Privacy Policy for Business

Effective as of September 30, 2026 | See a previous version of Privacy Policy | Compare changes

The protection of personal data is of particular importance to ESET, spol. s r. o., having its registered office at Einsteinova 24, 85101 Bratislava, Slovak Republic, Business Registration Number: 31333532 ("ESET" or "We"). We want to comply with the transparency requirements as prescribed by the EU General Data Protection Regulation ("GDPR"). To achieve this goal, We are publishing this Privacy Policy with the sole purpose of informing you, a person using our services in accordance with our Terms of Use for Business ("You"), about how We process data relating to identified or identifiable natural persons ("Data Subject") in the context of our services as defined below.

This Privacy Policy applies to all ESET  Applications, Products, and Services as defined in and regulated by our Terms of Use for Business ("Terms") or this Privacy Policy, and therefore to all ESET Applications, Products and Services included in our standard business subscriptions (except for small business subscriptions) ("Subscription"), to all ESET business accounts and their websites, including ESET PROTECT Hub, ESET Business Account, ESET MSP Administrator and ESET Services HUB ("Account") as well as to all services and features provided by ESET via the Account ("Subscription" and "Account" collectively "Services").

Our Services require the use of various types of ESET software applications, including locally installed software, cloud-based software, and more complex software platforms and Accounts developed by ESET (collectively as" Application"). Where a specific Application is offered as a stand-alone item for purchase, it is also referred to as a "Product". For the avoidance of doubt, the term "Services" includes Applications and Products.

Capitalized terms not defined in this Privacy Policy shall have the meanings given to them in the Terms.  We also use herein standard terms defined in the GDPR, for example, "personal data", "data subject", "controller" or "processor" within the meaning given to them in the GDPR.

For certain Applications, Products or Services, We may create a specific privacy policy. If a specific privacy policy applies to a particular Application, Product, or Service, that specific privacy policy shall prevail over this Privacy Policy to the extent of any inconsistency.

This Privacy Policy may be made available in several languages for convenience. In the event of any discrepancy, inconsistency or conflict between the English version and any translated version, the English version shall prevail, to the extent permitted by applicable law.

The Privacy Policy is mainly concerned with how We process personal data of Data Subjects as a data controller; however, to give You more complete information, We also describe here which data We process in a data processor role. In such cases, our Data Processing Agreement applies to the respective processing of personal data.

We may modify this Privacy Policy from time to time at our sole discretion. We will send You an email notification with a link to the Privacy Policy as amended, or We will notify You of the amended version via in-app notification or by other electronic means such as in case of smaller updates by solely publishing the new version on our website. If You do not agree with the amended Privacy Policy, You should cease to use the affected Services and uninstall the affected Applications or Products if applicable. If You continue to use the Services after the amended Privacy Policy becomes effective, We will consider You to have acknowledged it.

In particular, this Privacy Policy contains information about:

•Categories of Personal Data We Process,

•Legal Basis for Personal Data Processing,

•Data Disclosure and Transfers to Third Countries,

•Data Security,

•Your Rights as a Data Subject,

•Our Contact Information.

Categories of Personal Data We Process

To provide our Services, We must process various types of data that may relate to Data Subjects. Depending on the specific Services provided to You and their technical configuration, We may act as a data controller for certain data processing activities and as your data processor for others, in accordance with the GDPR.

Below, We outline the categories of data that can relate to Data Subjects that We may process in connection with our Services, taking into account our role in the specific data processing. Please note that some categories of data are processed only within specific Applications, Products and Services and therefore may not be applicable to your particular case.

ESET as a Controller

Subscription Management and Billing. ESET collects and processes your name, email address, information about your Subscription and activation keys (or if you represent a company, the information about the Subscription and activation keys of the company you represent). If We process your payment data for the Subscription, We also process your business address, company/business name and payment information (or if you represent a company, your name, company affiliation, company address and company payment information).  This data is used to facilitate Subscription activation, delivering activation keys, sending reminders about Subscription expiration and legal communication related to the Subscription, verifying Subscription authenticity, and sending other notifications in accordance with applicable laws. ESET is legally required to retain billing information for 10 years. Subscription-related data will be anonymized in our Subscription system no later than 12 months after your last Subscription expires; however, this data may be processed for a different time period and for different purposes in other internal systems, as described in this Privacy Policy. This includes processing of Subscription-related data together with any legal communication for 3 years after the expiry of your last Subscription for the purpose of establishment, exercise or defense of legal claims.

