Privacy Policy

1.Overview

This Privacy Policy explains how ProPera Online ("we", "us") collects, uses, discloses and protects personal information in connection with the ProPera Online security operations platform (the "Service"). We are committed to protecting your privacy and to complying with the privacy laws that apply to us, including the New Zealand Privacy Act 2020, the Australian Privacy Act 1988 (Cth), the EU General Data Protection Regulation (GDPR) where it applies, and other applicable data-protection laws.

By using the Service you agree to the practices described in this policy. We will only process personal information as described here or as otherwise disclosed to you at the time of collection.

2.What We Collect

Information you provide

• Account information: name, email address, organisation, role and login credentials (or your SSO identity from a provider such as Microsoft Entra ID or Google).
• Billing information: payment details are processed by our payment processor; we generally do not store full card numbers.
• Support information: content you send us when requesting support, including email communications.

Information we collect automatically

• Usage data: pages visited, features used, timestamps, device and browser type, IP address.
• Security data: audit logs of actions performed in the Service (who, what, when), login events and authentication results.

Information from connected services

When you connect the Service to your Microsoft tenant or other Connected Services, we access data those services expose through their APIs - for example device inventory, alerts, incidents, vulnerabilities, threat intelligence and compliance data - to the extent you authorise. This data is processed on your behalf to provide the Service's detection, investigation and response features.

3.How We Use Data

We use personal information to:

• provide, operate, maintain and improve the Service;
• authenticate users and protect accounts;
• process payments and administer subscriptions;
• detect, prevent and respond to security incidents and abuse;
• provide support and respond to enquiries;
• comply with legal obligations;
• send service notices and, where you have consented or we are otherwise permitted, marketing communications (you can opt out at any time).

We do not sell personal information. We do not use personal information for advertising profiling.

4.Lawful Basis (GDPR Article 6)

Where the EU General Data Protection Regulation (GDPR) applies, we process personal information on the following lawful bases:

• Performance of a contract: to provide the Service you have contracted for, including account administration, authentication, support and billing.
• Legitimate interests: to secure and improve the Service, prevent fraud and abuse, and maintain audit logs. We balance these interests against your rights and freedoms, and you may object as described below.
• Legal obligation: where we are required to process data by law, for example tax, accounting and regulator obligations.
• Consent: for marketing communications and any optional processing where we ask for your consent. Consent can be withdrawn at any time with effect for the future.

5.When We Share Data

We share personal information only in the following circumstances:

• Service providers (sub-processors): with processors who help us operate the Service (for example hosting, payments, email delivery, support), bound by a written data-processing agreement and used only for our purposes;
• Connected services: with the services you connect, when the Service needs to act on your behalf (for example executing a remediation action in your Microsoft tenant);
• Legal compliance: when required by law, regulation, legal process or government request, or to protect the rights, property or safety of our users, the public or ourselves;
• Corporate transactions: in connection with a merger, acquisition, reorganisation or sale of assets, with notice to you where practicable;
• With your consent: otherwise, only with your consent or at your direction.

We do not sell or rent personal information to anyone, and we do not share it for cross-context behavioural advertising.

6.Connected Services

The Service is designed to connect to your Microsoft environment and other third-party services. When you connect a service, you direct us to access and process data from it. Your use of each Connected Service remains subject to that provider's own terms and privacy policy.

You can revoke a connection at any time, and you can request deletion of data we hold from a connected service. Where a Connected Service authenticates with your credentials or delegated permissions, we store those credentials encrypted and use them only to provide the features you enable.

7.Retention & Deletion

We retain personal information only for as long as necessary to provide the Service, fulfil the purposes described in this policy, comply with legal obligations, resolve disputes and enforce our agreements.

• Account information is retained for the life of your account and for a reasonable period after closure.
• Audit logs are retained in accordance with our security and compliance commitments (typically at least 12 months, and longer where required by a regulated framework).
• Usage analytics are retained in aggregated form.

On account closure you may export your data. After the retention period, data is securely deleted or anonymised. You can request deletion of your personal information at any time; we will honour requests subject to legal and security retention obligations.

8.Security

We implement administrative, technical and physical safeguards designed to protect personal information, including encryption in transit and at rest, access controls, multi-factor authentication for platform administration, audit logging and regular security testing. See our Trust & Safety page for details.

No method of transmission or storage is completely secure. While we strive to protect your data, we cannot guarantee absolute security.

9.Cookies & Tracking

We use cookies and similar technologies only where necessary to make the Service work. Specifically:

• Essential cookies (strictly necessary): a single session cookie required for authentication, security and basic functionality. These are set solely so you can sign in and use the Service.
• Local storage: we may store small preference values in your browser (for example your theme choice, sidebar position and KQL query history). These stay on your device and are not sent to us for advertising.

We do not use analytics cookies, advertising cookies, tracking pixels or third-party trackers on the Service. Because the only cookie we set is essential, it is not subject to the cookie-consent requirement under the ePrivacy Directive / GDPR cookie rules, and no consent is required to set it. You can still block cookies in your browser, but doing so will prevent the Service from working.

Where we add any non-essential cookies in the future, we will ask for your consent first and let you manage your choices through a cookie preference banner.

10.Marketing Communications

We only send marketing communications (for example product updates and security news) where you have given your consent, for example by ticking the marketing box during registration, or where another lawful basis applies. Marketing consent is always optional, never a condition of using the Service.

