This privacy policy (hereinafter the “Privacy Policy”) governs how Patchstack OÜ (hereinafter „Patchstack”/”us/we/our”) gathers and uses personal data in connection to our services, website, marketing and processing data of our co-operation partners’ representatives’ and candidates’. We take security of personal data processing seriously. Our aim is to protect the privacy of our data subjects’ (herein after “you”). Please read this Privacy Policy as it contains important information about the processing of your personal data. 

If you have additional questions or require more information about our Privacy Policy, do not hesitate to contact us (see clause 2.2).

Definitions

Definitions are terms often used in the Privacy Policy. Terms are defined in this Section of the Privacy Policy or in the text of the Privacy Policy. 

1. Personal data protection terms have the same meaning as defined here or in the General Data Protection Regulation (2016/679) (hereinafter the “GDPR”). 
2. Client means a legal person entering into a Contract with us (e.g. while using Services under the TC). Please note, in case of a legal person data subject’s rights are applicable to the representative of the legal person (e.g., employee, management board member etc.).
3. Cookies mean data files stored in the Visitor’s device upon visitation of the Website according to the selection made. More information about the use of Cookies by us and on our Website can be found via the Cookie solution on our Website.
4. Contract means any contract (e.g. service agreement, terms and conditions) entered into between us and a Client or a Data Subject (if any). 
5. Data Subject is an identifiable natural person; one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. For example, a representative of a legal person, employee, management board member – all as natural person are Data Subjects. 
6. Privacy Policy means this text, which sets out our principles of personal data processing. 
7. Service(s) means services offered by us, e.g., vulnerability detection and vulnerability protection service and any other service/product offered by us. 
8. User - an individual who creates a user account and has access to our platform.
9. Visitor is a person visiting our Website.
10. Website means our website accessible via https://patchstack.com/ and all its subdomains and where applicable also refers to our platform and social media pages.

General information and contact details

Here you will find when the Privacy Policy applies, information about who we are, and how to contact us. 

1. About us. We are a private limited company Patchstack OÜ, registration code 14331217, address Aida tn 7, 80011 Pärnu linn, Pärnu maakond, e-mail privacy@patchstack.com. Patchstack is the leader in open-source vulnerability intelligence, covering the entire lifecycle from detection to mitigation.
2. Contacts. You can contact us in matters related to personal data processing by e-mailing us at privacy@patchstack.com or writing to us on the address provided in the previous clause i.e., 2.1 and addressing the letter as personal data inquiry. 
3. Applicability of the Privacy Policy. The Privacy Policy applies to personal data processing done by us in case of our Services, Website and candidates. We have the right to unilaterally amend this Privacy Policy. We will notify the data subject of all important material changes on the Website or otherwise.
4. Changes. We have the right to unilaterally amend this Privacy Policy. We will notify data subjects of all material changes on the Website or otherwise.
5. About the Controller-Processor statuses:
   1. We are the processor when we process personal data on behalf of our Clients in providing the Patchstack Solution. This includes personal data incidentally encountered in the course of providing vulnerability detection, virtual patching, and security monitoring services — such as IP addresses, user-agent strings, usernames, and form submission contents associated with traffic to or activity on Client websites. Any such processing is governed by our Data Processing Addendum, which forms part of the agreement between Patchstack and the Client.
   2. We are the controller when we process personal data for our own purposes as described in this Privacy Policy e.g., when developing and improving our Services (e.g., processing User data for service improvement), fulfilling our legal obligations (e.g., processing personal data for billing and accounting), processing data of Visitors or ensuring our legitimate interests.
6. Other links/apps etc. Please note, that the links on our Website may lead to media that is governed by privacy terms of the respective service providers’, and not by this Privacy Policy. We are not responsible for anything on those other websites. Processing of your personal data on our social media channels by providers of those platforms is done according to the privacy terms of relevant platform. In case of our social media, we will adhere to the relevant platform’s terms and to this Privacy Policy. 

Principles of personal data processing

Here you will find the key principles that we are always guided by when processing your personal data.

1. Compliance and aim. Our aim is to process personal data in a responsible manner where we are able to demonstrate the compliance of personal data processing with the purposes set and the applicable regulations.
2. The principles. All our processes, guidelines and activities related to personal data processing are based on the following principles: lawfulness, fairness, transparency, purposefulness, minimisation, accuracy, storage limitation, integrity, confidentiality, and data protection by default and by design.
3. Information we process

Here you can find categories of data subjects and personal data we process under this Privacy Policy.