Account Management. For Account registration, to enable You access to related Services, and to provide You with our Services, We may need to process your full name, name of the company You represent, country of residence, valid email address, phone number, as well as Subscription-related information.

Service Provision and Operations. For the purpose of the proper functioning of our Services, We process various technical and operational data that are automatically generated during the installation, configuration and use of ESET Services (including use of protected devices) ("Telemetry"). Telemetry includes data such as database performance, health statistics, numbers of managed endpoints, endpoint Operating System, system hardware, system errors, policies, logins, tasks, notifications, managed devices, detections statistics, event processing rates, rule engine statistics, exclusions, etc., as well as HTTP headers. Where technically feasible and appropriate, Telemetry may be processed in anonymized, pseudonymized, or aggregated form.

Research. For research purposes We may process Infiltration Data (only those that can potentially lead to malicious activity), and Incident Data (with Incident Data We do not use Customer identification data, solely business sector of the Customer) collected from our Services together with related Telemetry (for example, timestamp; OS name, type and version; cloud provider and instance; information about the device involved such as device manufacturer, device model). The data may also include data from third-party integrations if connected and AI Security Data if permitted. We don't use Customer identifiers except for instance ID, which We always hash. We generally process Research data only where you opt in. For the MDR Service, however, research processing is based on an opt-out mechanism, which is an exception to this general approach. The data from MDR Services is always used in an aggregated and anonymized manner.  Research data (for example, Telemetry, Customer name, IP address, browser identifier, operating system identifier, own Research, third party information about threats) may also be used for our ESET Threat Intelligence Service. Threat Research data is currently processed in our data centers in Slovakia and Germany. This processing is based on our legitimate interest in improving our Services.

The aim of our Research is to provide our Customers with more effective, powerful and state-of-the-art Services and to enable us to respond effectively to the latest and most sophisticated cybersecurity threats. We conduct Research to improve the detection, prevention and mitigation capabilities of our Services and Applications, develop new protection capabilities, analyze the evolution of cybersecurity threats, and identify relationships between malware families and threat actors.

Optimization and Improvement of our Services. For the purposes of optimizing and improving our Services, We may process Telemetry based on our legitimate interest. This processing helps us maintain and improve the Services, enhance the overall user experience, and support the security, effectiveness, performance, functionality, reliability, and quality assurance of our Services. It also enables us to adapt the Services to the latest industry standards and derive statistical insights. The data used for these purposes is aggregated, anonymized, and/or otherwise rendered not reasonably capable of being associated with any identifiable individual or with You.

Technical Support. Contact details, Subscription information, and data provided in your support requests may be necessary for technical support purposes. Depending on the communication channel You select, We may collect your email address, phone number, company affiliation, Subscription information, Application or Service details, and a description of your support case. Additional information may be requested to facilitate our technical support. All data processed for technical support is retained for 4 years.

Marketing Communication. In accordance with relevant laws governing direct marketing, We may use your contact information or our Application and Service communication channels for direct marketing of our Applications and Services, consistent with our legitimate interest in promoting our offerings. This use will continue until you unsubscribe from such communication, or until your Subscription-related data is anonymized 12 months following the expiration of your last Subscription.

Your Feedback. Your feedback, answers, or requests can be submitted through our web forms or other communication channels. To follow up, We may need your contact information (such as your email) or other relevant data, depending on the purpose and context of your communication. Data retention periods vary according to the nature or purpose of the communication and are managed in compliance with this Privacy Policy.

Legal & compliance purposes. Identification, contact, billing data and Telemetry may also be processed for the purposes of establishment, exercise, or defense of legal claims, protecting our rights and interests, enforcing contractual obligations, preventing misuse of the Services, compliance as well as cooperating with competent authorities where required by applicable law.

Cybersecurity Awareness. Anonymized, aggregated and statistical data from Research may be shared with research organizations, other security vendors, professionals, authorities or the general public via publications, blog posts, or social media to enhance awareness and prevention of internet security risks and to support cyber threats research. This also includes the use of statistics derived from such data to track and publish reports on cybersecurity risk trends.

