GDPR Compliance

The General Data Protection Regulation (GDPR) is a comprehensive data protection law that came into effect on May 25, 2018. It applies to organizations that process personal data of individuals in the European Economic Area (EEA) and the United Kingdom, regardless of where the organization is located.

Key principles of GDPR include:

• Lawfulness, fairness, and transparency in data processing
• Purpose limitation - data collected for specific, legitimate purposes
• Data minimization - only collect what is necessary
• Accuracy - keep personal data accurate and up to date
• Storage limitation - retain data only as long as necessary
• Integrity and confidentiality - ensure appropriate security
• Accountability - demonstrate compliance with these principles

Under GDPR, we must have a valid legal basis for processing your personal data. We rely on the following legal bases:

2.1 Contract Performance (Article 6(1)(b))

Processing necessary to perform our contract with you, including providing the Service, managing your account, and processing payments.

2.2 Legitimate Interests (Article 6(1)(f))

Processing necessary for our legitimate interests, such as improving our services, preventing fraud, and ensuring security. We balance our interests against your rights and freedoms.

2.3 Legal Obligation (Article 6(1)(c))

Processing necessary to comply with legal obligations, such as tax reporting, responding to legal requests, and maintaining required records.

2.4 Consent (Article 6(1)(a))

Where required, we obtain your explicit consent before processing, such as for marketing communications. You may withdraw consent at any time.

As a data subject in the EEA or UK, you have the following rights:

When we transfer personal data outside the EEA/UK, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs): EU Commission-approved contracts that ensure adequate protection
• Adequacy Decisions: Transfers to countries deemed adequate by the EU Commission
• Binding Corporate Rules: For transfers within our corporate group
• Supplementary Measures: Technical and organizational measures to enhance protection

You can request a copy of the safeguards we use by contacting our Data Protection Officer.

We implement appropriate technical and organizational measures to protect personal data:

• Encryption of data in transit (TLS 1.3) and at rest (AES-256)
• Access controls and authentication mechanisms
• Regular security assessments and penetration testing
• Employee training on data protection
• Incident response procedures
• Regular backups and disaster recovery planning
• Privacy by design in our development processes

We retain personal data only as long as necessary for the purposes for which it was collected:

• Account data: Duration of account plus 30 days after deletion
• Transaction data: As required by tax law (typically 7 years)
• Usage logs: 12 months for security and analytics
• Support communications: 2 years or as needed

After retention periods expire, data is securely deleted or anonymized.

Our Service provides access to threat intelligence data that may include personal data of third parties. Important considerations:

• This data originates from publicly available sources and data breaches
• We act as a data processor for our customers' investigations
• Customers using this data must have their own legal basis under GDPR
• Data subjects can request removal via our privacy contact

If your personal data appears in our database and you wish to exercise your GDPR rights, please contact our DPO with proof of identity.

We have appointed a Data Protection Officer (DPO) to oversee GDPR compliance. You can contact our DPO for any data protection inquiries:

To exercise any of your GDPR rights:

1. Email your request to [email protected]
2. Include your full name and email address associated with your account
3. Specify which right(s) you wish to exercise
4. Provide any additional information to help us locate your data

We will respond to your request within 30 days. This period may be extended by two months for complex requests, in which case we will inform you.

Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority in your country of residence, place of work, or where an alleged infringement occurred.