Personal Data

Privacy Statement

Effective Date: 03.12.2025

Introduction

HarfangLab SAS is a Software Vendor that develops cybersecurity solutions aimed at preventing cyberattacks (the “Software”). The Software consists of software agents (the “Agents”), deployed within the client’s IT system. The agents communicate with a central manager (the “Manager”) who sends orders and stores the data reported by the Agents. Algorithms, rules and detection engines, integrated into the Software and updated by the Vendor, enable the Software to carry out actions to strengthen cybersecurity.

We understand that you are aware of and care about your own personal privacy interests, and we take that seriously. This Privacy Notice describes HarfangLab’s policies and practices regarding its collection and use of your personal data and sets forth your privacy rights. We recognize that information privacy is an ongoing responsibility, and so we will from time to time update this Privacy Notice as we undertake new personal data practices or adopt new privacy policies.

This Privacy Statement applies to personal data collected and/or used while acting in the capacity of a Data controller, as defined under the EU General Data Protection Regulation (GDPR) for the purposes and legal bases set out in further detail below

This Privacy Statement does not apply where the HarfangLab acts as a processor or service provider in relation to data submitted, managed, or processed by customers through or as part of the services (“Customer Data”). In such cases, customers act as data controllers and are responsible for providing their own disclosures regarding data subject rights and data use, in accordance with our Data Protection Agreement and applicable law.

Data Protection Officer

HarfangLab is headquartered in Tour Campus Cyber, 5-7 rue Bellini, 92800 Puteaux, in France. HarfangLab has appointed an internal data protection officer for you to contact if you have any questions or concerns about HarfangLab’s personal data policies or practices. If you would like to exercise your privacy rights, please direct your query to HarfangLab’s data protection officer. HarfangLab’s data protection officer’s  contact information are as follows:

HarfangLab SAS

Tour Campus Cyber, 5-7 rue Bellini, 92800 Puteaux

Dpo@HarfangLab.fr

What data do we collect

HarfangLab collects personal information about its website visitors, prospects, partners and customers. With a few exceptions, this information is generally limited to:

• Identification and professional contact data
• Technical and login data
• Financial and billing data
• Audio-visual and profile data linked to marketing activities
• Website browsing data
• Cookies and analytics data
• Contribution and feedback data

We do not sell personal information to anyone and only share it with third parties who are facilitating the delivery of our services as described in the section “Sharing with third parties”.

From time to time, HarfangLab receives personal information about individuals from third parties. Typically, information collected from third parties will include further details on your employer or industry. Where required, we will inform you in line with the conditions of Article 14 GDPR.

• Use of the HarfangLab Website

As is true of most other websites, HarfangLab’s website collects certain information automatically and stores it in log files. The information may include internet protocol (IP) addresses, the region or general location where your computer or device is accessing the internet, browser type, operating system and other usage information about the use of HarfangLab’s website, including a history of the pages you view. We use this information to help us design our site to better suit our users’ needs. We may also use your IP address to help diagnose problems with our server and to administer our website, analyze trends, track visitor movements, and gather broad demographic information that assists us in identifying visitor preferences.

In addition to that, HarfangLab has a legitimate interest in understanding how customers and potential customers use its website. This assists HarfangLab with providing more relevant products and services, , and with providing appropriate staffing to meet member and customer needs.

• Cookies and tracking technologies

HarfangLab makes available a comprehensive Cookie Policy that describes the cookies and tracking technologies used on HarfangLab website and provides information on how users can accept or reject them. To view the notice, just click here.

Non-essential cookies (advertising, personalization, analytics not strictly necessary) are only placed with your consent, which can be withdrawn at any time via our Cookie Consent Management Platform.

• Software

Personal data is collected through the use and operation of the Software, such as IP addresses, logins, and activity logs is collected and processed strictly on behalf of the customer. This data is considered Customer Data and is handled only in accordance with the customer’s instructions and the applicable Data Protection Agreement.

In addition to that, we collect data from your system environment, in order to provide, maintain, , and improve the Software and associated services (“Improvement of detection Processing”). This data refers to technical and operational information such as product versions, configuration, usage data, file-related metadata, and threat-related indicators. This data may include personal information such as IP addresses, credentials, identity data, but this data is used solely to ensure the performance, security, and development of the Software and associated services, and never for any other purpose. The content of files that may be processed through the Software is neither accessed nor analyzed for any purposes whatsoever once confirmed to be non-malicious.