Specific Data Processing from Locally Installed and Cloud-Based Protection Applications (all antimalware Applications and ECOS)

•Telemetry. The data processed includes information about the installation process, device properties, as well as information on the operation and functioning of our Applications, such as the platform where the Application is installed, operating system, hardware specifications, installation IDs, Subscription IDs, IP address, MAC address, and Application configuration settings. This data is collected for the purpose of updates, upgrades, maintenance, security, and the development of our Applications and Services, and backend infrastructure. It is stored and processed independently from identification data necessary for billing or Subscription records, as its processing does not require identification of our Applications' End-Users or other Data Subjects. The retention period for this data is up to 4 years.

•ESET LiveGrid® Reputation System. One-way hashes related to infiltrations are processed for the purpose of ESET LiveGrid® Reputation System, which improves the efficiency of our antimalware Applications by comparing scanned files to a database of whitelisted and blacklisted items. The End-Users of our Applications or other Data Subjects are not identified during this process.

•ESET LiveGrid® Feedback System. Suspicious samples and Telemetry from the wild are collected as part of ESET LiveGrid® Feedback System, which enables ESET to react promptly to your needs and keep us responsive to the latest threats. We are dependent on You sending us:

oInfiltrations such as potential samples of viruses and other malicious computer programs and suspicious, problematic, potentially unwanted or potentially unsafe objects such as executable files, URLs, webpages, snippets/samples of network communication email messages, email attachments and OneDrive files reported by You as spam or flagged by our Application and related Telemetry;

oInformation concerning the use of internet, such as IP address and geographic information, IP packets, URLs and ethernet frames;

oCrash dump files and information contained.

Such data from ESET LiveGrid® Feedback System shall constitute "Infiltration Data" for the purposes of this Privacy Policy. Suspicious samples, filenames, URLs or Telemetry received as part of this Service may occasionally contain personal data of Data Subjects. We do not specifically seek to process such personal data, nor do We intend to collect it. Our purpose and sole goal in collecting, processing and researching the samples, URLs and related Telemetry is to provide You and other Customers with better Services, including our enhanced antimalware protection.

All Infiltration Data is intended to be handled without identifying the End-User of our Application or any other Data Subjects.

Browser Extension. The Browser Extension sends data only to the locally installed Application. This data is processed primarily locally, and ESET does not have access to it, including the user's search history. If data sent by the Browser Extension is identified as malicious by the locally installed Application, any transmission of that data to ESET is governed by the settings of the Application. If the LiveGrid® Feedback System is enabled, samples may be sent to ESET as Infiltration Data; other personal data is not transmitted to ESET. However, We receive Telemetry such as the number and type of particular threats detected by ESET Services (for example, the number of trojans detected).

AI Security. If AI Security is enabled to provide protection against malicious activities involving LLMs and other AI tools, the relevant processing is performed locally. ESET does not have access to the user's browsing activity or LLM conversations. However, if (i) the LiveGrid® Feedback System is enabled, (ii) the collection of LLM conversations is permitted, and (iii) malicious activity is detected, We may receive samples of viruses or other harmful code for Research. The data We then process includes type of AI tool used, detection type (code snippet, phishing URL), detection (prompt injection, trojan agent), affected object (address of the affected object within the OS), malicious prompt, malicious conversation, harmful output, browser application, user information (username and email), communication origin (who communicates with who, for example, computer name with LLM provider name) ("AI Security Data").

•ESET Secure Autentication On-Prem. If You choose to use this Application, We may process data necessary for authentication, provisioning, and the proper functioning of the particular features You enable. Depending on the selected features and configuration, this may include data such as username, telephone number, token name, token ID, other token-related information, activation URL, Subscription information, phone ID, notification ID, and platform information..

Theat Intelligence Services.  Where We provide You with our Threat Intelligence Report and related services, We conduct Customer due diligence due to the sensitivity and confidentiality of the information contained in the Threat Intelligence Report and related services. As part of this due diligence, We may process data such as who your beneficial owners are (your management or beneficial owners) or if You or your beneficial owners are on sanctions lists.

