I. Scope of Policy
This Nexus23 Labs Privacy and Information Security Policy applies to ipfilterX Software, and all of its contractors, representatives, agents, and resellers while they are working on behalf of ipfilterX (collectively “we” or “us”). ipfilterX Software is a data controller of personal data processed in accordance with this policy. This policy applies to the following situations and activities that we engage in:
This means situations in which you or the users of your device or computer (collectively “you”) visit a website that we own or operate including www.ipfilterX.com, or other websites under our direct control. This also includes circumstances where you download an ipfilterX product or program or use an ipfilterX service online, regardless of the site where you downloaded or use it, or who owns or operates that site. It also refers to interactions between your computer and us such as automatic updates, and our ipfilterX1, ipfilterX2, and ipfilterX3 and ipfilterX Addon features.
Sometimes we may appear at a “live” or in-person event such as a trade show or promotion. If we collect any personally identifiable information in such a case, this policy will apply.
This refers to data concerning ipfilterX employees if any. In general, human resources (HR) data is handled in a manner consistent with the provision of this policy, except that such data is never used or shared with anybody for any direct marketing purposes, and the provisions of this policy relating to in-product messaging do not apply.
This refers to information that is collected from prospective ipfilterX resellers at the time they apply to join the ipfilterX reseller program. Certain information may be collected regarding the reseller or its individual representative(s), including contact information such as telephone number and email address. Similar information may be obtained regarding sub-resellers, where applicable.
Other circumstances where you contact us.
This includes contact by email, by clicking the “Contact – Support” links on our website, through our media contact or news subscription services, by requesting online service or support or opening a support ticket, and any other time that you contact us.
When we refer to “personally identifiable information,” “personal data,” or “personal information,” we mean information that can identify you such as name, identification number, email address, phone number, or other information that refers specifically to you. We generally do not mean information that only refers to a business or organization but does not describe any specific individual. We also generally do not mean information that has been “anonymized,” or stripped of all identifiers that refer to you specifically.
II. Information We Collect When You Visit Our Website – Use of “cookies” and other similar technologies.
Stats – Analytics:
We use to gather info on visitors AwStats www.awstats.org/ AWStats, an advanced graphical web, ftp or mail statistics with a logfile analysis (For IIS, Apache,… distributed under GNU GPL), and WordPress Stats.
Info retrieved by usage of these services is not sold out to third parts in any form or method.
Our website offers news and information by subscription including newsletters, blogs, or others. If you decide to subscribe to these services you may be asked to provide your first and last name, email address, and country of residence. If you subscribe to our “Reports and Bloggers” email newsletter (for media professionals), you will be asked to provide your first and last name, email address, title, publication name, and country. The information you provide will be used to deliver the content that you request. We will never use this information for direct marketing purposes unless you agree on a case-by-case basis (also known as “opting in”). We may use the information you provide to help develop content that is relevant to our professional media audiences.
You are free to cancel your subscription(s) at any time by visiting www.ipfilterX.com/news-subscription.php?page=unsubscribe.
There are many opportunities to contact us via our website. There are links that allow you to reach us by email, by clicking Support link, by clicking our media contact or news subscription buttons, or by requesting online service or support.
The ipfilterX Forum is accessible from the “Community” pages or “Support” section of our website. Certain features require registration in order to participate.
If you decide to register, you will be asked to select a username, password, and physical location. Disclosing your physical location is optional. You will also be required to provide an email address for use in connection with ipfilterX Forum. You may allow other users to send you messages if you wish.
Once registered for ipfilterX Forum you may control your privacy settings by visiting your “Profile” page. You can modify your settings at any time. You can also view your past posts, usage stats, password settings, and user profile as seen by others. You have the option to provide additional information if you wish. You may provide personal text; disclose your birth date and age; identify your gender, ICQ number, messenger username, or website name and address; disclose your physical location; and select an avatar or personalized picture. Any information you provide here will be visible to other users. The following minimum items of information will be available to all users, regardless of your profile settings: your username, your total number of posts and posts per day, the date and time you registered, your local time, and the date and time of your last activity.
There may be times when we offer links to third-party sites such as Twitter, Facebook, or others.
Occasionally thumbnails and user profiles (including your primary photo) from these sites will be imported onto our “Community” pages, as is the case if you post a comment that is linked to your Facebook profile. Clicking on such a thumbnail or profile link will take you away from the ipfilterX website to a third-party site (for example, Twitter). By connecting from our website to any third-party site, you agree that we are not responsible for any loss or damage you may suffer as a result of your dealings with the third party, or your use of or reliance on any of that party’s content.
III. Information We Collect When You Download or Use our Blacklists, Request Service or Support, or Pay for Products and Services
Free product downloads generally.