1. Categories of Data Subjects. Generally, we may process personal data of the following data subjects:
   1. Client (if natural person);
   2. cooperation partner (if natural person);
   3. representatives of our Clients’ and cooperation partners’;
   4. Users;
   5. Website Visitors;
   6. candidates;
   7. other data subjects (e.g., vulnerability/bug bounty hunters).
2. Source of Personal Data. We get personal data from:
   1. Personal data disclosed to us by the data subject - we receive specific data about you when such information is provided voluntarily, such as when our you request information, purchase or enrol for Services, submit a customer support inquiry, provide information for employment opportunities, or send us an email with personal information. Some of these activities require that you give us information, such as when you make a purchase, submit your resume, or request certain types of information. Usually e-mail address, name and other data sent or made available to us by you are processed; or data made available to us in connection to bug bounty program – usually nickname, banking information;
   2. Personal data resulting from standard communication between us and the data subject (e.g., correspondence regarding Contract (if any) or other co-operation);
   3. When you use the Website, we automatically collect the following information- device and log information: we collect information about the computer device you use to access the Website, including device identifiers, mobile network information, type of operating system, and the type of browser used; log information about your use of the Website, including access times, pages viewed, IP address, other standard web log data, and the page visited before and after navigating to our websites (see Cookie solution on our Website for more precise information);
   4. Personal data resulting from visiting and using the platform (data about using/moving on the platform; device data, IP address, data gathered by Cookies – see Cookie solution on our Website for more precise information);
   5. Personal data obtained from third parties (e.g., when doing KYC on the co-operation partner, data from use of third-party services);
   6. other information that the Client has transmitted or has made available to Patchstack or entered into our systems;
   7. Personal data generated and combined by us (e.g., correspondence in connection to Contract, activity analytics (if any)).
3. Data we process. We mainly process the following personal data:
   1. about Visitors – data gathered from use of Website incl., by Cookies (if enabled) (technical data, usage data);
   2. Our Clients’/co-operation partner’s representatives or Client/co-operation partner (if natural person) identification data – name, date of birth, ID-code, address, contacts, KYC data (if applicable);
   3. contact data – e-mail, phone nr, address;
   4. Contract and billing data;
   5. communications - communications with us (emails, sms, chats, calls);
   6. usage information - information about the use of our systems and Services incl. about User (web and technical data e.g. IP-address);
   7. other data – e.g., provided in the feedback surveys, data about bounty hunters etc.;
   8. candidate data – full name, personal identification code, contact details (tel.nr, e-mail, address), information provided in the CV, including education, qualifications, people marked as recommenders, previous experience, aptitude tests (if applicable), background check (if applicable). See also Section 10.

General purposes, grounds for, and activities of processing

Here you will find information about the purposes and grounds for processing of your personal data. 

1. Consent. Based on consent, we process personal data precisely within the limits, to the extent and for the purposes for which the data subject has given their consent. The data subject’s consent must be freely given, specific, informed, and unambiguous, for example, by inserting email address on a contact form on our Website. Please note that you have the right to withdraw your consent at any time e.g., by contacting us or unsubscribing. Withdrawal of consent will not influence the rightfulness of personal data processing done under the consent before the withdrawal of the consent. 
2. Entry into and performance of a Contract. Upon entering into and performing a Contract with a data subject, we may process personal data for the following purposes:
   1. taking steps prior to entering into a Contract, which are necessary for entering into a Contract or which the data subject requests (mainly identification, Contract, contact, billing and communication data);
   2. identifying you to the extent necessary for entering into and performing a Contract (mainly identification data and communications);
   3. performing the obligations assumed (e.g., billing) (depending on the situation all data may be used);
   4. communicating with you, incl. sending information and reminders about the performance of the Contract (mainly usage, billing and communication data; but all data may be used);
   5. protection of rights and claims (depending on the data all gathered data may be used);
   6. to detect, prevent and address technical issues (depending on the issue all gathered data may be processed);
   7. to provide support (depending on the issue all data may be processed);
   8. to notify you about changes to Contract (mainly contacts and Contract data).

Please note that, personal data processing specifics may be regulated in the Contract and accompanying data processing agreement (if any). 