Every marketing email includes a clear unsubscribe link. You can also opt out at any time by emailing info@propera.online or updating your preferences. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

We do not use your Customer Data or security telemetry for marketing, and we never sell marketing lists.

11.Your Rights

Depending on your location, you may have rights under applicable privacy law. These include (where they apply to you):

• GDPR (EU/EEA/UK): the right to access, rectify, erase and port your data; the right to object to or restrict processing; the right to withdraw consent; the right not to be subject to automated decision-making that produces legal effects; and the right to complain to your local supervisory authority.
• CCPA/CPRA (California): the right to know what personal information we collect, use and share; the right to delete; the right to correct; the right to opt out of the sale or sharing of personal information (we do not sell); the right to limit use of sensitive personal information; and the right to non-discrimination for exercising these rights.
• Other jurisdictions: equivalent rights under the Australian Privacy Act, New Zealand Privacy Act 2020, Canada's PIPEDA, Brazil's LGPD, South Africa's POPIA, Japan's APPI and other applicable laws.

You can exercise your rights yourself from your Profile page (export or delete your account data), or by emailing info@propera.online. We will respond within the timeframe required by applicable law (typically 30 days; under GDPR up to one month, extendable by two further months for complex requests). We may need to verify your identity before acting on your request, and we will not discriminate against you for exercising your rights.

12.International Transfers

We may process personal information on infrastructure located in different countries, including outside your country of residence. Where we transfer personal information across borders - including transfers from the EU/EEA/UK to third countries - we rely on appropriate safeguards recognised under applicable law, including:

• the European Commission's Standard Contractual Clauses (SCCs) together with the required transfer impact assessments, and the UK International Data Transfer Agreement / Addendum where the UK GDPR applies;
• an adequacy decision by the European Commission or the UK Secretary of State where one applies to the destination country;
• for California and other US states, compliance with the applicable state privacy laws and contractual protections;
• equivalent lawful transfer mechanisms for other jurisdictions.

Copies of the relevant safeguards are available on request. We process data from EU/EEA/UK data subjects only under these safeguards, and we will not transfer your personal information to a jurisdiction that does not provide an adequate level of protection.

13.Regional Privacy Rights

Because the Service is available internationally, this policy recognises the main regional privacy laws. In addition to the rights described above:

• California (CCPA/CPRA): we do not sell or share your personal information, and we do not use sensitive personal information for purposes other than providing the Service. If you are a California resident you may request that we disclose the categories and specific pieces of personal information we have collected, and you may request deletion or correction. Contact us at info@propera.online or use the Profile page tools.
• Virginia, Colorado, Connecticut, Utah, Texas and other US states: where applicable, we honour requests to access, correct, delete or opt out of targeted advertising (we do not engage in it) and profiling.
• Canada (PIPEDA): personal information is collected with knowledge and consent, used only for the purposes stated, and safeguarded. You may access and correct your information and withdraw consent subject to legal limits.
• Brazil (LGPD): data subjects may request confirmation of processing, access, correction, anonymisation, portability and deletion, and may revoke consent.
• UK (UK GDPR / Data Protection Act 2018): the same rights as the GDPR apply, exercised with the UK Information Commissioner's Office available for complaints.

14.Children

The Service is not directed to children under 18 (or the age of majority in your jurisdiction) and we do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

15.Breach Notification

If we experience a personal-data breach, we will:

• notify the relevant supervisory authority within 72 hours where the GDPR applies, unless the breach is unlikely to result in a risk to individuals' rights and freedoms;
• notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms;
• notify under the applicable local frameworks - for example the New Zealand Privacy Act 2020 (real risk of serious harm), the Australian Notifiable Data Breaches scheme (serious harm), and other applicable laws;
• document the breach, our response and our remediation in our incident log.

We maintain an incident-response plan covering detection, containment, investigation, remediation and verification. For our security commitments, see our Trust & Safety page.

16.Data Processing Agreement

Where you are a controller (or a processor acting for a controller) and the GDPR, UK GDPR, CCPA/CPRA or another applicable law requires a data-processing agreement, we will enter into our Data Processing Agreement (DPA) with you. The DPA covers our role as a processor, the scope and purpose of processing, data-subject rights assistance, security measures, sub-processor notifications and deletion/return of data on termination.

Our DPA incorporates the EU Standard Contractual Clauses (Module Two and Module Three, as applicable) and the UK IDTA/Addendum where required. You can request a copy of the DPA by emailing info@propera.online; it is incorporated into these Terms and the Privacy Policy by reference.

A list of our current sub-processors is available on request and is maintained as part of the DPA.

17.Contact & Complaints

If you have questions or complaints about this Privacy Policy or how we handle personal information, contact:

ProPera Online
Email: info@propera.online

You may also complain to your local privacy regulator. In New Zealand: the Office of the Privacy Commissioner (privacy.org.nz). In Australia: the Office of the Australian Information Commissioner (oaic.gov.au). In the EU/EEA: your local supervisory authority (for example the Irish Data Protection Commission). In the UK: the Information Commissioner's Office (ico.org.uk). In the US: the relevant state attorney general or the FTC.

If you are based in the EU/EEA or UK and we are required to designate a representative under Article 27 of the GDPR, we will publish that representative's details here.