You are not required to disclose any personal information in order to download ipfilterX Free Blacklists and Tools, and you are permitted to use these programs. Participation in ipfilterX IRC Community is purely voluntary.
Online Subscription registration: To register our products online, you are generally required to provide your email address and we shall give you a password. We use this information to validate our users and verify the number of current licenses in existence. We may also use it to verify that copies of our product are legitimate, and not counterfeit. We will not use this information for direct marketing purposes unless you “opt in” to receive such communications from us, except that we may notify you of similar products or services that we offer to the extent that we are permitted to do so by law. We may send you an email if your license expires to ask if you want to renew. We may also request additional information such as your name, demographic information, or other information. This information generally is not required, but you may provide it if you wish.
ipfilterX3 Account: In some cases, you may be permitted to register multiple ipfilterX products using a single registration and authentication system called ipfilterX3. If you choose to use ipfilterX3 Account you will be asked an email address. A password and an username will be provided to you by our Account Manager eMail contact. We may use this information for purposes of validating your license, providing support, delivering additional products and services, and enabling you to change your ipfilterX Account and/or product settings. In the future this information may also be connected with your registration for ipfilterX Forum and/or a Support Portal.
Other ipfilterX products: There may be other products (current or future) that require that we collect certain types of personal information in order to enable full product functionality. We will always inform you prior to collecting any such information, usually in the terms of service or end user license agreement (EULA) applicable to the product in question.
We reserve the right to store and use the information collected by the ipfilterX software and to share such information within the ipfilterX Group in order to improve the ipfilterX Group’s current and future products and services, to help the ipfilterX Group develop new products and services, and to better understand the behavior of ipfilterX users. We may publish or share that information with third parties that are not part of the ipfilterX Group, but we will only ever do so after removing our users’ personally identifiable information. Any reference in this policy to “ipfilterX Group” means ipfilterX, its parent companies and any company that is controlled by or under common control with ipfilterX or its parent companies.
When you use our services or request support.
We may at times collect personally identifiable information from you in the course of providing our services or support. This information may be collected from you verbally, from your computer, or via electronic communication (including communications between your computer and us, or other automated communications). If you request support we may offer you the option of accepting a remote session in which we take control of your device or computer; in such a case we may acquire information via communication between your computer and ours.
This information is collected to help us provide the service or support that you have requested.
We may at times request personal information such as email address, or other information by which we may identify you. This information is collected for identification purposes, and to confirm that transactions with you are legitimate and not with an imposter. We will not use this information for direct marketing purposes unless you “opt in” to receive such communications, except that we may notify you of similar products or services that we offer to the extent that we are permitted to do so by law. If you contact us for support, or initiate a transaction with us, we may suggest that you upgrade or update products or services. We may also contact you if your product license has expired or is about to expire.
In cases where you request individual support or assistance we may also ask you to provide information about your device or computer, your means of accessing the Internet, or your Internet service provider. This information may include, without limitation, your email address, IP address, information about your hardware and software, the URLs of sites you have visited, files stored on your computer (including potentially dangerous or infected files), email messages (whether stored on your computer or elsewhere), information regarding senders and receivers of email messages, and the like. This information is collected to help us to provide services and support, to identify and remove computer viruses, and to help us solve your technology problem(s). For purposes of this section we will use any such information only when providing individual support or assistance at your request, and will not retain such information any longer than necessary for this purpose. This information will not be stored in a way that identifies you personally in any record that we keep of your request for assistance.
The service provider may request billing information such as your name, home or work address, email address, telephone or mobile phone number(s), plus payment information including credit card number, expiration date, name of your issuing bank, and the like. The purpose of this information is to enable payment for products or services that you order. The third-party service provider may transmit some of your personal information to us, but not including payment information, unless you specifically agree (as may be the case in the event of a purchase with auto-renewal). We may use the information we receive (not including payment information) to verify your registration or license status, to contact you about the status of your account, or for renewal of your subscription, if applicable.
In all cases where your payment data is processed by a third-party service provider, we have determined that the service provider follows data privacy and security procedures that we deem adequate. Some of these third-party service providers are subject to the enhanced data privacy rules of the European Union. Others have registered for, and certified compliance with, the so-called “Safe Harbor” framework of the U.S. Department of Commerce for the handling of personal information. In all cases, such third-party service providers have executed agreements with us promising not to use personal information of our users for their own marketing purposes, and not to share this information with other parties.
IV. Special Types of Personal Information
In general, human resources (HR) data is handled in a manner consistent with this policy. However, such data is never used or shared with anybody for direct marketing purposes, and the provisions of this policy relating to in-product messaging and product downloads do not apply (except in the case where an employee uses our products in his or her personal capacity, in which case the employee’s information is subject to the same policies as any other user). In addition, HR data may be subject to different retention requirements than the data of our users; we store and maintain data in compliance with local law governing employment information. In the case of employees who have children we may collect and store the names of the children, their personal IDs and birthdates, copies of their birth certificates, scholastic status, and other information that relates to the taxation status of the employees. The purpose of collecting this information is to calculate the employees’ tax rates and to otherwise comply with the law.
