PRIVACY POLICY

Last updated: November 14, 2025

This Privacy Policy describes the Provider’s personal data processing practices for the Provider’s StaySecure service ("Service(s)"), in general or through the Provider’s websites, collectively or individually "Site(s)". The Provider acts as data controller and the Provider’s subsidiaries as data processor. The Provider acts as the data controller for all Data processed. Certain processing activities may be performed by the Provider’s subsidiaries or service providers acting as data processors on behalf of the Provider.

Details about Provider

The name and details of the Provider can be found in the welcome email sent to you upon subscribing to the Service. They are also available after logging in to stay-secure.app in the footer of the Website and on the My Account page on stay-secure.app/account.

By visiting the Site, providing the Provider with personal data, subscribing to the Service, or entering into a contract with the Provider, Customer acknowledges having read and accepted this Privacy Policy.

Minors (as defined under applicable law) cannot subscribe to the Service. Parents or guardians remain responsible for minors’ use of Sites or Services.

The Provider may update this Privacy Policy from time to time. Updates may be announced on the Site’s homepage, within the Service, or by email where appropriate.

1. What information does the Provider collect and why?

The Provider may collect and process personal data ("Data") necessary to:

Perform the contract
Operate, maintain and provide the Service
Ensure security
Improve user experience
Comply with legal obligations

The Provider does not intentionally collect sensitive personal data.

1.1 Personal Data

Personal Data means information that directly or indirectly relates to Customer as an identified or identifiable natural person. This may concern, depending on the contract, the Sites, the Products or Services, Customer’s status and/or the means of collection, all or part of the following Personal Data:

Name(s) and surname;
Postal address (invoicing or delivery);
Landline or mobile (personal or professional) phone number;
Email address;
Banking information (bank or other account information, bank account details, credit/charge card information, number, expiry date, visual cryptography);
Passport number or ID number;
Spoken language or chosen language for the Sites or Services;
Any confidential information to help Customer recall Customer’s personal identifiers or passwords;
IP address number automatically assigned by Customer’s Internet Access Service Provider or the MAC address of Customer’s electronic devices from which access to the Site(s) is made and which are subject to an automatic identification and recording for each use of the Site(s);
Demographic data on Customers (e.g. age, gender, place of residence);
Technical information, such as cookies;
Geolocation data (country level only);

1.2 Other Information

The Provider also collects other data that does not necessarily lead, directly or indirectly, to Customer’s identification as a natural person ("Other Information").

In such a case, the Provider will process it in accordance with the conditions described and for the purposes set out in section 3 below. These Other Information may be:

Information on the Customers' Internet browser and devices to access the Sites, such as the type of device, screen resolution, version of operating system, type and version of the Internet browser, as well as the type and version of the Service used. A unique identifier may be assigned to the device from which Customers access the Service(s) delivered by the Provider or its service providers;
Data relating to Customers' use of mobile applications or other communication services: within this context the Provider may collect the unique identifier, as well as Other Information relating to the connecting device in order to provide content to the devices. It may also collect the date and time of access to the servers, as well as the downloaded files and information;
Server Log files to manage the Services, diagnose problems affecting the servers, or determine Customers' geolocation data (on country level);
Information collected using cookies, clear gifs, web beacons, pixel tags or other similar technologies;
Demographic or Other Information as long as it does not allow the person's identification;
Information on the Services' use via analytical tools enabling the Provider to provide Customer with enhanced performance level. The information thus collected may provide the Provider with information regarding the most used services and functions, the type of equipment used, its characteristics, country, and downloading language.

2. How does the Provider collect Customer Data?

The Provider collects Data through:

Account creation
Subscription processes
Browsing the Sites
Customer support interactions
Communications with the Provider

The Provider also collects Data automatically through:

Devices and browser interactions
Cookies and similar technologies
Server logs

3. What does the Provider use Customer Data for?

The Provider processes Data to:

Create and administer Customer accounts
Perform contractual duties
Provide and maintain the cybersecurity software services
Process payments
Respond to Customer inquiries and provide support
Communicate with Customers (administrative or promotional)
Secure the Sites and Services
Detect and prevent fraud
Analyze and improve the performance of Sites and Services
Comply with legal obligations

4. Legal Grounds for Processing

Depending on the jurisdiction and processing activity, the Provider may rely on:

Customer consent
Performance of a contract
Compliance with legal obligations
The Provider’s legitimate interests (e.g., improving Services, preventing fraud, ensuring security)

5. Who receives Customer Data?

The Data Customer sends to the Provider, directly or indirectly, is accessed exclusively by authorised individuals, only when necessary, and for the sole purposes referred to in Section 3 above. The Provider makes sure that such access complies with the security measures that the Provider implements.