Legal Basis of Personal Data. There are a few legal bases for data processing which We use as a data controller according to the applicable legislative framework related to the protection of personal data. The processing of personal data by ESET is mainly necessary for the performance of the Terms with the Data Subject (Art. 6 (1) (b) GDPR), which is applicable for the provision of ESET Applications or Services, unless explicitly stated otherwise, for example:

oLegitimate interest legal basis (Art. 6 (1) (f) of the GDPR), that enables us to process data on how You use our Services and your satisfaction to provide You with the best protection, support and experience We can offer. Even marketing might be recognized by applicable legislation as a legitimate interest, therefore, We may rely on it for marketing communication in some cases. We also rely on legitimate interest for the purposes of conducting Research; however, We always do so either with your authorization, or We allow You to opt out from the usage of your data for research purposes.

oConsent (Art. 6 (1) (a) of the GDPR), which We may request from You as a Data Subject in specific situations when We deem this legal basis as the most suitable one or if it is required by law.

oCompliance with a legal obligation (Art. 6 (1) (c) of the GDPR), for example, stipulating requirements for electronic communication, retention for invoicing or billing documents.

Please note that if, within our Services, We process personal data of a Data Subject who has not accepted our Terms and therefore has not entered into a contract under Art. 6 (1) b) of the GDPR (for example, your employee, a family member, another person You have authorized to use the Services, or third parties in cases of suspicious sample collection), We process their data based on our legitimate interest under Art. 6 (1) f) of the GDPR. This processing enables us to provide the Services to You as well as to maintain their high quality and security.

ESET as a Processor

This section outlines the categories of data processed in connection with our Services for which We act as your data processor. It applies mainly to our cloud-based Applications, which require the collection and processing of data concerning monitored endpoint devices on which our locally installed Applications are deployed, as well as your network. The extent of monitoring that is being performed in your infrastructure, as well as the exact data being collected, depends on rules, exclusions, configurations, thresholds and settings managed by You and your administrators. We process personal data as a data processor based on our Data Processing Agreement to be able to provide You with our Services. The data, along with other Service-related logs, shall be stored in accordance with the Logs Retention Policy of a specific cloud-based Application, as detailed in the documentation.

We encourage You to check and review the legislation and legal requirements for data collection and processing in your country while setting up our cloud-based Applications. You might be required to notify End-Users of managed or monitored endpoint devices or ask for specific permission under certain jurisdictions to perform monitoring activities.

ESET PROTECT

•XDR Platform. XDR Platform collects and processes data from monitored endpoint devices and the network and sends them to the cloud console. As an endpoint detection and response (XDR) type of Application, it is designed for detailed monitoring and anomaly detection.  
 
When You use the XDR Platform, ESET PROTECT, We process security-relevant data relating to events generated by devices, systems, or Third-Party Services monitored through our Services. This may include indicators of suspicious activity, such as suspicious logins or unusual use of applications; information about identified security incidents, including combinations of indicators and Telemetry used to evaluate the incident, such as its severity; actions taken in relation to incidents, such as isolating a computer from the network, ending a process, or logging out a user; and information about the Customer segment, such as industry. Together with related Telemetry, this security-relevant data constitutes "Incident Data" for the purposes of this Privacy Policy. Related Telemetry may include event timing and identifiers, event characteristics and risk information, cloud and infrastructure information, network and endpoint information, device information, operating system information, file and Application information, process and command-line information, URL and web-resource information, and user and account information.

•Managed Endpoint Devices. Management of ESET locally installed Applications requires seat ID and name, Application name, Subscription information, activation and expiration information, hardware and software information concerning managed devices with ESET Applications installed. Logs concerning activities of managed ESET Applications and devices are collected and available in order to facilitate managing and supervising features and our Services. Other processed information may include information concerning the installation process, including platform on which our Application is installed and information about the operations and functionality of our Applications or managed devices, such as hardware fingerprint, installation IDs, Subscription IDs, IP address, MAC address, used email addresses, GPS coordinates of a mobile device or configuration settings of our Applications. We may also use your contact information to inform You about a security issue in your environment We identified.

•Vulnerability & Patch Management. If You choose to use Vulnerability Assessment and Patch Management features, more information will be processed. The information related to the vulnerability name and identifier, severity and impact score for managed devices will be collected and processed for the Vulnerability Assessment. The Patch Management feature also requires the application name, version and vendor, the version of the patch missing on the device and the identifier of the missing patch.