How we collect your personal data

We collect your personal data in the following situations:

• Directly from you: participation in an event, communication with us, or otherwise interact with our teams.
• Through the use of our Software, certain data may be generated or collected automatically as part of your use of our Software (for example, credentials, IP address… etc), as described in the section “Software”
• Automatically during your browsing activities on our website: as described in sections “Use of the HarfangLab Website” and “Cookies and tracking technologies”
• From authorized third-party sources: such as business partners, service providers, or publicly available sources, in accordance with applicable law. When we obtain your personal data from such third parties, and within the limits of applicable law, we inform you within one month of collection, or earlier if the data is used to contact you.

How we use (process) your personal information

Personal data may be used to:

• operate and improve our website, including audience measurement and statistics;
• carry out commercial prospecting and send marketing communications, while respecting any request to stop receiving them;
• manage our relationships with prospects and customers, including maintaining an opposition list;
• issue and manage invoices and related billing activities;
• provide, maintain, and continuously improve our Software and associated services (“Improvement of detection Processing”) ;
• handle disputes, protect our rights, and respond to legal claims when necessary.

• fulfill any other purpose for which the data was provided, or any other lawful purpose with consent where required.

We process your personal data only when we have a valid legal basis under applicable law. These legal bases include:

• Consent; for example, when you agree to the use of your information, including receiving marketing communications.
• Contractual necessity, such as managing commercial relationship, providing access to the Software and related services, processing payments and billing, and performing all other actions that are required to enter into and fulfill our contractual obligations. Without this processing, we would not be able to provide the Software or deliver the services you have requested.
• Legitimate interests, such as promoting, developing, and improving our Software and services; protecting our rights; or establishing, exercising, and defending legal claims, provided that these interests are not outweighed by your own interests or fundamental rights and freedoms.
• Legal obligations: where processing is required to comply with laws and regulations, including tax and accounting requirements.

Some data is necessary to provide our Software and related services (e.g. identity, contact or billing details). If you do not provide it, we may not be able to deliver the requested services. Other data is optional and not providing it has no consequence.

We do not make decisions producing legal or similar significant effects solely by automated means, as referred to in Article 22 of the GDPR.

Data storage and retention

Your personal data is stored by HarfangLab on its servers, and on the servers of the cloud-based database management services HarfangLab engages, located in the European Union.

We store your personal data only for as long as necessary to achieve the purposes described in this Privacy Statement, and always in accordance with applicable legal obligations and our legitimate business interests. The applicable retention period depends on the legal basis for processing:

• Contract: where processing is necessary for the performance of a contract, we retain your personal data for the duration of the contractual relationship and for an additional period required to comply with legal obligations or to cover potential limitation periods for legal claims (g : 5 years after the end of the contract, 10 years for invoices)
• Legitimate interests: where processing is based on our legitimate interests, data is retained for a period that is appropriate to the specific purpose, while taking into account your fundamental rights and freedoms ( 12 months for logs, 6 months for files that triggered alerts, 5 years for other data collected on this basis).
• Consent: where processing relies on your consent, data is retained until you withdraw your consent or until the purpose for which the consent was given has been fulfilled (3 years after last contact).
• Legal obligation: where processing is required by law, data is retained for the period necessary to meet that obligation.
• Legal claims: in situations where there is a risk of legal dispute, we may apply a “legal hold” and retain data beyond our standard retention periods until the dispute is resolved.

All personal data that HarfangLab controls may be deleted upon verified request from you or your authorized agents. For more information on where and how long your personal data is stored, and for more information on your rights of erasure and portability, please contact us at: dpo@HarfangLab.fr

Sharing information with third parties

As stated above, the personal information HarfangLab collects from you is stored in one or more databases hosted by third parties located in the European Union. These third parties do not use or have access to your personal information for any purpose other than cloud storage and retrieval.

Otherwise, HarfangLab may communicate your Personal Data to authorized recipients subject to an appropriate obligation of confidentiality, who may be internal or external as appropriate:

Internal Recipients are all members of HarfangLab staff whose duties, functions and tasks justify their processing of the Personal Data of Data Subjects solely for the purposes set out in this Privacy Policy and within the framework of the technical and organizational measures implemented by HarfangLab to preserve the confidentiality and security of the Personal Data detailed below;

External Recipients are :

• Any service providers or subcontractors that HarfangLab may use to manage relations with you or your employer (e.g. hosting company);
• Entities responsible for HarfangLab’s advice, audit and financial control (statutory auditor, lawyer);
• Administrative or judicial authorities within the scope of their powers or any person authorized to fulfil a legal obligation to which Harfang is subject;
• In the event of the sale of a HarfangLab activity or assets by any means whatsoever, including the sale of the company carrying out this activity or owning these assets or the sale of its shares, the potential buyer(s) and their advisors as part of the audit preceding the transaction;
• In the event of an acquisition by a third party, your Personal Data may form part of the transferred assets and as such will be processed by the acquirer who will act as the new Data Controller under its own privacy policy.