Data recipients may be:

The Provider’s subsidiaries;
Third-party providers with whom the Provider work to facilitate the Services' provision or access to Sites, such as but not limited to hosting services, data analysis, processing of payment transactions, providing infrastructure services, information technology services, customer services, e-mail distribution services or other similar services;

The Provider may also communicate Customer’s Data to duly authorised individuals, only when necessary for the sole purposes referred to in Section 3 above, in the following cases:

To comply with applicable law, including the law of countries outside Customer’s place of residence;
To respond to injunctions or requests from public or governmental authorities, including those outside Customer’s country of residence;
To perform under or enforce the contract and the Terms of Service, or to protect the Provider’s activities or those of the Provider’s subsidiaries;
To protect the Provider’s rights, security and property or those of the Provider’s subsidiaries, licensors and partners;
To exercise or defend the Provider’s legal rights or to have such rights recognized;
To make any necessary recourse or to limit damages or any sentences that may be pronounced against the Provider or the Provider’s subsidiaries;
For a reorganisation, merger, acquisition, joint venture or any other form of transfer of all or part of the Provider or the Provider’s assets to any such third party;
To perform specific data transfers upon receiving Customer’s explicit consent;
To satisfy a public interest;
To protect Customer, or third parties, from fraud, abuse, illegal acts or breach of contract, or of the Terms of Service.

6. Data Retention

he Provider keeps Data only for the time necessary to execute the contract, achieves the objective pursued, meets Customer’s needs, executes the contract or meets the Provider’s legal obligations.

The data retention criteria the Provider established includes:

The term of the contract entered into by Customer with Us;
The retention period required by applicable law (i.e., accounting or archiving obligations);
The duration of the Customer’s consent for a specific use;
For prospects (in the absence of any subscription to a Service or purchase of a Product): 1 year or less from the day of the Data collection;
12 months or less for cookies.

When the Provider no longer needs to process Customer’s Data, the Provider deletes it from the Provider’s systems and databases or anonymises it so that Customer can no longer be identified.

7. Storage and International Data Transfers

Customer Data is primarily stored on servers located in the European Union, where the Provider is established.

However, Data may be accessed or processed in other countries by the Provider’s processors or service providers. These countries may have privacy laws that differ from those of Customer’s place of residence.

The Provider implements appropriate safeguards to ensure Data receives an adequate level of protection in accordance with GDPR and other applicable laws. These may include contractual protections, technical safeguards, and organizational measures.

By using the Service, Customer acknowledges that Data may be transferred internationally as described above.

8. Security Measures

The Provider implements appropriate physical, technical, administrative and organisational security measures in order to best protect, Customer’s Data against loss, theft, misuse, abusive use, fraudulent access, disclosure, alteration and destruction.

No data transmission on the Internet can be 100% secure but the Provider is committed to implementing security standards recognised in the Provider’s industry and designed to protect and prevent unauthorised access, disclosure and use of Data.

These measures include but are not limited to:

Storage on secure servers within the European Union;
Protection, including through data encryption processes, such as Secure Sockets Layer (“SSL”) for credit card transactions and other bank payment transactions;
Limited access of employees or third-party staff to databases containing the Data;
procedures for the Provider’s staff handling Data which impose confidentiality requirements they must fulfil.

In addition, Customer has the opportunity, on the Sites or when using the Services, to create an access account or Customer account containing an identifier and password that Customer only are deemed to know to protect access to Customer’s account. In order to further protect Customer’s Data, the Provider recommends that Customer periodically changes Customer’s password and under no circumstances should Customer discloses Customer’s identifiers to anyone.

9. Customer Rights

9.1 EU/EEA Residents (GDPR Rights)

Customers located in the EU/EEA have rights including:

Right to information
Right of access
Right to rectification
Right to erasure (subject to legal limits)
Right to restrict processing
Right to object to processing (including marketing)
Right to withdraw consent
Right to data portability
Right to lodge a complaint with their supervisory authority

9.2 U.S. Residents (State Privacy Law Rights)

Depending on the Customer’s state of residence, U.S. Customers may have rights including:

Right to know categories of Data collected
Right to request access to specific personal information
Right to request deletion of certain Data
Right to correct inaccurate Data
Right to opt-out of certain data-sharing practices
Right to non-discrimination for exercising privacy rights

Requests may be submitted to:
[email protected]

10. Contact Information

Details about Provider:

The name and details of Provider can be found in the welcome email sent to you upon subscribing to the Site. In addition, it can be found after logging in to the website stay-secure.app in the footer of this website, and on the My Account details page on stay-secure.app/account.

In case Customer has any questions with regards to this Privacy Policy, please contact the Provider at [email protected].

11. Complaints

If Customer believes their Data has been mishandled, they may contact the Provider at the above address.

EU/EEA customers may also contact their national supervisory authority.

U.S. customers may contact their state Attorney General.

Customer information will not be sold to third parties