•Cloud Workload Protection. This feature collects and processes primarily two types of cloud activity logs: (i) logs related to resource operations (such as Azure Activity Logs, AWS Management Events, GCP Admin Activity Logs) and (ii) identity-related logs (such as Microsoft Entra ID), which may include the following personal data from your cloud environment: (i) the IP address of the API request executor and (ii) the identity of the user who executes the request (name, email). It also collects Telemetry about cloud resources and identities and may include personal information from your cloud environment, such as name, email address or IP address. This data from your cloud environment is processed to detect and respond to potential malicious software or malware running in your virtual machines or your broader cloud environment, and to write indicators in the form of a report, status of connectors and tasks, and/or to publish events to ESET PROTECT. For this purpose, We create temporary snapshots of your disk and other resources, such as virtual machines and network firewalls. We scan these snapshots to detect malware and other security threats and to take the necessary protective action. Once the relevant scan has been completed, We delete the temporary snapshots and any associated data. We do not retain or use these snapshots for any other purpose.

•Remote Access Service. ESET Remote Access, if available, enables administrators to remotely access a managed endpoint device via the ESET PROTECT . Depending on the network setup, data from the endpoint is either transmitted directly between the ESET PROTECT (administrator's browser) and the endpoint or relayed through ESET's servers. In both cases, all information is end-to-end encrypted on a per-session basis. This includes the remote desktop screen, mouse and keyboard activity, clipboard contents (only data copied during the session), file transfers, and chat messages. When relayed through ESET servers, the information is neither stored nor decrypted. IP addresses and routing information are processed to negotiate the connection between the endpoint and the ESET PROTECT. If files are transferred, they follow the same encrypted path and are not retained on ESET's servers. For audit purposes, ESET PROTECT records certain Telemetry related to admin actions, such as the dates and times when the session starts and ends, and whether a file was transferred from the endpoint. Additional Telemetry related to the session will also be collected, such as filenames of the transmitted files, IP addresses, machine names, and usernames. Administrator's actions performed on a remote device are neither monitored nor logged. Furthermore, once ESET PROTECT chat feature becomes available for ESET Remote Access, chat transcripts of communications between the administrator and the End-User may also be logged for audit purposes. Apart from ESET Remote Access, we also provide remote access to terminals on computers. If available, for security, access-control and audit purposes, We monitor remote access to terminals on computers. An authorized user may use the remote terminal to view or otherwise interact with content stored on or accessible from the relevant computer, including files. We record information about the remote access and activities performed through the terminal, including the identity of the user, the relevant account and computer, the date and time of connection and disconnection, the actions performed, for example, the download of any files via the terminal and the output or results of those actions. These records may include information relating to the computer or files accessed or handled during the remote session.

•Third-Party Services connected to XDR Platform. Where enabled by You, additional data originating from Third-Party Services may also be processed if You activate any inbound integrations or You enable specific functionalities of the Service. The data We may process if You connect Third-Party Services to XDR Platform may include Incident Data standardly processed by the XDR Platform as described above. The data We process always depends on the integration You connect. . We may also process data when We are helping You to configure a particular integration based on your request or when We process data for the purposes of providing our Services and their monitoring to confirm that the integration works properly. Please note that the relevant Third-Party Service provider acts as independent data controller or data processor as applicable under the GDPR. We do not take any responsibility for data protection compliance or security practices of such Third-Party Service providers.

Outbound integrations. Where We allow outbound integrations and You instruct us to do so by their activations, We send data processed through our Application to your infrastructure or other Third-party Services You use. The data shared is data already processed through our Applications and depends on the particular integration: We send the data requested by the integration or, where possible, the data You configure to be shared. Details of each integration are available in the documentation for the respective Application allowing the integration. Please note that when You use an integration to transfer your data to another product, the retention periods applicable to the receiving product will apply to the data stored there.

