not use it for advertising, and we make no decision about you based solely on automated processing that has legal or similarly significant effects. The only automated step is a security check: an unusual sign-in may be asked for an extra confirmation.
3. Who receives your data
- The Venture applications you sign in to receive your identifier, and, if the application asks for it and you allow it, your name, e-mail address and language, together with your roles in that application.
- Processors working on our behalf, under data processing agreements:
- Vultr (hosting; servers in Frankfurt, Germany);
- Wasabi (encrypted backups; EU region);
- the Venture e-mail service (ventMail), which sends account e-mails such as verification and security notices;
- the Venture consent service (ventCookie), which manages cookie consent on our pages.
- Google (or another sign-in provider we may offer later, in the same way), only if you choose to sign in with it: Google receives the sign-in request and tells us your Google identifier, name and e-mail address. Google acts as an independent controller under its own privacy policy.
We do not transfer personal data outside the European Economic Area, except to Google when you choose Google sign-in (Google LLC is certified under the EU–U.S. Data Privacy Framework).
4. The security log
Every change in the service is recorded in a tamper-evident security log. An entry contains an identifier of the person who acted (a pseudonymous number), what was done, when, the network the request came from (the IP address shortened to its /24 or /48 network) and the browser's user agent. After a failed sign-in we keep only a keyed hash of the e-mail address that was typed, not the address itself.
Because the log must not be altered, these entries are kept for the life of the log, even after your account is deleted. Without your account they can no longer be linked to your name. The legal basis is our legitimate interest in the security of the service (Art. 6(1)(f)); the right to erasure does not apply to them (Art. 17(3)(b) and (e)).
5. How long we keep data
- Your account data: as long as your account exists. When your account is deleted, it is erased. The applications you used keep their own copy under their own privacy policies; ask them, or us, to have it erased there too.
- Sign-in events: 90 days.
- Web sessions: 120 minutes of inactivity; a "remember me" sign-in and a trusted device last up to 30 days.
- Access tokens: one hour; refresh tokens: up to 30 days. Expired tokens are deleted afterwards.
- Backups: encrypted. The daily copies kept outside the server are locked against any change for 90 days and deleted after that; the copies on the server itself are deleted after 7 days. Data erased from the service disappears from the backups as they expire.
- The security log: as described in section 4.
6. Cookies
ventSSO uses only cookies it needs to work: the session cookie, a protection against cross-site request forgery, the "remember me" cookie if you ask for it, and the trusted-device cookie if you choose to trust a device. Consent for any other cookie is managed by ventCookie.
7. Your rights
You have the right to access your data, to rectify it, to have it erased, to restrict or object to its processing, and to data portability. To exercise any of them — including getting a copy of your data or having your account deleted — contact us as described in section 1. We answer within one month.
You may also lodge a complaint with the Hungarian supervisory authority: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), 1055 Budapest, Falk Miksa utca 9–11., naih.hu.
8. Security
Passwords are stored only as Argon2id hashes; two-factor secrets and other sensitive values are encrypted; all connections use TLS; tokens are signed; and every change is recorded in the tamper-evident security log.
9. Children
ventSSO is not intended for children under 16.
10. Changes
When this policy changes, we publish the new version here with its date, and ask you to accept it the next time you sign in.