ThreatPurge Privacy Notice
This Privacy Notice explains how ThreatPurge Pvt Ltd collects, uses, discloses, retains, and protects personal data when you interact with our websites, products, platforms, threat intelligence services, and related business operations.
No Sale of Personal Data
ThreatPurge does not sell or share personal data for cross-context behavioral advertising. We strictly honor Global Privacy Control (GPC) signals.
Threat Intel Transparency
OSINT, dark-web, and breach telemetry are processed strictly for cybersecurity risk detection without altering or claiming raw accuracy of breach records.
Enterprise Security
Protected with TLS 1.3 in-transit, AES-256 at-rest, least-privilege RBAC, and SOC 2 certified security infrastructure.
Universal Rights (DSRR)
Exercise your rights to access, rectify, erase, restrict, or port your data at any time via our dedicated Data Protection Officer.
Introduction
ThreatPurge Pvt Ltd is a unified cybersecurity and AI-powered threat intelligence company providing external attack surface management (EASM), digital risk protection (DRP), dark web monitoring, and automated threat disruption solutions to enterprises, managed security service providers (MSSPs), and government organizations worldwide.
This Privacy Notice covers Personal Data we collect through our own websites, marketing, sales, product demonstrations, webinars, and customer support activities.
This Privacy Notice does not cover Personal Data that a customer or its authorized users upload to, ingest, or generate through their active subscription use of our software, APIs, and cloud platforms. That data is strictly processed under our enterprise Master Services Agreement (MSA), Data Processing Addendum (DPA), and End User License Agreement (EULA). Any requests regarding customer-controlled data should be directed to the customer organization, who acts as the Data Controller.
This Privacy Notice explains how ThreatPurge Pvt Ltd, together with our subsidiaries and affiliates worldwide (“ThreatPurge,” “we,” “us,” or the “Company”), collects, uses, discloses, retains, transfers, and protects Personal Data when you interact with our websites, products, platforms, software, subscriptions, support services, threat intelligence feeds, customer interactions, marketing activities, and related business operations (collectively, the “Services”).
We use cookies and similar technologies to support the functionality, security, performance, and analytics of our website and Services. Where required by applicable law, we will obtain your affirmative consent to non-essential cookies through our cookie consent banner before they are set.
Links available through our website may direct you to third-party websites or services that are not owned or operated by ThreatPurge. This Privacy Notice does not apply to those third-party sites or their privacy practices. We encourage you to review their respective policies.
If you believe any information about you contained in our systems is inaccurate, please contact our Data Protection Officer at dpo@threatpurge.com.
Children’s Personal Data
ThreatPurge does not knowingly collect, solicit, or maintain Personal Data from children under the age required by applicable law (including under 13 in the United States under COPPA, or under 16 in the European Economic Area and United Kingdom under GDPR).
Our website, applications, and cybersecurity intelligence platforms are strictly intended for professional, commercial, and enterprise security operations. If ThreatPurge becomes aware that it has inadvertently collected Personal Data from a child contrary to applicable law, such data will be permanently purged and deleted from our databases.
If you believe that Personal Data relating to a child has been submitted to or collected by ThreatPurge, please immediately contact our Data Protection Officer at dpo@threatpurge.com.
Information We Collect and How We Collect It
Depending on how you interact with our websites, products, and services, we collect information from several categories of data subjects through direct interactions, automated telemetry, and third-party threat intelligence intelligence pipelines:
| Data Subject | Mode of Collection | Categories of Personal Data Collected |
|---|---|---|
| Customers & Prospective Customers | Direct collection from customers, authorized users, and enterprise prospects via demo requests, account setup, sales inquiries, and support interactions. |
|
| Website Visitors & Authorized Platform Users | Automatic collection through use of our website, documentation portal, and web applications via server logs, cookies, and telemetry trackers. |
|
| Other Data Subjects — Individuals Identifiable in Threat Intelligence Feeds | Indirect collection from public sources, open-source intelligence (OSINT), dark web channels, leak forums, breach repositories, and third-party data providers. |
|
| Customers / Billing Contacts | Direct collection during commercial contracting, invoice setup, or subscription checkout. | Payment and billing information, corporate tax identifiers, VAT numbers, invoicing addresses, and authorized signatory details. |
ThreatPurge collects and analyzes threat intelligence data strictly to support proactive cybersecurity defense, external attack surface discovery, ransomware detection, credential leak mitigation, and exposure management. Personal Data may be obtained from third-party sources and publicly available sources, including open-source intelligence (OSINT) and, where relevant, dark web sources.
