Legal information

Vulnerability disclosure policy

If you find a vulnerability in anything of ours, we want to know. This page says how to report it and what we do when we receive it.

What it covers

This site, www.driven2u.com, and the services run by DRIVEN2U, S.L. that have no policy of their own.

How to report it

Write to security@driven2u.com with the subject “Vulnerability”. Say which service and address are affected, the steps to reproduce it and the impact you think it has. You may write in Spanish or English.

What we do when we receive it

We acknowledge receipt within five working days, assess it and keep you informed until it is fixed. If it affects personal data, we also apply our breach management procedure.

What we ask of you

• Do not access, modify or keep data that is not yours. If you reach it, stop and tell us.
• Do not run denial-of-service tests, social engineering or physical tests.
• Do not disclose the vulnerability until it is fixed or 90 days have passed since your report, whichever comes first.

Our commitment

We will take no legal action against anyone who researches in good faith and respects this policy. If you wish, we will publicly acknowledge your contribution once it is fixed.