This Privacy Policy describes how we handle and protect your personal data and the choices available to you regarding collection, process, access, and how to update, correct and delete your personal data. Additional information on our personal data practices may be provided in product settings, contractual terms, or notices provided prior to or at the time of data collection.

Billing Data includes your name, email address, masked credit card number, license information and in certain circumstances, your billing address and your phone number. In most circumstances, you purchase our products and services from a trusted third-party service provider, reseller, or app store. In those circumstances, your Billing Data is processed by the relevant third party and we only receive a subset of this data to keep proper business records. In these instances, see below an example of Billing Data and what we use it for:

Billing data	What we use it for
Email address	To send you purchase receipts
Masked credit card number	To process the payment and billing records
License key	To identify a specific license for a follow-up actions such as renewal or troubleshooting
License type	To enable features based on the purchased license
Renewability	To check if a given subscription can be renewed
Date of expiry	To check whether a license is valid

Account Data includes information needed to set up and customize an account, such as your name, email address and username, and information connected with our services, such as license keys. For some of our products or some of their functions creating an account is necessary. See below an example of Account Data and what we use it for:

Account data	What we use it for
Name	To customize our communications by addressing you by your name
Email address	To send you communications regarding your license and support
Username	To manage your account and facilitate your login into the service
Subscription renewal date	To tell us until when the account is valid
Trial User	To add a trial period before the account is charged

An account is also necessary for some features of our Forum. You have the option to provide additional information within your account such as personal texts, disclose your birth date, identify your gender, instant messaging number, messenger username, or website name and address, disclose your physical location, and select an avatar or personalized picture. Any information you provide here will be visible to other users (including your total number of posts, and posts per day, the date and time you registered, your local time, and the date and time of your last activity).

Product Data includes two sub-categories:

• Device Data includes information about the operating system; hardware; city/country of device; error logs; browser; network; applications running on the device, including the Esa products; and
• Service Data includes information about the Esa product usage and events relating to use of our product by you such as samples, detections and files used for malware protection, information concerning URLs of websites, usage statistics (activation, crashes, scans, errors), IP address.

We use your Personal Data for the following purposes and on the following grounds:

On the basis of fulfilling our contract with you or entering into a contract with you on your request, in order to:

• Process purchase of our products or services from us, our partners or our trusted third- party service providers’ online stores;
• Provision the download, activation, and performance of the product or service;
• Keep our products or services up-to-date, safe and free of errors, including implementation of new product features and versions;
• Verify your identity and entitlement to paid products or services, when you contact us for support or access our services;
• Process your purchase transactions;
• Update you on the status of your orders and licences;
• Manage your subscriptions and user accounts; and
• Provide you with technical and customer support.

On the basis of your consent, in order to:

• Subscribe you to a newsletter or the Esa forum;
• Enable the provision of third-party ads in product messages;
• Enable the provision of personalized ads in support of certain free products; and
• Allow us to record our phone conversation when you contact our tech support by phone.

On the basis of legal obligations, we process your Personal Data when it is necessary for compliance with a legal tax, accounting, anti-money laundering, legal order, sanction checks or other obligation to which we are subject.

On the basis of our legitimate interest we will use your Personal Data to:

• Communicate about possible security, privacy and performance improvements and products that supplement or improve our purchased products and to optimize the content and delivery of this type of communication;
• Evaluate and improve the performance and quality of our products, services and websites, develop new products, train our employees and to understand usage trends, and analyze user acquisitions, conversions and campaigns;
• Allow interoperability within our applications;
• Secure our systems and applications;
• Allow effective performance of our business by ensuring necessary internal administrative and commercial processes (e.g. finances, controlling, business intelligence, legal & compliance, information security etc.); and
• Establish, exercise or defend our legal rights.

Balancing Legitimate Interests

Before relying on our legitimate interests, we balanced them against your interests and made sure they are compelling enough and will not cause any unwarranted harm. With respect to the purposes below we consider necessary to explain what our interests are in detail.

Systems, Apps and Network Security

We process Personal Data for network and information security purposes. In line with EU data protection law, organizations have a recognized legitimate interest in collecting and processing Personal Data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security. This primarily covers the ability of a network or of an information system to resist events, attacks or unlawful or malicious actions that could compromise the availability, authenticity, integrity and confidentiality of stored or transmitted data, or the security of the related services offered by, or accessible via those networks and systems.

Both as an organization in our own right, and as a provider of cybersecurity technologies and services which may include hosted and managed cybersecurity technology services, it is necessary for the functionality of our systems, products and services and in our legitimate interests as well as in our users’, to collect and process Personal Data to the extent strictly necessary and proportionate for the purposes of ensuring the security of our own, and of our users’ networks, devices, and information systems. This includes the development of threat intelligence resources aimed at maintaining and improving on an ongoing basis the ability of our networks and systems, and those of certain partners, to resist unlawful or malicious actions and other harmful events (“cyber-threats”).