Additional Information: We may ingest personal information made available by threat actors or unauthorized third parties on the dark web, underground marketplaces, or public repositories through our threat intelligence discovery engines. The categories of data vary based on the nature of the breach or exposure.
In limited circumstances, this may include identifiers relating to individuals where lawfully accessible and directly relevant to documented threat intelligence purposes (such as exposed employee credentials or compromised VIP identities targeted in extortion schemes).
How We Use Personal Data
We process Personal Data collected through our website, communications, and business operations to:
Lawful Bases for Processing Personal Data
In compliance with the General Data Protection Regulation (GDPR), UK GDPR, and applicable international privacy frameworks, ThreatPurge processes your Personal Data relying on one or more of the following established legal bases:
Explicit Agreement
You have given explicit, affirmative consent for us to process your Personal Data for a specific purpose (for example, opting into marketing newsletters, non-essential cookies, or customized webinar invitations). You retain the unconditional right to withdraw your consent at any time.
Performance of Agreement
Processing is strictly required to execute, perform, or fulfill a contract or Non-Disclosure Agreement (NDA) with your organization, or to take pre-contractual steps at your specific request (such as provisioning enterprise pilots or generating customized security quotes).
Statutory Compliance
Processing is mandatory for compliance with applicable statutory, regulatory, financial, accounting, or tax obligations, or to respond to valid, binding legal orders issued by competent judicial or governmental authorities.
Proactive Defense & Operations
Processing is necessary for legitimate commercial, cybersecurity, and technological interests pursued by ThreatPurge (such as defending IT systems, preventing fraud, detecting digital exposure, and advancing threat research), balanced rigorously against individual fundamental rights.
Cross-Border Data Transfer
Because ThreatPurge maintains a distributed global presence and threat detection infrastructure, Personal Data we hold about you may be transferred to, stored, and processed in countries outside your country of residence (including the United States, India, and other jurisdictions where our cloud infrastructure and engineering hubs operate).
Any Personal Data that we transfer internationally is protected strictly in accordance with this Privacy Notice and in full compliance with applicable data protection legislation. Where required by GDPR or UK GDPR, we implement robust transfer mechanisms, including:
- Standard Contractual Clauses (SCCs): The European Commission’s approved Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914).
- UK International Data Transfer Addendum: Approved by the UK Information Commissioner’s Office (ICO).
- Adequacy Decisions: Transfers to jurisdictions recognized by the relevant authorities as providing an adequate level of data protection.
- Supplementary Technical Measures: End-to-end encryption in transit and at rest, strict tenant isolation, and zero-trust access controls.
Please note that destination jurisdictions may have differing privacy laws than your country of residence. To obtain further information about the specific transfer safeguards applied or to request a copy of relevant transfer instruments, please contact our Data Protection Officer at dpo@threatpurge.com.
Data Security Measures
As an enterprise cybersecurity company, data integrity and confidentiality are foundational to ThreatPurge. We implement comprehensive technical, organizational, and physical safeguards (TOMs) engineered to protect Personal Data against unauthorized access, accidental destruction, alteration, unlawful disclosure, or loss:
We maintain rapid-response incident management procedures to identify, contain, and remediate potential security anomalies. In the event of a confirmed personal data breach affecting your records, we maintain protocols to notify competent data protection authorities and impacted individuals within statutory deadlines (such as GDPR’s 72-hour notification mandate).
Security Disclaimer & Account Safeguards: While we enforce rigorous cybersecurity controls, no transmission method over the public Internet or cloud storage system is guaranteed to be 100% impenetrable. Users are solely responsible for safeguarding their login credentials, choosing resilient passwords, and restricting physical and digital access to their devices.
How Long We Retain Personal Data
We retain Personal Data only for as long as necessary to fulfill the documented purposes outlined in this Privacy Notice, satisfy our contractual requirements, and comply with applicable statutory, tax, and legal obligations.