We do not disclose your personal data to third parties for their independent use unless: (1) you request or authorize it; (2) it’s in connection with HarfangLab-hosted and HarfangLab co-sponsored events; (3) the information is provided to comply with the law (for example, compelled by law enforcement to comply with a search warrant, subpoena, or court order), enforce an agreement we have with you, or to protect our rights, property or safety, or the rights, property or safety of our employees or others; (4) the information is provided to our distributors and partners or service providers who perform functions on our behalf; (5) to address emergencies ; or (6) to address disputes, claims, or to persons demonstrating legal authority to act on your behalf. We may also gather aggregated data about our services and website visitors and disclose the results of such aggregated (but not personally identifiable) information to our partners, service providers, advertisers, and/or other third parties for marketing or promotional purposes.

The HarfangLab website connects with third party services such as Youtube, LinkedIn, X and others. If you choose to share information from the HarfangLab website through these services, you should review the privacy policy of that service. If you are a member of a third party service, the aforementioned connections may allow that service to connect your visit to our site to your personal data.

Transferring personal data outside the European union

In principle, we do not transfer data outside of the E.U.

However, if we were to transfer your personal data to countries located outside the European Union (EU), such transfers would only occur where necessary for the purposes described in this Privacy Statement.

In such a case, we would ensure that appropriate safeguards are implemented to protect your personal data in accordance with applicable data protection laws. These safeguards could include relying on adequacy decisions adopted by the European Commission, entering into standard contractual clauses approved by the competent authorities, or using other lawful transfer mechanisms.

Further information on the safeguards that would apply to international data transfers, and a copy of such safeguards where relevant, may be obtained by contacting us at the details provided below.

Data Subject rights

The European Union’s General Data Protection Regulation (GDPR) and other countries’ privacy laws provide certain rights for you. Your rights under GDPR include the following:

• The right to request confirmation that data relating to you is being processed, to obtain information on the characteristics of such Processing, as well as on the identity of the recipients of your data where applicable, to access such data and to request a copy thereof (right of access and copy);
• The right to rectify or add to any data concerning you that is inaccurate or obsolete (right of rectification);
• The right to withdraw your consent at any time provided that the Processing concerned is based exclusively on this legal basis (right to withdraw consent), where applicable; where processing relies on your consent, you may withdraw it at any time, without affecting the lawfulness of processing before withdrawal (e.g. via unsubscribe links or cookie settings).
• The right to object to the Processing of your Personal Data on legitimate grounds and to obtain its erasure, unless the Processing is justified on compelling legitimate grounds (right to object on legitimate grounds and right to erasure); you may object at any time to processing based on our legitimate interests, including direct marketing
• The right to have the Processing limited temporarily in the event of a request for rectification or objection while the request is being analysed, which in practice means that the Personal Data is retained but not processed (right to restrict);
• The right to erase your Personal Data, as soon as possible, by the Data Controller, except in the following cases: archival purposes in the public interest, scientific or historical research or statistical purposes, performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller;
• The right to the portability of Personal Data, i.e. a right to obtain the return of the Personal Data you have communicated in a commonly used format where the Processing is automated and based on consent or on the performance of a contract, where applicable;
• The right to formulate directives relating to the Processing of your Personal Data after their death and to request the retention, erasure or communication of such data to an expressly designated third party (post-mortem right).

This Privacy Notice is intended to provide you with information about what personal data HarfangLab collects about you and how it is used. If you wish to confirm that HarfangLab is processing your personal data, or to have access to the personal data HarfangLab may have about you, please contact us at dpo@HarfangLab.fr

You may also request information about: the purpose of the processing; the categories of personal data concerned; who else outside HarfangLab might have received the data from HarfangLab ; what the source of the information was (if you didn’t provide it directly to HarfangLab); and how long it will be stored. You have a right to correct (rectify) the record of your personal data maintained by HarfangLab if it is inaccurate. You may request that HarfangLab erase that data or cease processing it, subject to certain exceptions. You may also request that HarfangLab cease using your data for direct marketing purposes. In many countries, you have a right to lodge a complaint with the appropriate data protection authority if you have concerns about how Harfanglab processes your personal data. When technically feasible, HarfangLab will – at your request – provide your personal data to you.

