1. Information We Collect
To operate continuous cybersecurity GRC auditing, our micro-agents collect specific system parameters systematically:
- Personal Data:
Corporate registration names, corporate emails, job titles, and federated directory identities.
- Usage Data:
Workspace navigation clicks, diagnostic run parameters, audit compilation histories, and configuration logs.
- Technical Data:
Infrastructure control plane telemetry, IP addresses, cryptographic agent hashes, and API query profiles.
2. How We Use Your Information
We utilize your metadata exclusively to execute real-time autonomous audits, manage sandboxed self-healing scripts, verify framework alignments, and deliver security-standing briefings.
3. Legal Basis for Processing
Our data processing operations stand on explicit legal foundations: the performance of your enterprise contract, compliance with sovereign ISO obligations, and protecting vital cybersecurity infrastructure resilience.
4. Data Sharing & Third Parties
We never monetize, rent, or lease your corporate metrics. Telemetry is shared strictly with verified cloud infrastructure providers (such as AWS and Microsoft Azure) to execute federated GRC queries securely.
5. International Data Transfers
We fully guarantee on-soil data sovereignty. Under Saudi Arabia's PDPL or EU GDPR mandates, all compliance audit databases remain permanently housed within their native sovereign boundaries without foreign transfer.
6. Data Retention
System logging metrics are retained systematically for an audit-compliant window of 12 months, after which they undergo absolute deletion unless regulatory mandates require extended legal preservation.
7. Your Sovereign Rights
Conforming to modern privacy laws, you maintain absolute rights to request access, rectification, complete erasure, data portability, and formal processing objections. Address requests to our GRC console.
8. Security Measures
Our platform runs exclusively on zero-trust architecture. All sensitive variables and query logs are locked with AES-256 and TLS 1.3 encryption at every transport and storage layer.
9. Children's Privacy
Our autonomous automation platform is designed exclusively for enterprise cybersecurity developers and GRC managers; we do not intentionally monitor or collect any metrics from children under 18.
10. Changes to This Policy
We reserve the right to systematically modify this Privacy Policy as sovereign regulations evolve. Significant updates are broadcasted directly via our GRC system console.
11. Contact Our Data Protection Officer
For formal inquiries, data deletion requests, or regulatory audits, contact our global Data Protection Officer directly at dpo@zelartrust.com.