Our retention periods are established based on the following objective criteria:
- The nature, sensitivity, and volume of the Personal Data collected.
- The duration of our active contractual or business relationship with you or your organization.
- Statutory limitation periods and legal retention obligations (e.g., tax records, commercial laws, audit requirements).
- The need to establish, exercise, or defend against potential legal claims or arbitrations.
Upon expiration of the applicable retention schedule, we take immediate, irreversible steps to securely delete, shred, or permanently de-identify and anonymize the data in accordance with our documented Data Retention and Disposal Policy.
Your Privacy Rights
Subject to local legal requirements, exemptions, and verification, you possess specific fundamental rights regarding your Personal Data under GDPR, UK GDPR, CCPA/CPRA, and comparable privacy legislation:
Right of Access
Request confirmation of whether we process your data and receive a clear copy along with details of processing.
Right to Rectification
Request correction of inaccurate, incomplete, or outdated Personal Data without undue delay.
Right to Erasure ('Right to be Forgotten')
Request the deletion of your Personal Data when it is no longer necessary or when you withdraw consent.
Right to Restrict Processing
Request that we temporarily freeze or restrict processing under certain conditions (e.g. while accuracy is contested).
Right to Data Portability
Receive your Personal Data in a structured, commonly used, and machine-readable format (JSON/CSV) to transfer to another entity.
Right to Object
Object to processing based on legitimate interests, public interest, or direct marketing at any time.
Right to Withdraw Consent
Revoke consent previously provided without affecting the lawfulness of processing carried out before withdrawal.
Right to Opt-Out
Opt out of data sharing, sales, or targeted advertising. ThreatPurge does not sell data and respects GPC signals.
Right to Limit Sensitive Data
Request limitation on the collection and use of sensitive personal information where recognized under US state law.
Right to Know
Request disclosures regarding categories of personal data collected, sources, business purposes, and recipients.
Right to Grievance Redressal
Raise formal privacy concerns or complaints directly with our Data Protection Officer for prompt investigation.
Right Against Automated Profiling
Not to be subject to decisions producing legal effects based solely on automated processing without human intervention. ThreatPurge conducts no solely automated legal profiling.
Right to Lodge a Complaint
Lodge a complaint with your national or regional data protection supervisory authority (e.g. EU DPA, UK ICO, FTC).
Right to Nominate
Where recognized under applicable law, nominate an authorized representative to exercise rights on your behalf.
United States State Privacy Rights (California CCPA / CPRA, Virginia, Colorado, Connecticut, Texas)
If you are a resident of California or another U.S. state with applicable privacy laws, you possess specific rights including the right to know, access, correct, delete, and opt out of the sale or sharing of Personal Data.
- No Sale / No Sharing: ThreatPurge does not sell Personal Data and does not share Personal Data for cross-context behavioral advertising.
- Global Privacy Control (GPC): We automatically detect and honor opt-out preference signals sent via browser GPC headers as valid opt-out requests.
- Non-Discrimination: We will never discriminate against you, deny services, charge differing prices, or alter service quality because you exercised statutory privacy rights.
How to Submit a Data Subject Rights Request (DSRR)
You can exercise any of your privacy rights or submit a formal Data Subject Rights Request through any of the following channels:
Verification & Timelines: To safeguard your security, we may require identity verification before fulfilling your request. We will acknowledge and respond to valid requests within statutory timeframes (typically within 30 days under GDPR, or 45 days under CCPA). Where complex, we will notify you with the rationale for any permitted extension.
Changes to This Privacy Notice
It is ThreatPurge’s policy to post any changes we make to this Privacy Notice directly on this page. If we implement material revisions affecting the way we treat or process Personal Data, we will provide prominent notification on our website prior to the change taking effect, or notify registered account holders directly via their registered email address.
The date on which this Privacy Notice was last updated is indicated at the top and bottom of this document. You are encouraged to review this Privacy Notice periodically to stay informed about our data handling protocols.
Contact Information & DPO
For any questions, clarifications, feedback, or complaints regarding this Privacy Notice or to exercise your statutory data protection rights, please reach out to our privacy office:
7th Floor, Tower B, Knowledge Boulevard, Sector 62,
Noida, Uttar Pradesh 201309, India