The Personal Data we process for said purposes includes, without limitation, network traffic data related to cyber-threats such as:

• Sender email addresses (e.g., of sources of SPAM);
• Recipient email addresses (e.g., of victims of targeted email cyberattacks including phishing);
• Reply-to email addresses (e.g., as configured by cybercriminals sending malicious email);
• Filenames and execution paths (e.g., of malicious or otherwise harmful executable files attached to emails);
• URLs and associated page titles (e.g., of web pages broadcasting or hosting malicious or otherwise harmful contents); and/or
• IP addresses (e.g., of web servers and connected devices involved in the generation, distribution, conveyance, hosting, caching or other storage of cyber-threats such as malicious or otherwise harmful contents).

Depending on the context in which such data is collected, it may contain Personal Data concerning you or any other Data Subjects. However, in such cases, we will process the data concerned only to the extent strictly necessary and proportionate to the purposes of detecting, blocking, reporting (by removing any personally identifiable elements) and mitigating the cyber-threats of concern to you, and to secure your network, device and systems. When processing Personal Data in this context, we do not seek to identify a Data Subject.

In-product and Email Messages

We have a legitimate interest for messaging our users about possible security, privacy and performance improvements and products that supplement or improve purchased products.

If you are our customer, we feel a responsibility to inform you about security and utility improvements and possible problems to your device and software that go beyond our product that is installed and provide you with effective solutions relevant to these problems. We thus have legitimate interest to optimize the content and delivery of this type of communication to you so that you will be most likely to find them relevant and non-intrusive at the same time.

We do our best to disconnect or remove all direct identifiers from the Personal Data that we use:

• For free versions, this disconnection or removal of identifiers begins when the products and services are initially activated. For paid users we keep Billing Data in a separate database and minimize its use for anything other than handling payments and our own finances.
• For both paid and free versions, we continuously monitor for, minimize, disconnect and remove all direct identifiers during the normal performance of the products and services.

Processing of IP Addresses

For paid products including antivirus, virtual private network (“VPN”), and performance, your IP address is collected at the time at which your product or service is being provided, for the purpose of facilitating our billing process. Specifically, our third-party billing partner will collect your IP address for its billing process; we do not store the IP address from this process.

Personalization

We use your answers from surveys, in which you can participate, and relevant Product Data to personalize communication and recommend our relevant products for you.

We do not take any decisions solely based on algorithms, including profiling, that would significantly affect you.

We only disclose your Personal Data as described below, within our group, with our partners, with service providers that process data on our behalf and with public authorities, as required by applicable law. Processing is only undertaken for the purposes described in this Privacy Policy. If we disclose your Personal Data, we require its recipients to comply with adequate privacy and confidentiality requirements, and security standards.

Payment processors

If you opt to pay for use of our services, we will use a third party payment processor to take payment from you. These third parties are properly regulated and authorized to handle your payment information and are prohibited from using your Personal Data for any other purposes other than arranging these services for us. However, they are independent controllers of your data with their own responsibility.

These are our long-term payment processors:

Payment Processor	Link to Privacy Policy	Location
Mamo Limited, India	https://www.mamopay.com/legal/privacy	Mamo Limited, Unit GA-00-SZ-L1-RT-196, Level 1, Gate Avenue - South Zone, Dubai International Financial Centre, Dubai, United Arab Emirates

Your Billing Data is processed by the payment processor from whom you purchased the product. Your data is processed according to the relevant processor’s privacy policy.

Service Providers

We may use contractors and service providers to process your Personal Data for the purposes described in this Privacy Policy. We contractually require service providers to keep data secure and confidential.

Such service providers may include in particular contact centers, professional consultants (including for defence or exercise of our rights), and marketing/survey/analytics/software suppliers.

Sometimes these service providers, for example, our distributors, resellers, and app store partners, will be independent controllers of your data and their terms and conditions, end user license agreements (“EULA”) and privacy statements will apply to such relationships.

Distributors, Resellers

We may provide your Personal Data to our partners for the purpose of distribution, sale or management of our products. Our partners may use your Personal Data to communicate with you and others about Esa products or services. In addition, you purchase our products directly from our distributor, a reseller, or an app store. Because your relationship in these cases is with that distributor, reseller or an app store, such third party will also process your Personal Data.

Cookies Providers

Our websites use cookies to personalize your experience on our sites, tell us which parts of our websites people have visited, help us measure the effectiveness of campaigns, and give us insights into user interactions and user base as a whole so we can improve our communications and products..

We maintain administrative, technical, and physical safeguards for the protection of your Personal Data.

Administrative Safeguards

Access to the Personal Data of our users is limited to authorized personnel who have a legitimate need to know based on their job descriptions, for example, employees who provide technical support to end users, or who service user accounts. In the case of third-party contractors who process personal information on our behalf, similar requirements are imposed. These third parties are contractually bound by confidentiality clauses, even when they leave. Where an individual employee no longer requires access, that individual's credentials are revoked.

Technical Safeguards

We store your personal information in our database using the protections described above. In addition, we utilize up-to-date firewall protection for an additional layer of security. We use high-quality antivirus and anti-malware software, and regularly update our virus definitions. Third parties who we hire to provide services and who have access to our users' data are required to implement privacy and security practices that we deem adequate.