ESET Secure Authentication

•ESA Cloud console. Our cloud-based console enables You to manage and configure our Services, and it also functions as a cloud-based authentication server, processing authentication requests from endpoint devices for which You enabled two-factor authentication. Various categories of data that are necessary for the functioning of our ESET Secure Authentication are being processed there to enable provisions of our Services to You, while the exact data to be processed depends on authentication methods and components You choose to use and other configurations of the Service You make. Cloud console may therefore process data related to your End-Users, such as usernames and IDs, IP addresses, mobile numbers, email addresses, organizational units, as well as data related to your organizational structure (if You choose automatic syncing of your database containing data on your organizational structure with our cloud console, your login credentials for the database might need to be input). ESA also has a mobile application within which We process data such as username, environment to which the user can log in, activation URL or timestamp.

•Third Party Services and Integrations. If You choose to integrate ESET Secure Authentication with third-party services and components, We may process additional data necessary for integration and functioning of our Services with such services and components of your choice, e.g. necessary data from Microsoft Exchange Server, Microsoft Dynamic CRM, Identity Provider Connector or RADIUS, data on hardware tokens used by your users (e.g. hard token secret) and data related to your Subscription. To provide You with the reporting functionality as well as with relevant notifications, data related to various events happening in your organization (such as who logged in, failed logins, etc.), as well as about our Service functioning (such as errors) need to be processed.

•Please note that, depending on the properties of the component You choose to integrate with ESET Secure Authentication, We may have to process also first-factor information used for authentication, usually the End-User's password, but only to forward it to the competent entity for verification. No passwords of End-Users who use ESET Secure Authentication for two-factor authentication are stored in our ESA cloud console, nor on other ESET servers.

MDR Services. If You use ESET MDR Services (ESET MDR and ESET MDR Ultimate), We conduct continuous monitoring, analysis, and utilization of Incident Data collected during the provision of the Services, as necessary to enhance the security of your environment, strengthen cybersecurity strategies, detect and counteract malicious activities, identify vulnerabilities, and continuously enhance security measures.  As part of MDR Services We perform actions required to investigate, confirm, contain, remediate, or otherwise mitigate security incidents within the Customer environment. We process Incident Data and Telemetry to provide the MDR Services. Depending on your settings, We may also process such data, together with Customer identification data, for Research purposes.

MDR Guided onboarding Service. As part of the guided onboarding process, We may process personal data that is displayed on screen during a walkthrough of the Application deployment process, shown by the Customer or its administrator, or provided as part of a reasonable verification procedure.

ESET Threat Intelligence

•Investigation Lab. If You choose to submit a sample via the sample submission feature in the ESET Threat Intelligence portal, it will be automatically processed within our automated sample processing and detection systems. The analysis output made available to You will contain results related to the sample's behavior.
 
The processing differs depending on the tier selected - Investigation Lab or Investigation Lab advanced:

oInvestigation Lab. We may retain and further analyze the submitted sample and related intelligence for Research. The sample will be marked as "do not share", and neither the full analysis report nor the full related information will be made available to other Customers. This may allow us to recognize the sample in later IoC or hash searches without disclosing the full report or related information to third parties.

oInvestigation Lab Advanced. We process the submitted sample to provide the requested analysis and delete the file after processing.

We operate the sample-processing systems used to test sample behavior, ensuring your data remains under our control and is not processed by third parties. For the avoidance of doubt, We do not make the full submitted file or the full analysis report available to other Customers solely because the file hash is later searched.

•Early Warning. If You decide to set up a YARA rule to utilize the Early Warning feature, for instance, for searching, and You include text strings that contain personal data, this data will be used to identify the relevant instances and therefore to provide You with our Early Warning feature. You may delete the rule at any time through the ESET Threat Intelligence portal.

ESET LiveAI. If You decide to use the ESET LiveAI, your query, along with relevant data from monitored endpoint devices and network information processed within our cloud-based Application(s), will be transmitted to our generative AI solution running on our private cloud in Azure or, where more critical, on our own LLM server. Only the essential data required to address your query will be shared with the AI solution, and it will be processed exclusively to deliver the requested Service. ESET manages the AI solution, ensuring that your data remains within our control and is not processed by third parties.

