Security Policy
Last updated: 18 October 2026 / Andreas Digital Agency / ADA Web Division
ADA Web Division takes the security of this website and of the information sent through it seriously. This page explains what we do, and how to report a problem.
1. What protects this website
- HTTPS only, with HSTS so browsers always use the secure connection;
- a strict Content Security Policy: scripts and libraries are served from our own site, not from third-party hosts;
- the site cannot be shown inside another website's frames (clickjacking protection);
- forms accept requests only from this website, only as JSON, and are limited in how often they can be used;
- form submissions go through our server, so secret keys never reach your browser;
- no advertising trackers; usage records only if you accept them (see the Cookie Policy); and
- personal information is handled as described in the Privacy Policy.
2. What we ask of you
- Never send passwords, card numbers or ID numbers through the enquiry or booking forms. We will not ask for them there.
- Check that the address starts with https://web.andreasdigitalagency.com before entering any details.
- If a message claiming to be from us asks for payment to a new account, confirm it with us by phone or WhatsApp first.
3. Reporting a vulnerability
If you find a security problem, please email security@andreasdigitalagency.com with the page, what you found and the steps to repeat it. Our machine-readable contact is at /.well-known/security.txt.
- Please give us reasonable time to fix the problem before sharing it publicly.
- Please do not access other people's data, disrupt the service, or run automated attacks at high volume.
- We will acknowledge your report and keep you informed. We do not currently run a paid bug bounty.
4. Limits
No website can be guaranteed completely secure. This page describes our practices and is not a promise that incidents can never occur. If personal information is affected, we will act as described in the Privacy Policy and applicable law.