Physical Safeguards

Access to user information in our database by Internet requires using an encrypted VPN, except for email which requires user authentication. Otherwise, access is limited to our physical premises. Physical removal of Personal Data from our location is forbidden. Third-party contractors who process Personal Data on our behalf agree to provide reasonable physical safeguards.

Proportionality

We strive to collect no more Personal Data from you than is required by the purpose for which we collect it. This, in turn, helps reduce the total risk of harm should data loss or a breach in security occur: the less data we collect, the smaller the overall risk.

We will hold your Personal Data on our systems for the following periods:

• For Billing Data, for as long as we have a legal obligation or for our legitimate interests in establishing legal rights;
• For Account Data, for as long as you maintain your account;

The data we collect from you may be stored, with risk-appropriate technical and organizational security measures applied to it, on in-house as well as third-party servers in the Czech Republic, in the United States, as well as anywhere we or our trusted service providers and partners operate.

In all cases, we follow generally accepted standards and security measures to protect the personal data submitted to us, both during transmission and once we receive it.

You have the following rights regarding the processing of your Personal Data:

• Right to information - Right to receive information about the processing of your Personal Data, prior to processing as well as during the processing, upon request.
• Right of access - Aside from the information about the processing of your Personal Data, you have the right to receive a copy of your Personal Data undergoing processing.
• Right to rectification - We should process accurate Personal Data; if you discover inaccuracy, you have the right to seek rectification of inaccurate Personal Data.
• Right to erasure ("right to be forgotten") - You have the right to erasure of your Personal Data, but only in specific cases stipulated by law, e.g., if there is no legally recognized title on our part for further processing of your Personal Data (incl. protection of Esa’s legitimate interests and rights).
• Right to data portability - The right to receive Personal Data which you have provided and is being processed on the basis of consent or where it is necessary for the purpose of conclusion and performance of a contract, in machine-readable format. This right applies exclusively to Personal Data which processing is carried out by automated means.
• Right to object - Applies to cases of processing carried out in legitimate interest. You have the right to object to such processing, on grounds relating to your particular situation, and we are required to assess the processing in order to ensure compliance with all legally binding rules and applicable regulations. In case of direct marketing, we shall cease processing Personal Data for such purposes after the objection.
• Right to restriction of processing - You have the right to restriction of processing of your Personal Data if: You are contesting the accuracy of your Personal Data, for a period enabling us to verify the accuracy of your Personal Data; the processing is unlawful and you oppose the erasure of the Personal Data and request the restriction of its use instead; we no longer need the Personal Data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims; or you have objected to processing of your Personal Data, and there is a pending verification whether our legitimate grounds override your interests.
• Right to contact supervisory authority, court - You may contact and lodge a complaint with the supervisory authority – The Office for Personal Data Protection (Czech: Úřad na ochranu osobních údajů – www.uoou.cz) or your local authority or a relevant court.

The fulfillment of data subject rights listed above will depend on the category of Personal Data and the processing activity. In all cases, we strive to fulfill your request.

We will action your request within one month of receiving a request from you concerning any one of your rights as a Data Subject. Should we be inundated with requests or particularly complicated requests, the time limit may be extended to a maximum of another two months. If we fail to meet these deadlines, we would, of course, prefer that you contact us to resolve the situation informally.

Where requests we receive are manifestly unfounded or excessive, in particular because of their repetitive character, we may either: (a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or (b) refuse to act on the request.

For the free versions, we do not and will not maintain, acquire or process additional information solely in order to identify the users of our free products and services. This is simply not necessary for the free versions of our products to be provided to you and function.

This means, when you use a free version of our products and services, you may contact us with a request concerning your Personal Data. Please note, consistent with our privacy by design, privacy by default and minimization practices, we may not be able to identify you in connection with your Product Data about your specific free products and services. If such a situation occurs, please go to your product settings and explore your options.

Your Choices in products

You can make certain choices about how your data is used by us by adjusting the privacy settings of the relevant product. Please check your product settings to set your privacy preferences there.

Privacy Portal

In order to make it easier for you to reach out to us and obtain the necessary information and action changes, corrections or deletions of your Personal Data, we have decided to provide you with a portal, which can show you the Billing Data and Account Data we have collected from you as well as your email preferences.

To exercise any of your rights, or if you have any other questions or complaints about our use of your Personal Data and its privacy, write our Privacy Team through the most convenient channel below:

If you live in India is, Business Centre, Sharjah Publishing City Free Zone, Al Zahia, Sharjah or email via support@unitedaddress.com

As required under the GDPR, we have a data protection officer (DPO) to monitor our compliance with the GDPR, provide advice where requested and cooperate with supervisory authorities. You can contact our data protection officer via dpo@unitedaddress.com.

We reserve the right to revise or modify this Privacy Policy. In addition, we may update this Privacy Policy to reflect changes to our data practices. If we make any material changes we will notify you by email (sent to the e-mail address specified in your account) or by means of a notice on this website prior to the change becoming effective. We encourage you to periodically review this page for the latest information on our privacy practices.