Reasonable access to your personal data will be provided at no cost. If access cannot be provided within a reasonable time frame, HarfangLab will provide you with a date when the information will be provided. If for some reason access is denied, HarfangLab will provide an explanation as to why access has been denied.

For questions or complaints concerning the processing of your personal data, you can email us at dpo@HarfangLab.fr. Alternatively, if you are located in the European Union, you can also have recourse to the CNIL or with your Member states’ data protection authority.

Security

HarfangLab implements the technical and organisational security measures it deems appropriate to preserve the confidentiality and security of the Personal Data it processes and to prevent its unauthorised destruction, loss, alteration or disclosure. By way of example, the following measures have been implemented by HarfangLab and are documented in the Information System Security Assurance Plan:

• Hosting of Personal Data on servers located within the European Union on the territory of a Member State;
• Raising employee awareness, in particular through a Charter on the use of the company’s data and IT resources;
• Authentication systems for users of HarfangLab’s information system, with personal and secure access via strong, confidential and frequently changed identifiers and passwords;
• Authorization management procedure (definition and review of authorization profiles according to employee profiles, removal of obsolete access);
• Access tracking systems, connection logging, incident management and, where applicable, encryption of certain Personal Data;
• Regular internal audits and, where appropriate, differentiated penetration tests to monitor and evaluate the effectiveness of the security measures in place;
• Physical security of premises (codes, keys and access badges) and workstations (automatic session locking, antivirus and firewall).

When HarfangLab resorts to subprocessors, i.e. service providers to whom it has delegated all or part of a Processing and who process your Personal Data in accordance with its instructions, HarfangLab undertakes to contractually impose on them security guarantees similar to those it implements to protect their Personal Data and reserves the right to audit them in order to ensure compliance with their obligations. In the event of a Data Breach, HarfangLab undertakes to notify the CNIL under the conditions prescribed by the RGPD and, if the said breach poses a high risk to your rights and freedoms, to notify you and, where appropriate, to provide you with the necessary information and recommendations, in accordance with the conditions laid down by the RGPD.

Children’s data

We do not knowingly attempt to solicit or receive information from children.

Questions, concerns or complaints

You may direct any questions or complaints regarding this policy to HarfangLab or make any recommendations or comments regarding this policy in writing to the following address:

By post: HarfangLab, Question RGPD, Tour Campus Cyber, 5-7 rue Bellini, 92800 Puteaux.

By email: dpo@HarfangLab.fr.

We respond to requests within one month, extendable by up to two additional months in case of complexity or volume.

You may also ask the CNIL any question or lodge a complaint with the CNIL at the following address: CNIL Complaints Department, 3 place de Fontenoy – TSA 80751, 75334 Paris Cedex 07 or by telephone on 01.53.73.22.22 or online by clicking on the following link: https://www.cnil.fr/fr/plainte.

Processing Summary Table

Note: This table reflects processing as controller. Customer Data processed on behalf of customers (via the Software) is out of scope.

HARFANGLAB GDPR Cookie Policy

Effective Date: 31.10.2025

1. Application

This policy applies to all employees, contractors, and vendors while doing business with HarfangLab and others such as visitors of our website who have access to European Union (EU) and the European Economic Area (EEA) data subject information (“personal data”) in connection with HarfangLab’s operating activities.

2. Policy

HarfangLab believes in transparency about collection and use of data. This policy supplements the Privacy Policy and provides information about how and when HarfangLab uses cookies for these purposes. Capitalized terms used in this policy but not defined have the meaning set forth in our Privacy Policy, which also includes additional details about the collection and use of information at HarfangLab.

What is a cookie?

Cookies are small text files sent by us to your computer or mobile device, which enable HarfangLab’s website features and functionality. They are unique to your account or your browser. Session-based cookies last only while your browser is open and are automatically deleted when you close your browser. Persistent cookies last until you or your browser delete them or until they expire.

Does HarfangLab use cookies?

Yes. HarfangLab uses cookies and similar technologies like single-pixel gifs and web beacons. HarfangLab uses both session-based and persistent cookies. HarfangLab sets and accesses cookies on the domains operated by HarfangLab and its corporate affiliates (collectively, the “Sites”). In addition, HarfangLab uses third party cookies, like Google Analytics.

How is HarfangLab using cookies?

Some cookies are associated with your account and personal information to remember that you are logged in and which workspaces you are logged into. Other cookies are not tied to your account but are unique and allow us to carry out analytics and customization, among other similar things.