ESET LiveGuard Advanced. If You enable this feature, which may be available in your cloud-based or locally installed Applications and Services, any file identified as suspicious by our Application will be sent to ESET servers via ESET LiveGrid® Feedback System for automated analysis. If LiveGuard determines that the file is infected, our Application will initiate the cleaning action and delete the file. If the file is deemed clean, it will be executed normally. Analyzed files will be stored for the period You select in your settings, and logs related to the analysis will be available in your ESET PROTECT console. We will further process files detected by LiveGuard as infected as a data controller, in the same manner as We process suspicious or malicious samples within the ESET LiveGrid® Feedback System described above.

ESET Anti-theft. Within the ESET Anti-Theft Service, We process data related to the device, in particular data about the device's network location (latitude, longitude, altitude, and the time of the last connection) and the device configuration. We use this data exclusively to provide, operate, and support the Service, including locating the device and taking the requested security measures; in doing so, We do not identify the user of the device. We retain the data for the period during which the device or server is registered with the Service, and subsequently for an additional 30 days after its removal by You. When the device wipe function is used, the data is removed from the device locally by the operating system, and no further data is transferred from the device to the server.  Please note that ABM devices can be automatically re-enrolled to the Mobile Device Management following a device wipe.

ESET Cybersecurity Awareness Training. As part of this cybersecurity awareness training, You may use a phishing simulator solely to test your employees and other authorized End-Users internally in your organization, including testing their resilience to phishing campaigns. No communication shall be sent to third parties, including spam or other unlawful communication.  

Third-party warranty. Certain Subscription offerings may include, or be marketed together with, a cyber warranty, guarantee, or similar coverage ("Third-Party Warranty") provided solely by an independent third party ("Warranty Provider"). For this purpose, We will communicate to the Warranty Provider, which provides the Third-Party Warranty, your name, email address and the name of the company You work for. As soon as you purchase any offering that includes this Third-Party Warranty you are automatically enrolled to the warranty program as described in the Terms of Use.

Data Sharing

We may share your data with third parties as mentioned in this Privacy Policy, such as in case of a dispute, We may share Your data to courts, tribunals, law-enforcement authorities, regulators and other competent public authorities where this is necessary to comply with a legal obligation, establish, exercise or defend legal claims or protect our rights and legitimate interests. These recipients generally process personal data as independent controllers under applicable law. We operate globally through affiliated companies or partners as part of our sales, Service and support network. These companies may also act as our processors and subprocessors. Subscription, billing and technical support information processed by ESET may be transmitted to and from affiliates or partners for the purpose of fulfilling the Terms, such as providing Services or support. Moreover, for the purpose of performing some of our Services, such as Professional and Security Services, We may engage our trusted partners as subcontractors to carry out certain parts of these Services. We always have appropriate transfer mechanisms in place shall the respective affiliate or partner be seated in a third country or have access to personal data from a third country.

Subprocessing

We may engage third-party service providers, including affiliates and other subprocessors, to process personal data on our behalf and to support the provision, operation, maintenance and security of our services. These subprocessors may provide services such as hosting, cloud infrastructure, customer support, data storage, analytics and other technical or operational services.
 
We require our subprocessors to process personal data only on our documented instructions and only for the purposes for which We engage them. We also require them to implement appropriate technical and organizational measures to protect personal data and to comply with applicable data protection requirements. We remain responsible for the processing activities carried out by our subprocessors to the extent required by applicable law.

A current list of our subprocessors, including information about the services they provide and the relevant locations of processing where applicable, is available on our website. We may update this list from time to time, for example, when We appoint, replace or remove a subprocessor.

Transfer to Third Countries.

ESET prefers to process its data in the European Union (EU). However, depending on your location (use of our Applications and/or Services outside the EU/EEA) and/or the Service you choose, it may be necessary to transfer your data to a third country outside the EU/EEA. For example, We use third-party services in connection with cloud computing. In these cases, We carefully select our service providers and ensure an appropriate level of data protection through contractual as well as technical and organizational measures. In compliance with GDPR, We may transfer personal data to third countries only under specific conditions. We ensure that any such transfer is carried out in accordance with the GDPR's strict requirements, aiming to safeguard the rights and freedoms of individuals whose data is being transferred.

