Data Security and Privacy Plan

Last updated: Jun 11, 2026

1. About This Document

This Data Security and Privacy Plan is published by Hankuper s.r.o., the developer of AdLock, in accordance with the requirements of the Student Data Privacy Consortium (SDPC) National Data Privacy Agreement (NDPA), Exhibit K.

It describes the administrative, technical and physical safeguards we maintain to protect data collected through AdLock products and services. This plan is reviewed at least annually or whenever significant changes occur.

2. About AdLock

AdLock is an ad-blocking application available for Windows, macOS, Android, iOS and as a Chrome browser extension. It blocks advertisements, trackers and malicious content to protect users while browsing.

AdLock is developed and operated by Hankuper s.r.o., a software company registered in Bratislava, Slovak Republic.

3. Data Governance and Accountability

The CEO/CTO of Hankuper s.r.o. serves as the designated Information Security and Data Protection Officer, responsible for:

• Maintaining and reviewing this plan annually;
• Overseeing the Information Security Management System (ISMS), implemented in accordance with ISO/IEC 27001:2022;
• Managing data subject rights requests and breach notifications;
• Ensuring all personnel comply with data protection obligations.

All employees and contractors sign confidentiality agreements prior to commencing work and receive information security training.

4. Data Collected

AdLock collects the minimum technical data necessary for application functionality and stability:

• IP address — for geo-based service delivery;
• Device identifiers (MAC address, serial number) — for licence management;
• Device information (OS version, language setting, display dimensions) — for UI compatibility;
• Crash reports — anonymised, contain no personal data;
• Anonymous usage statistics (Chrome extension only) — stored locally, not shared with third parties.

AdLock does not collect student names, IDs, grades, demographics, attendance, communications, or any other student record data.

5. Data Storage and Security

Infrastructure

AdLock’s backend is hosted with certified providers in the European Union. Primary hosting is provided by Hetzner Online GmbH (Germany, ISO 27001 certified), with additional services on Amazon Web Services in the EU region (ISO 27001 and SOC 2 Type II certified).

Encryption

• All data transmitted between AdLock applications and our servers is encrypted using TLS 1.2 or higher;
• Sensitive data stored on servers is encrypted at rest (AES-256);
• Employee devices use full-disk encryption.

Access Controls

• Multi-Factor Authentication (MFA) is required for all corporate accounts;
• Access to systems is granted on a least-privilege basis;
• Remote access to internal systems is provided via VPN with MFA.

Backups

Critical data is backed up daily and stored in a geographically separate location. Backups are retained for 90 days and tested quarterly.

6. Incident Response and Breach Notification

Hankuper s.r.o. maintains a formal incident response process. In the event of a confirmed data breach affecting LEA or student data:

• We will notify the affected LEA within 72 hours of confirming the breach, or as required by the executed NDPA;
• Notification will include the nature of the breach, data categories affected, likely consequences, and measures taken;
• We will cooperate fully with the LEA and relevant authorities throughout the response process.

To report a security concern: gdpr@adlock.com

7. Data Retention and Deletion

• Personal data is retained only for as long as necessary to provide the service;
• Upon account deletion or service termination, personal data is deleted within 30 days of request;
• LEAs may request deletion of all data associated with their deployment at any time by contacting gdpr@adlock.com.

8. Third-Party Vendors

Hankuper s.r.o. engages the following sub-processors. All vendors are bound by data processing agreements and selected based on their security standards:

A complete list of sub-processors is available on request at gdpr@adlock.com.

9. Student Data Commitments

Hankuper s.r.o. makes the following commitments regarding student data:

10. Contact