Privacy Policy

1. Who we are and what this policy covers

THREAT-WATCH is Konstantinos Chatzistavrou, trading as THREAT-WATCH, a sole proprietorship (Ατομική Επιχείρηση) registered in Greece, VAT/Tax ID (ΑΦΜ) 186856801, GEMI No. 196779406000, registered address Ano Tzoumagias 6, 54453 Thessaloniki, Greece. Contact: info@threat-watch.com.

This policy covers the website threat-watch.com, the THREAT-WATCH client dashboard, the THREAT-WATCH Android app, and the managed security services we deliver to client organizations (together, "the services").

2. Our two roles: controller and processor

For your website inquiries, your dashboard or app account, and app crash and performance data, THREAT-WATCH decides how and why the data is used, so we are the data controller.

When we monitor and protect a client organization's systems, that organization (usually your employer) is the data controller for the personal data in its environment, and THREAT-WATCH acts as its data processor under a service agreement and data processing terms. We use that data only on the client's documented instructions and to deliver the contracted services. If you are an employee or user of a client organization, questions about that data are best directed to your organization first; we will help them respond.

3. Website and business contacts: what we collect

When you submit our contact, breach-response, or data-deletion form, we collect the information you provide (such as name, email address, company, and message content) in order to respond to your request. We also process your IP address at the point of submission, solely to apply rate limiting and prevent automated abuse of the forms.

The website itself does not use analytics, advertising, or tracking cookies, and we do not collect personal data through passive browsing. The site stores a single value in your browser to remember that you have seen our privacy notice.

Business contacts. We also process professional contact details (name, role, company, work email) from public professional sources to contact organisations about our services. You can object at any time by emailing info@threat-watch.com.

4. Dashboard and app accounts: sign-in and account data

To give you secure access to the dashboard and the Android app, we process:

• Account details: your name, work email address, company, role, and permissions.
• Authentication data: sign-in identifiers, password credentials stored only in hashed form, multi-factor authentication settings, and single sign-on identifiers where your organization uses them.
• Session and access records: sign-in times, IP addresses, device and browser or app details, session tokens, and failed sign-in attempts, which we keep to protect your account and detect misuse.
• Activity in the dashboard or app, such as reports viewed, alerts acknowledged, and settings changed, recorded as an audit trail.

5. App crash reporting and performance monitoring

The Android app uses Sentry for crash reporting and for error and performance monitoring, to keep the app working and to improve it. It is configured not to send personal data: reports carry no names, email addresses, account identifiers, or IP addresses. Sentry receives only technical information:

• Device and app information: device model, operating system version, app version, and language.
• Performance data: which screens are opened, how long they take to load, and the technical steps leading up to an error.
• Diagnostic data: crash logs, error reports, and stack traces.
• This information is not used for advertising, is not sold, and is not used to track anyone across other companies' apps or websites.

6. Security monitoring data we process for clients

Delivering managed detection and response, SOC monitoring, email security, OT/ICS security, backup and disaster recovery, incident response, phishing simulation, and compliance services means processing the security data of client environments. Depending on the services a client has contracted, this can include:

• Endpoint and server telemetry: device names, user account names, running processes, file names and hashes, and security events.
• Logs from identity systems, firewalls, cloud services, and applications, including user names, IP addresses, and access and authentication events.
• Network connection metadata, such as source and destination addresses, ports, and domains.
• Email security data: sender, recipient, and subject metadata, and the content and attachments of messages flagged as suspicious or malicious.
• Vulnerability and configuration data about client systems.
• Incident and forensic data collected while investigating and containing an incident.
• Backup data: copies of the client's systems and files, protected on the client's behalf.
• Phishing simulation and awareness training results: participant names, email addresses, and responses.

7. Legal basis

Website inquiries: our legitimate interest in responding to inquiries and operating an abuse-resistant contact channel, and, where a service engagement follows, taking steps before entering into a contract.

Business contacts: our legitimate interest in contacting organisations about our services, balanced against your rights. You can object at any time.

Accounts, authentication, and audit trails: performance of our contract with your organization, and our legitimate interest in keeping the services secure.

App crash reporting and performance monitoring: our legitimate interest in keeping the app reliable and improving it. These reports contain no personal data.

Security monitoring data: the client organization's instructions under our service agreement; the client determines its own legal basis as controller.

Accounting records and cooperation with authorities: compliance with our legal obligations under Greek and EU law.

8. Who we share data with

We do not sell personal data. We share it only with:

• Service providers acting as our processors under contract: Sentry (app crash reporting and error and performance monitoring), Checkly (uptime and availability monitoring of the dashboard and its APIs), Vercel (website hosting), Resend (website form email delivery), our security operations partner and the other technology partners that operate parts of the THREAT-WATCH platform, hosting, and backup infrastructure on our behalf, and the AI service providers described in section 12. Each may only use the data to provide its service to us.
• Authorities such as CSIRTs, law enforcement, or data protection authorities, when a client instructs us to notify them, or when the law requires it.
• Professional advisers, such as lawyers and accountants, where needed, under confidentiality obligations.

9. International transfers

Where our providers offer EU hosting, we use it. Some providers we rely on to deliver our services, including our security operations partner and AI service providers, process data in the United States or other countries. The website is also hosted by Vercel, with form processing running in its Frankfurt region, and form emails are delivered by Resend; both are United States companies.

Every such transfer is covered by an EU adequacy decision (including the EU-US Data Privacy Framework for certified companies) or by the European Commission's Standard Contractual Clauses. Clients receive the full list of providers, locations and safeguards in their data processing agreement.

10. How long we keep data

• Website inquiries: 24 months from our last contact if no engagement follows. Where a service engagement follows, for the duration of that engagement.
• Business contacts: until you object or the details are no longer relevant for contacting your organisation.
• Accounts and authentication data: for as long as your account is active. When an account is closed, we delete it as described on our Delete My Data page (threat-watch.com/delete-my-data).
• Access and audit records: for the period set in the client's service agreement, or as needed to investigate security incidents.
• App crash reports and performance data: contain no personal data, and are kept in Sentry for a limited period under our retention settings, then deleted automatically.
• Security monitoring data: for the retention period set in the client's service agreement, then deleted or returned to the client.
• Invoices and accounting records: for the period required by Greek tax law.

11. How we protect data

We protect personal data with technical and organizational measures appropriate to the risk, including encryption in transit, access limited to staff who need it for their role, multi-factor authentication for administrative access, and logging of access to client environments.

12. Automated processing

Automated tools score and prioritize security alerts and, where a client's service agreement authorizes it, can take pre-agreed containment actions such as isolating a compromised device. We do not use personal data to make decisions that produce legal or similarly significant effects about you as an individual.

We also use AI services to generate plain-language explanations of security findings. They make no decisions about individuals, and our providers may not use this data, including client data, to train their models.

13. Your rights

Under the GDPR, you have the right to access, correct, delete, or restrict the processing of your personal data, to object to processing (including to our use of your business contact details, at any time), to data portability, and to withdraw consent at any time where processing is based on consent. You may exercise these rights by emailing info@threat-watch.com. To delete your dashboard or app account, see threat-watch.com/delete-my-data.

For data we process on behalf of a client organization, we will pass your request to that organization and help it respond.

You also have the right to lodge a complaint with the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα, dpa.gr).

14. Children

Our services are intended for businesses and their staff. They are not directed at children under 16, and we do not knowingly collect their personal data.

15. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by an updated "last updated" date on this page, and, where they affect dashboard or app users, communicated through the services or by email.