We never collect “sensitive” personal data such as sexual preference, religion, political views, or health. We do not wish to receive any such data and will not request it from you.
Data on children.
Persons under the age of 18 should not transfer personal information to us unless they have the consent of their parent(s) or guardian(s). Except for children of ipfilterX employees, we do not knowingly collect, nor do we want to receive, personal information about individuals who are under 13 years of age.
V. Storage, Retention, and Deletion of Personal Information
Storage of information.
Information that we collect is stored on our servers or on the servers of our subsidiaries, affiliates, contractors, representatives, contractors, agents, or resellers who are working on our behalf. Personally identifiable information on our servers is only accessible from our physical premises, or via SSH2 – SSL Encryption. Access is limited to authorized personnel only, and company networks are password protected, and subject to additional policies and procedures for security.
Data collected by ipfilterX Backup is transmitted in encrypted format using SSL technology, and stored under minimum 256-bit key encryption. Information collected by ipfilterX is transmitted using SSL technology, and very private information such as financial data is stored under rotating 256-bit key encryption. Data transmitted using ipfilterX Subscription is also encrypted. In all cases data is transmitted to and from our servers using https protocol. In some cases this information may be transmitted to or stored within the European Union (“EU”), and in other cases the information may be transmitted to or stored at a location outside the territory of EU member states, such as the United States or other non-EU locations.
Access by our contractors.
Maintenance of personally identifiable information is performed either by us or by contractors who we hire, or by our subsidiaries, affiliates, representatives, agents, or resellers who are working on our behalf. All such third parties must agree to observe the privacy of our users, and to protect the confidentiality of their personal information. All have agreed not to share personal information of our users with other parties, and not to use such personal information for their own direct marketing purposes.
Deletion of personal information.
In general, our policy is to keep personal information for no longer than reasonably necessary in light of the purpose for which the information was collected, plus any additional period that is permitted or required by law thereafter. Following the expiration of the purpose for which we collected personal information plus any additional period that is permitted or required by law, we will either delete or de-identify the information from our systems.
If you subscribe to a recurring newsletter, we will keep the information in order to fulfill your subscription request until you cancel your subscription.
For products that are registered on a periodic basis (for example, a one-year license), we will keep your personal information for the duration of your product registration, and longer if you renew your license.
If you purchase a “premium” or paid service, we or our third-party service providers will retain payment information for as long as is necessary to complete payment, plus any period of time thereafter that is required or permitted by law.
If you participate in a giveaway or promotion that we offer, we will retain your data long enough to administer the promotion, plus any additional time that is permitted or required by law.
We strive to delete or de-identify inactive data as soon as is reasonably possible after the above time periods have passed. We attempt to take this action every 90 days unless we have a specific reason to delete data sooner — for example, if you contact us to request that your information be removed from our system. In the case of ipfilterX Forum, Support Portal, or ipfilterX news and blogs, your account is kept active until we shall delete it, but we reserve the right to remove you from our database and delete your credentials if you have not been active for an extended period of time.
VI. Information Security
Safeguards for protection of personal information.
We maintain administrative, technical, and physical safeguards for the protection of personal information. These safeguards include the following:
Administrative safeguards: Access to our personal data of users is limited to authorized personnel who have a legitimate need to know based on their job descriptions — for example, an administrator who provide technical support to end users, or who service user accounts. All such data is subject to password protection. In the case of third-party contractors who process personal information on our behalf, similar requirements are imposed. Where an individual employee no longer requires access, that individual’s credentials are revoked.
Technical safeguards: Personal information of users that is stored in our database using the protections described above in the section entitled “Storage of information.” In addition, we utilize up-to-date firewall protection for an additional layer of security. We utilize high-quality antivirus and anti-malware software, and regularly update virus definitions. Third parties who we hire to provide services and have access to our users’ data agree to implement privacy and security practices that we deem adequate.
Physical safeguards: Access to user information in our database by Internet is not permitted except using an encrypted connection. Otherwise access is limited to our physical premises; removal of personal data from our location is forbidden. Third-party contractors who process personal data on our behalf agree to provide reasonable physical safeguards.
Deletion of personal information.
By retaining personal information no longer than is reasonably necessary for the function for which we originally collected it, we effectively reduce the quantity of personal information that is in our possession at any given time. This, in turn, helps reduce the degree of risk associated with our maintenance and storage of personal information on the whole: the less data we store, and the shorter time we keep it, the smaller the risk of overall harm in the event a breach.
