Who is responsible
clm.mt is a certificate lifecycle service operated by Marco Lorenzo Qureshi Grima, a sole trader trading as LimitBreakIT, Malta. For privacy questions or requests, email marco@limitbreakit.com with the subject “clm.mt privacy”.
Supplied correspondence address: 8 Pepprina Court, Flat 6, Triq it-Trejqet ir-Rummien, Hal Ghaxaq GXQ 1210, Malta. This is the address for legal correspondence.
LimitBreakIT determines how website, business-contact, account administration and service-security information is used. For certificate-management information processed on an organisation's instructions, the organisation is normally the controller and LimitBreakIT its processor. If the organisation acts for its own customers, it may itself be a processor. The DPA addresses that chain. Contact your organisation first about its certificate and workforce records; we will help route a request without disclosing another organisation's information.
Information we receive and why
| Information and source | Use | Controller basis |
|---|---|---|
| Website/download IP address, request path/time and browser/device request metadata received by delivery providers | Deliver requested pages/software, diagnose delivery problems and protect availability | Legitimate interests in reliable and secure delivery; provider scope/retention requires account-specific review |
| Business name, email and correspondence supplied by you or your organisation | Answer enquiries, arrange and administer a pilot, provide support | Steps towards/operation of a contract when you are the contracting individual; legitimate interests in business communication when you represent an organisation |
| Account name/email, organisation membership, roles, invitations and authentication records | Provide access and administer accounts | The same contract distinction; legitimate interests in controlled business access |
| Session IP address, browser identifier, sign-in times and security/audit events | Investigate abuse, enforce access and protect the service | Legitimate interests in service and account security, with minimisation and access restrictions |
| Marketing-site page views, referrer, approximate location and device/browser details collected by Google Analytics, only after you accept analytics | Understand which pages and documentation help visitors | Your consent, withdrawable at any time from Cookie settings |
| Records needed for an identified legal duty or dispute | Comply with that duty or establish/defend a claim | Applicable legal obligation, or legitimate interests in legal claims as appropriate; record the particular law/purpose |
We receive some account details from your organisation's administrator and, if enabled by that organisation, its identity provider. We store password hashes, passkey public credentials and authentication metadata; passkey biometric/PIN verification takes place through your authenticator, not by sending us biometric templates. TOTP enrolment involves a service-held secret; use the supported secure setup and do not send recovery codes to support.
Customer instructions can cause the service to receive domains, certificate subjects/SANs/chains and expiry, discovered endpoints, agent hostnames/OS/IPs, ownership labels, configuration, operator actions, deployment events and notification recipients/content. Some of these identify people or reveal internal infrastructure. Organisation-configured connection credentials are encrypted at rest, but authorised service execution must be able to use them. Agent-managed certificate private keys stay in agent state and configured destinations; hosted runner private keys are held encrypted in control-plane state. This is not a promise that the service can never handle private keys.
Provide only what is needed for certificate management. Avoid personal data in hostnames, tags, certificate names and free-text diagnostics where possible. Do not submit unrelated sensitive personal data, passwords in support messages or content you lack authority to manage. Providing required identity/access data is necessary to use an account; withholding it can prevent access. We do not use these records for advertising or sell them as a business model. This notice does not authorise marketing mailing lists or a new secondary use of customer data.
Recipients and public disclosure
Our provider register separates the hosting, mail, DNS and delivery providers from customer-selected certificate authorities, DNS APIs, identity providers and notification destinations. Only configured functions should receive their relevant data. Authorised operators may access records to provide support, investigate incidents or recover the service. We may disclose information when lawfully required, limiting it to the request's proper scope.
Public certificate issuance may send domain and applicant data to your selected CA and publish certificate names in public Certificate Transparency logs. CT disclosure is public and cannot be erased by deleting a clm.mt record. DNS validation publishes challenge records; configured notifications may send domain names and operational information to recipients outside your organisation. Review destinations and public names before enabling automation.
Locations and transfers
The pilot's control-plane state and configured backup storage are in AWS eu-west-1, Ireland. The marketing site uses global CloudFront delivery. Public agent images use ECR Public, whose registry is operated in us-east-1. DNS, provider support, transactional delivery and customer-selected integrations can involve other countries. This is not an EU-only processing or residency guarantee.
Before accepting customer processing, we must approve the vendor contracts and any required international-transfer safeguards. Where applicable, these may use an adequacy decision or approved transfer clauses with an assessment and further measures. We have not established a particular transfer mechanism for every recipient in this pilot register. Contact the privacy address to request the applicable approved safeguard information or a copy, with justified confidential details redacted. Account-specific assessments remain part of the pilot onboarding review.
Retention
Accounts and customer operational records currently remain until an operator removes them or an applicable configured cleanup runs. There is no complete automated tenant-erasure workflow. We must adopt and test the deletion schedule before accepting customer data; indefinite retention is not the proposed policy.
The source/configuration currently specifies 12-hour browser sessions, notification outbox cleanup for sent records older than 30 days and failed records older than 90 days, and a 14-day CloudWatch log-group retention. Backup lifecycle rules expire current backups after 30 days and noncurrent versions after 30 days as noncurrent; versioning and asynchronous lifecycle action mean this is not a 30-day maximum from original creation. Local logs, provider records and other history have different handling. Expired credentials and database cleanup are distinct from expiry of retained backup copies. A justified legal hold may require limited retention, documented and restricted to its purpose.
Your choices and rights
You can ask for access, correction, erasure or restriction where applicable, and object to processing based on legitimate interests. Portability applies where its conditions are met. If a processing activity relies on consent, you can withdraw it without affecting earlier lawful processing. Contact the privacy address; we may verify your identity with proportionate information. We respond within one month, with a lawful extension explained in that period when needed. Requests are normally free; limited legal exceptions apply. We do not make solely automated decisions with legal or similarly significant effects on individuals. Certificate automation follows customer configuration.
You may complain directly to the Malta Information and Data Protection Commissioner or your competent supervisory authority. You do not need to contact us first. For customer-controlled data, we assist that customer rather than decide its purposes or bypass its permissions.
Browser storage and updates
See Cookies and browser storage for authentication cookies and local preferences. The marketing site offers optional Google Analytics, loaded only if you accept it in the consent prompt; our basis is that consent, which you can withdraw at any time from Cookie settings in the footer. The app at app.clm.mt has no analytics or advertising tools. Provider processing still occurs when a site is visited. Material changes to an approved notice should be communicated before a new use begins when required. This notice was published on 22 October 2026 and updated on 23 October 2026 for consent-gated marketing analytics. Publication is not acceptance of a customer contract.