Before transferring any data outside the European Union (EU) or the European Economic Area (EEA), We assess the adequacy of the recipient country's data protection laws and consider implementing appropriate safeguards. We evaluate if the receiving country is a country for which the European Commission issued a decision that it provides an adequate level of personal data protection (such as the UK, Canada (commercial organizations), Argentina, Brazil, Japan, Switzerland or the USA (commercial organizations participating in the Data Privacy Framework)). If not, We rely on other appropriate transfer mechanisms such as Standard Contractual Clauses issued by the EU, binding corporate rules, recognized codes of conduct or certification mechanisms that demonstrate compliance with data protection requirements.

By taking these measures, We ensure that personal data transfers are secure, transparent, and in accordance with the GDPR's principles.

Data Security

ESET implements appropriate technical and organizational measures to ensure a level of security that corresponds to potential risks. These measures are detailed in our Security Policy and, where available, in individual security policies applicable to specific Applications, which can be found in the respective Applications' documentation.

Data Subject's Rights

The rights of every Data Subject matter and We would like to inform You that all Data Subjects (from any EU or any non-EU country) have the following rights guaranteed by ESET. To exercise your Data Subject's rights, You can contact us via the support form or by using our contact details below. For identification purposes, We ask You for the following information: Name, e-mail address and - if available - activation key or Customer number and company affiliation. Please refrain from sending us any other personal data, such as the date of birth. We would like to point out that to be able to process your request, as well as for identification purposes, We will process your personal data. Please note that in line with the GDPR, this section of the Privacy Policy is applicable only to Data Subjects; accordingly, all references to "You" in this section pertain to Data Subjects only. Please also note that if You are an employee or other authorized person of our Customer, You shall primarily contact your employer or the person who authorized You.

Right to Withdraw the Consent. Right to withdraw the consent is applicable in case of processing based on consent only. If We process your personal data on the basis of your consent, You have the right to withdraw the consent at any time without giving reasons. The withdrawal of your consent is only effective for the future and does not affect the legality of the data processed before the withdrawal.

Right to Object. Right to object the processing is applicable in case of processing based on the legitimate interest of ESET or third party. If We process your personal data to protect a legitimate interest, You have the right to object to the legitimate interest named by us and the processing of your personal data at any time. Your objection is only effective for the future and does not affect the lawfulness of the data processed before the objection. If We process your personal data for direct marketing purposes, it is not necessary to give reasons for your objection. This also applies to profiling, insofar as it is connected with such direct marketing. In all other cases, We ask You to briefly inform us about your complaints against the legitimate interest of ESET to process your personal data.

Please note that in some cases, despite your consent withdrawal or your objection processing, We may be entitled to process your personal data on the basis of another legal basis, for example, for the performance of a contract.

Right of Access. You have the right to obtain information about your data processed by ESET free of charge at any time.

Right to Rectification. If We inadvertently process incorrect personal data about You, You have the right to have this corrected.

Right to Erasure. You have the right to request the deletion or restriction of the processing of your personal data. If We process your personal data, for example, with your consent, You withdraw it and there is no other legal basis, for example, a contract, We delete your personal data immediately. Your personal data will also be deleted as soon as they are no longer required for the purposes stated for them at the end of our retention period.

Right to Restriction of Processing. If We use your personal data for the sole purpose of direct marketing and You have revoked your consent or objected to the underlying legitimate interest of ESET, We will restrict the processing of your personal data to the extent that We include your contact data in our internal blacklist in order to avoid unsolicited contact. Otherwise, your personal data will be deleted.

Please note that We may be required to store your data until the expiry of the retention obligations and periods issued by the legislator or supervisory authorities. Retention obligations and periods may also result from the Slovak legislation. Thereafter, the corresponding data will be routinely deleted.

Right to Data Portability. We are happy to provide You, as a Data Subject, with the personal data processed by ESET in the .xls format.

Right to Lodge a Complaint. As a Data Subject, You have a right to lodge a complaint with a supervisory authority at any time. ESET is subject to the regulation of Slovak laws, and We are bound by data protection legislation as part of the European Union. The relevant data supervisory authority is the Office for Personal Data Protection of the Slovak Republic, located at Námestie 1. Mája 18, 81106 Bratislava, Slovak Republic.

Our Contact Information

If You would like to exercise your right as a Data Subject or You have a question or concern, please contact us at:

ESET, spol. s r.o.
Data Protection Officer
Einsteinova 24
85101 Bratislava
Slovak Republic