1. Legal obligation. We process personal data to comply with a legal obligation in accordance with and to the extent provided by law. For example, obligation to retain accounting documents from Estonian Accounting Act, and obligations from the International Sanctions Act (KYC data, when applicable).
2. Legitimate interest. Our legitimate interest means our interest in managing or directing our business activities. In case we are using legitimate interest, we have previously assessed our and your interests. You have the right to see conducted assessment connected to processing of your personal data. If you wish to do so contact as at privacy@patchstack.com. We may process your personal data (except special categories of personal data) based on legitimate interest for the following purposes:
   1. development of our Website and/or platform (mainly anonymous; however, depending on the development all data may be used); 
   2. ensuring a better Visitor and User experience - we may monitor the usage of our Website, platform analyse identifiers and personal data collected when our Website, social media pages and other sales channels are used, and we may collect statistics about Visitor/User (usage data and technical data may be processed);
   3. sending information to data subjects if they have shown interest in our Service and if such processing is allowed for relevant jurisdiction (name, email, interest in our Service); 
   4. making recordings and logging; we may record messages and orders given both in our premises and using means of communication (e-mail) as well as information and other activities we have performed. If necessary, we use these recordings to prove orders, claims or other activities;
   5. technical and cyber security reasons, for example measures for combating piracy, fake accounts and ensuring the security of the Website as well as for making and storing back-up copies and preventing/repairing technical issues (depending on the issue all data may be processed);
   6. processing for Service development – ensuring best possible Service (mainly anonymized data, however identification, usage data and Contract data may be processed);
   7. processing for organisational purposes and Service provision, foremost for service provision and management purposes (but also audits and other potential supervision), including for processing the personal data of Clients or representatives (mainly anonymized, however Client data identification and Contract data may be processed);
   8. establishing, exercising or defending legal claims, incl. assigning claims to, for example, collection service providers, or using legal advisors (depending on the claim/issue all data may be processed);
   9. processing in the context of commercial transactions - mergers, acquisitions, purchase/ sale of shares or a company; processing of data in the framework of carrying out a transaction and consulting (all data may be processed);
   10. If you have given us information about not sending you a certain type of information – retaining the information about such prohibition.
3. New purpose. Where personal data is processed for a new purpose other than that for which the personal data are originally collected or it is not based on the data subject’s consent, we carefully assess the permissibility of such new processing. We will, in order to ascertain whether processing for a new purpose is compatible with the purpose for which the personal data are initially collected, take into account, inter alia:
   1. any link between the purposes for which the personal data are collected and the purposes of the intended further processing;
   2. the context in which the personal data are collected, in particular regarding the relationship between the data subject and us;
   3. the nature of the personal data, in particular whether special categories of personal data are processed or whether personal data related to criminal convictions and offences are processed;
   4. the possible consequences of the intended further processing for data subjects;
   5. the existence of appropriate safeguards, which may include encryption or pseudonymisation.
4. Overview of our main personal data processing activities in the scope of this Privacy Policy:

About our services

1. Vulnerability detection and mitigation. When the Patchstack Solution operates on a Client’s website, personal data may be processed incidentally as part of providing the service — for example, IP addresses and user-agent strings in HTTP requests, form submission contents associated with blocked threats, and usernames associated with logged activity. Patchstack processes such data only as a processor on behalf of the Client and only as necessary to provide the Patchstack Solution. This processing is governed by our Data Processing Addendum.
2. Platform. Allows Client or Client representative (User) to have overview of the Service provision and have certain controls over the Service provision. Data processed for Service improvement and developing the Service e.g., data about how User uses the platform and Services is processed as a controller.
3. Bug bounty program. For security researchers we only process the name, country, email (consent) and IP address (to provide the service). Generally, no other personal data is processed. However, if the bounty hunter has provided us with personal data in connection to the bug bounty program (e.g., for collecting prize money) we process it as a controller. 

Transfer and authorised processing of personal data

Here you will find information about the transfer and authorised processing of personal data.

1. Usage of co-operation partners. We may cooperate with persons to whom we may transmit data, including personal data. We may have different type of controller-processor-sub-processor relationships with those cooperation partners. When transferring personal data to third parties (generally our cooperation partners), we comply with the applicable data protection requirements. 
2. Requirements for the usage of cooperation partners that are our processors. Such third parties may include:
   1. advertising and marketing partners (Visitor’s/User’s data, contact data);
   2. product analytics providers, e.g. PostHog (hosted in the European Union), for analyzing usage of our services under legitimate interest (User’s pseudonymous identifier and usage data; no data is stored on your device for this purpose);
   3. advisers e.g., financial adviser, tax (depending on the case all data may be processed);
   4. IT partners, i.e., server and other IT service providers for various technical services (all data may be processed);
   5. CRM – Client data, co-operation partner’s data (contacts, Contract data, billing);
   6. Accounting service provider (mainly Client/co-operation partner’s or their representative’s data, billing data).