We also strive to collect no more personal information from users than is required by the purpose for which we collect it. This, in turn, helps reduce the total risk of harm should data loss or a breach in security occur: the less data we collect, the smaller the overall risk.
Notification in the event of breach.
In the unlikely event of a breach in the security of personal data, we will notify all users who are actually or potentially affected. The method of notice may be tailored to suit the facts of a particular case — for example, if the only contact information that we have for a particular user is an email address, then the notification will necessarily be by email. We may elect to give notice via the in-product messaging system described above. In an unusual case — for example, if we believe there are users for which we have no contact information on file — we may give notice via publication on our company website. In any case we reserve the right to delay notification is we are asked to do so by law enforcement or other authorities, or if we believe that giving notice immediately will increase the risk of harm to our user body overall.
VII. Compliance with Laws and Dispute Resolution
Residents of the EU.
For residents of the EU, the handling of personal information is subject to EU Directive 95/46/EC, also known as the EU Privacy Directive, as well as local law. We have registered with the Office for Personal Data Protection of the Czech Republic. Registration with this office governs our collection and handling of information from employees, visitors to our physical premises, and customers. Additional information on the Office for Personal Data Protection is available here: http://www.ceecprivacy.org/main.php or http://www.uoou.cz.
There may be occasions in which we transmit personal data collected from EU residents to a location outside of the EU, including potentially the United States. The personal data may be transmitted to locations that may have less protective personal data protection legislation than the country of your residency. We comply with all conditions required by law for transmission of personal data to such locations.
We are also subject to certain provisions of EU Directive 2002/58/EC (also known as the E-Privacy Directive) governing privacy in various types of electronic communications. Additional information is available here: http://europa.eu/legislation_summaries/information_society/legislative_framework/l24120_en.htm.
Residents of Switzerland.
The collection and handling of personal information of residents of Switzerland are governed by the Swiss Federal Act on Data Protection, also known as the Data Protection Act (“DPA”). There may be cases where personal data is collected from Swiss residents and subsequently transmitted to locations outside of Switzerland, such as the United States. Additional information on the Swiss DPA can be found here: http://www.dataprotection.eu/pmwiki/pmwiki.php?n=Main.CH.
Residents of the United States.
The collection and handling of personal information in the United States is subject to federal legislation, regulation by federal government agencies, and regulation on the state level. The federal agency with primary jurisdiction over our data handling practices is the Federal Trade Commission (“FTC”).
Sharing of information among ipfilterX entities in different jurisdictions.
Our data collection and data management practices do not vary by location. We follow the same minimum data security and data privacy procedures with respect to all personal data in our possession, regardless of the jurisdiction from which it was collected, and regardless of whether the data is transferred from one ipfilterX entity to another (for example, from ipfilterX Software to ipfilterX Labs, Inc.).
We make every effort to conduct our business in a fair and responsible manner. In the unlikely event of a disagreement or complaint about the way that your personal data is handled, the following procedures will apply.
For all users: informal dispute resolution:
If you have a disagreement with us relating to our handling of your personal information, we ask that you contact us to work it out. We are always happy to hear from you, and we promise to try our best to respond to any concerns you may have.
There are several ways you can reach us:
You can always reach us by email at email@example.com . Please type “PRIVACY REQUEST” in the message line of your email so we can have the appropriate member of the ipfilterX Team respond.
For residents of the European Union and Switzerland: If you live in the EU or Switzerland and you have a dispute regarding our handling of your personal data, you may contact the Data Protection Authority(ies) in your jurisdiction. Information on Data Protection Authorities in Europe can be found here: http://ec.europa.eu/justice/data-protection/bodies/authorities/eu/index_en.htm.
For residents of the United States: If you live in the U.S. and you have a dispute regarding our handling of your personal data, you may contact the FTC for information. See http://www.ftc.gov/bcp/index.shtml. You may also contact the attorney general of the state where you live.
Special note for residents of California.
Under California Civil Code § 1798.83, we are required to disclose to consumers the following information upon written request: (1) the categories of personal information that we have disclosed to third parties within the prior year, if that information was subsequently used for marketing purposes; and (2) the names and addresses of all such third parties to whom such the personal information was disclosed. We hereby disclose that we have not disclosed any such personal information regarding any California resident during the one-year period prior to the effective date of this Privacy and Information Security Policy. California residents seeking additional information on this requirement or our privacy practices in general may write to us at firstname.lastname@example.org with the headline “PRIVACY REQUEST” in the message line.
VIII. How to Request Changes to Your Personal Information
You may request information on the way your personally identifiable information is stored. In addition, you may also request changes to the information we have on file for you — this could be the case if you believe that some information we have about you is incorrect, or there is some information about you that has changed (for example, if you no longer use a former email address).
To request information or changes regarding your personally identifiable information that we have on file, please email email@example.com with the headline “PRIVACY REQUEST” in the message line.