Cookies can be used to recognize you when you visit our website, remember your preferences, and give you a personalized experience that is consistent with your settings. Cookies also make your interactions faster and more secure. Visit our Cookie Table in Appendix 1 to learn more.

Categories of use

• Authentication: If you’re signed into the services, cookies help HarfangLab show you the right information and personalize your experience.
• Security: HarfangLab uses cookies to enable and support security features, and to help detect malicious activity.
• Preferences, features, and services: Cookies denote which language you prefer and what your communications preferences are. They can help fill out forms on our Sites more easily. They also provide you with features, insights, and customized content.
• Advertising: HarfangLab may use cookies to help deliver marketing campaigns and track their performance (e.g., a user visited HarfangLab.com and then made a purchase). Similarly, HarfangLab’s partners may use cookies to provide us with information about your interactions with their services, but use of those third-party cookies would be subject to the service provider’s policies.
• Performance, Analytics, and Research: Cookies help HarfangLab learn how well the Sites and services perform. HarfangLab also uses cookies to understand, improve, and research products, features, and services, including to create logs and record when you access our Sites and services from different devices, such as your work computer or your mobile device.

What third-party cookies does HarfangLab use?

You can find a list of the third-party cookies that HarfangLab uses on our sites along with other relevant information in the Cookie Table in Appendix 1. HarfangLab does its best to keep this table updated, but please note that the number and names of cookies, pixels, and other technologies may change from time to time.

How are cookies used for advertising purposes?

Cookies and other ad technology such as beacons, pixels, and tags help HarfangLab market more effectively to users that may be interested in the services. They also help with aggregated auditing, research, and reporting.

What can you do if you don’t want cookies to be set or want them to be removed?

You have the option to disable and delete cookies that may not be necessary for the basic functionality of our website. Please note, blocking categories may impact your experience on our website. You may access the Cookie Manager at any time in the footer of our website.

Does HarfangLab respond to Do Not Track Signals?

The Sites and services do not collect personal information about your online activities over time and across third-party websites or online services. Therefore, “do not track” signals transmitted from web browsers do not apply to the Sites or services, and HarfangLab does not alter any data collection and use practices upon receipt of such a signal.

How To Control and Delete Cookies                                                                                           

1. Using Your Browser

Many of the cookies used on our website and through emails can be enabled or disabled through our consent tool or by disabling the cookies through your browser. To disable cookies through your browser, follow the instructions usually located within the “Help,” “Tools” or “Edit” menus in your browser. Please note that disabling a cookie or category of cookies does not delete the cookie from your browser unless manually completed through your browser function.

2. Cookies Set in the Past

Collection of your data from our analytics cookies can be deleted. If cookies are deleted, the information collected prior to the preference change may still be used.  However, we will stop using the disabled cookie to collect any further information from your user experience. For our marketing cookie, when a user opts out of tracking, a new cookie is placed to prevent users from being tracked.

Appendix 1: Cookie Tables Sample

• Strictly Necessary Cookies

These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but that will cause some parts of the site to not work. These cookies do not store any personally identifiable information.

• Functional and Performance Cookies

These cookies are used to enhance the performance and functionality of our website but are non-essential to their use. However, without these cookies, certain functionality may become unavailable.

• Analytics Cookies

These cookies (HarfangLab uses Google Analytics) allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. If you do not allow these cookies we will not know when you have visited our site and will not be able to monitor its performance.

To view an overview of the privacy of your Google Analytics cookies please go here: https://support.google.com/analytics/answer/6004245.

You may install a Google Analytics opt-out browser add-on by going here: https://tools.google.com/dlpage/gaoptout?hl=en-GB.

• Advertising Cookies

We also use a marketing database management program (NextRoll/Adroll) that deploys a cookie when a user interacts with marketing communications, such as a marketing email or a marketing-based landing page on our website. This cookie collects personal information such as your name, which pages you visit on our website, how you arrived at our website, and your purchases from HarfangLab. Collected information is used to evaluate the effectiveness of our marketing campaigns or to provide better targeting for marketing. From time to time, cookies set by third parties find their way into this “Advertising” category, but HarfangLab does not always have control over those cookies and does not share personal data with those third parties.

Third Party Website Cookies

When using our website, you may be directed to other websites for such activities as surveys, to make payment, for job applications, and to view content hosted on those sites such as an embedded video or news article. These websites may use their own cookies. We do not have control over the placement of cookies by other websites you visit, even if you are directed to them from our website.