We may use such processors provided that the respective purpose and processing are lawful and personal data are processed pursuant to the instructions of us and on the basis of a valid data processing agreement. 

If you wish to get more information about which processors we may give your personal data, please contact us at privacy@patchstack.com.

1. Other transfers. In other cases, we may transmit your personal data to third parties provided that we have a valid ground to do so e.g., your consent or a legal obligation or there is an exception in the event that the transfer is necessary to protect your vital interests.
   1. We may disclose your personal data:
      1. Connected service provides who are separate controllers – e.g., payment service providers, attorneys, banks etc.; 
      2. For Law Enforcement and other public authorities. Under certain circumstances, we may be required to disclose your personal data if required to do so by law or in response to valid requests by public authorities. We always assess the lawfulness of information requests before disclosing any personal data. 
      3. For Business Transactions. If we or our subsidiaries are involved in a merger, acquisition or asset sale, your personal data may be transferred.
2. Transfers outside the EEA. We may use service providers/co-operation partners from outside the EEA. Such transfers are only commenced if requirements from the GDPR Chapter V are met e.g., adequacy decision* (see the GDPR art 45) or EU SCC (see the GDPR art 46). We usually use EU standard contractual clauses** or EU-US Data Privacy Framework*** for transferring your personal data outside of the EEA. We will take all the steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy policy. If you want more information about transfers outside the EEA, contact us at privacy@patchstack.com.  

* Adopted adequacy decisions can be found here.

** You can find the text of standard contractual clauses here. 

*** Participants of the EU-US Data Privacy framework can be found here.

STORAGE AND SECURITY OF PROCESSING PERSONAL DATA

Here you will find a description of how we protect your personal data and for how long we store personal data. Storage. We comply with the purpose of processing principle and have set storage periods for personal data, e.g., we use claim limitation periods set in applicable law for potential claims, and other storage periods provided for in the law. We store personal data as long as need depending on the purpose of the processing. Typically, we store User’s personal data as long as the User is using the Services. We keep personal data as long as it is required by law or necessary for internal reporting and reconciliation purposes. For example, we keep all payment transactions data for 7 years due to the accountancy rules. In the event that there are suspicions of a criminal offense, fraud or false information having been provided, the data will be stored for 10 years. In case the User decides to delete the account, the personal data will be held for another 12 months in order to prevent and investigate possible violations (fraud, fake accounts, identity thefts etc). If an actual proceeding is started, then data is stored for the duration of such proceeding and additional time period of claim limitation. If you want more precise information on data retention, then write to us at privacy@patchstack.com. Security measures. We have established guidelines and rules of procedure on how to ensure the security of personal data through the use of both organisational and technical measures. Among other, we do the following to ensure security and confidentiality: Our intent is to provide privacy, integrity, as well as authentication with regards to our online communication. The security measures we have taken are intended to secure and encrypt your data, such that a third party cannot capture, access or read the information while it is in transit between your computer and our system. We use some third-party service providers to help us provide services related to the Website such as the cloud platform providers. We have concluded contracts with the processors of personal data which provide protection at the same level as set out in this Privacy Policy. We implement and maintain reasonable and appropriate technical and organizational security measures to protect the personal data we process, from unauthorized access, alteration, disclosure, loss or destruction. We further protect personal information by restricting its access to those employees, contractors, advisers and service providers that we determine to require access to such information for any of the purposes stated in this Privacy Policy. Any personal data collected by Patchstack is stored in the data centers located on territories and hosted by service providers that present sufficient guarantees in terms of technical and organizational measures that are required pursuant to the GDPR. Only authorized employees have access to the personal data and they may access the data only for the purpose of resolving issues associated with the use of the Website. We have access-level management system in use. Incident. In the event of any incident involving personal data, we do our best to mitigate the consequences and alleviate the relevant risks in the future. We will follow notice requirements of the GDPR. GDPR Data Protection Rights Here you can read about your rights in connection to your personal data. We would like to make sure you are fully aware of all of your data protection rights. Every data subject is entitled to the following rights (under certain preconditions): The right to access – you have the right to access and to request copies of your personal data. As a User you’ll be able to see and control certain data about you via our platform. The right to rectification – you have the right to request that we correct any information that is inaccurate. User has the right to correct inaccurate or incomplete personal data we store on the Website (platform). The User may correct his/her personal data in the User account. If you are not able to correct your data, please contact Patchstack support. The right to erasure – you have the right to request that we erase your personal data, under certain conditions (e.g., we are processing your personal data under your consent). Please note that personal data processed for legal obligations are not erased before due date from law. We may not immediately be able to erase all residual copies from our servers and backup systems after the active data have been erased. Such copies shall be erased as soon as reasonably possible The right to restrict processing – you have the right to request that we restrict the processing of your personal data, under certain conditions (e.g., we are processing your personal data under consent). The right to object to processing – you have the right to object to our processing of your personal data, under certain conditions (e.g., we are processing your personal data under legitimate interest). The right to data portability – you have the right to request that we transfer the data that you have provided us to another organization, or directly to you, under certain conditions. If you are interested in to transfer your data, please contact Patchstack support. Rights in connection to consent- if we process your personal data using consent as legal basis, then you have the right to withdraw your consent at any time (e.g., by unsubscribing or emailing us). Withdrawing your consent won’t change the legality of processing done before withdrawal. Rights in connection to use of legitimate interest - if we process your personal data under legitimate interest, then you have the right to object and right to see the conducted legitimate interest assessment connected to the processing of your personal data. For this write us at privacy@patchstack.com. Rights related to automated processing and profiling mean that the data subject, on grounds relating to their particular situation, has the right to object at any time to the processing of personal data concerning them based on automated decisions/profiling and to require human intervention. The data subject may also require an explanation regarding the logic of making an automated decision. For avoidance of doubt, we do not use automated processing or profiling that has a significant effect on the data subject or their rights. The right to file a complaint and seek judicial remedy – you have the right to file a complaint with us or supervisory authority or court if you think that your rights in connection to personal data have been infringed. We kindly ask you to contact us first for finding a solution. Disputes relating to the processing of personal data are resolved by Patchstack support via [write to us privacy@patchstack.com] If needed our data protection supervisory authority is Estonian Data protection Inspectorate (Andmekaitse Inspekstioon) contacts can be find: https://www.aki.ee/en/contacts. In addition, as a data subject you have a right to file a complaint in the EU Member State of your residence or a place of work or of where alleged infringement of the GDPR took place. If you are a resident of the EU, you can find the details of respective data protection authority from here. Responses and additional information. If you make a request connected to personal data processing, we have one month to respond to you (in certain cases we have the right to extend that time period). If you would like to exercise any of these rights or need more information on your rights, please contact us. Please note, that we may need to identify you before granting you any of the rights connected to your personal data. Candidates In the application procedure, we may processes the candidate's personal data in order to assess the candidate's suitability for the chosen position and take pre-contractual measures and conclude a (employment) contract. The measures for concluding a (employment) contract in the application process are carried out on a contractual basis (Art. 6 (1) b GDPR), which also includes pre-contractual processing to the required extent). The processing of the personal data of an applicant for a job position generally includes the following: processing of personal data transmitted by the job applicant/candidate to us for the purpose of concluding an employment or similar contract (name, personal identification code, information provided in the CV, incl. education, previous work experience, etc.) (basis - contract); processing of the data indicated by the candidate e.g., data from the recommenders or data provided by the previous employer (if the candidate has provided the information of the references himself/herself - consent; legitimate interest in other cases); aptitude test and background check (if applicable) (name, personal identification code, test results, criminal record information, references information; grounds for legitimate interest); processing of personal data collected from national databases and registers and public (social) media (if applicable) (basis for contractual verification of information; otherwise legitimate interest). We may use recruitment service providers and software in the recruitment process. Depending on the recruitment service, the first contact may be based on consent (e.g. the candidate has given their consent to the service provider, with permission to transfer their data; the processing required to enter into the contract or our legitimate interest). 10.3.If the candidate is not selected for the position, we may keep the collected personal data in order to make a job offer to the candidate, when a suitable job position becomes vacant. The basis of such processing is the legitimate interest. Candidate always has the right to deny such processing. Children's Information We do not intend to process data of people underage. We follow data protection requirements applicable for processing child’s personal data (if any). Changes The latest changes and entry into force of the Privacy Policy: