This Privacy Policy (the “Policy”) between Breka Inc. and its affiliates (together, “us”, “we” and “our”) and you, the individual or company (“you”, “your” and “User”), governs your use of our website, accessible at https://www.breka.ai, and all pages, products, tools, information, protocols, software and content located there (the “Service”), and explains how we collect, use, disclose and protect your information.

1. Definitions

Unless otherwise defined in this Policy:

“Personal Data” means data about a living individual who can be identified from that data, or from that data and other information either in our possession or likely to come into our possession.
“Usage Data” means data collected automatically, either generated by the use of the Service or from the Service infrastructure itself, for example the duration of a page visit.
“Cookies” are small files stored on your device.
“Data Controller” means a natural or legal person who, alone or jointly with others, determines the purposes for which and the manner in which personal data are processed. For the purposes of this Policy, we are a Data Controller of the data described in Section 3.
“Data Processor” or “Service Provider” means a natural or legal person who processes data on behalf of a Data Controller.
“Client Data” means data contained in or obtained from the systems of a client of ours in the course of the security testing services we perform for that client, as described in Section 10.

2. Information collection and use

We collect several types of information for various purposes, in order to provide and improve the Service. We do not sell your Personal Data, and we do not use it for interest-based or cross-context behavioral advertising.

3. Types of data collected

Personal Data. While you use the Service we may ask you to provide information that can be used to contact or identify you. This may include your name, business address, phone number, email address, job title, employer, payment card number, purchase and ordering information, and any other information you choose to provide.

We may use your Personal Data to contact you with information that may be of interest to you. You may opt out of receiving any or all of these communications by emailing us at privacy@breka.ai.

Usage Data. We may collect information that your browser sends whenever you visit the Service. Usage Data may include your internet protocol address, browser type and version, the pages of the Service you visit, the time and date of your visit, the time spent on those pages, unique device identifiers and other diagnostic data.

Cookies. We may use Cookies and similar tracking technologies to track activity on the Service and hold certain information. Cookies are sent to your browser from a website and stored on your device. You can instruct your browser to refuse all Cookies or to indicate when a Cookie is being sent; if you do not accept Cookies, you may not be able to use some parts of the Service. We use session Cookies to operate the Service, preference Cookies to remember your preferences and settings, and security Cookies for security purposes. We do not use advertising Cookies.

4. Use of data

We use the data we collect:

to provide and maintain the Service;
to notify you about changes to the Service;
to provide customer support;
to gather analysis and information so that we can improve the Service;
to monitor the use of the Service;
to detect, prevent and address technical issues and security incidents;
to carry out our obligations and enforce our rights arising from any contract between you and us, including billing and collection;
to provide you with notices about your account or subscription, including expiry and renewal notices;
to provide you with news and general information about services we offer that are similar to those you have already purchased or enquired about, unless you have opted out;
to aggregate pseudonymized or anonymized information for statistical purposes; and
for any other purpose with your consent.

5. Consent

How we obtain your consent. When you provide us with Personal Data to complete a transaction, we imply your consent to our collecting it and using it for that purpose. If we ask for your Personal Data for a secondary purpose, we will either ask for your express consent or give you an opportunity to decline.

How you withdraw your consent. If you change your mind, you may withdraw your consent to our contacting you, or to the continued collection, use or disclosure of your information, at any time by emailing us at privacy@breka.ai.

6. Retention of data

We retain your Personal Data only for as long as is necessary for the purposes set out in this Policy. We retain and use your Personal Data to the extent necessary to comply with our legal obligations, resolve disputes and enforce our agreements and policies. We also retain Usage Data for internal analysis. Usage Data is generally retained for a shorter period, except where it is used to strengthen the security or improve the functionality of the Service, or where we are legally obliged to retain it for longer.

7. Transfer of data

Your information, including Personal Data, may be transferred to and maintained on computers located outside your state, province or country, where data protection laws may differ from those of your jurisdiction. We operate from Canada and the United States, and your information may be processed in either. Your consent to this Policy, followed by your submission of information, represents your agreement to that transfer.

We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Policy, and no transfer of your Personal Data will take place to an organization or a country unless adequate controls are in place.

8. Disclosure of data

We may disclose Personal Data that we collect or that you provide:

where required to do so by law or in response to a valid request by a public authority;
to our subsidiaries and affiliates;
to contractors, service providers and other third parties we use to support our business, who are bound to protect it;
if we are involved in a merger, acquisition or asset sale, in which case your Personal Data may be transferred;
to establish, exercise or defend our legal rights;
where we believe disclosure is necessary or appropriate to prevent physical or other harm or financial loss, or in connection with an investigation of suspected or actual illegal activity; or
with your consent, in any other case.

9. Security of data

The security of your data is important to us, but no method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security. We use technical and organizational measures appropriate to the types of Personal Data we hold and the risks associated with processing it. In the event of a data breach we will notify those affected, and any applicable regulator, as required by law.

10. Data we process for our clients

This Section describes data we handle in a different role from the rest of this Policy. When we perform security testing for a client under a master services agreement and an order form, we access systems the client has identified and authorized in writing. In the course of that testing we may encounter Client Data, which may include Personal Data relating to the client’s own users, customers or personnel.

In relation to Client Data we act as a Data Processor on the client’s instructions, not as a Data Controller. We access and use Client Data only as necessary to perform the testing and to prepare and support our report, we do not use it for any purpose of our own, we do not sell or share it, and we do not retain it for longer than is necessary to prepare and support that report.

The client’s own privacy notice, not this Policy, governs the collection and use of Client Data, and the client’s agreement with us governs our handling of it. Where the client is subject to a data protection or sectoral regime that requires a written data processing agreement or business associate agreement, we enter into one before testing begins.

If you are an individual whose data we may have encountered in this way, please direct your request to the client that operates the system. We will refer your request to that client and assist them in responding to it.

11. Your rights under the General Data Protection Regulation

If you are a resident of the European Union or the European Economic Area, you have certain data protection rights under the General Data Protection Regulation. We aim to take reasonable steps to allow you to correct, amend, delete or limit the use of your Personal Data. If you wish to know what Personal Data we hold about you, or want it removed from our systems, email us at privacy@breka.ai.

In certain circumstances you have the following rights:

the right to access, update or delete the information we hold about you;
the right of rectification, where that information is inaccurate or incomplete;
the right to object to our processing of your Personal Data;
the right to request that we restrict the processing of your Personal Data;
the right to be provided with a copy of your Personal Data in a structured, machine-readable and commonly used format; and
the right to withdraw your consent at any time where we rely on your consent to process your Personal Data.

We may ask you to verify your identity before responding to such a request, and we may not be able to provide the Service without some necessary data. You have the right to complain to a data protection authority about our collection and use of your Personal Data.

12. Your rights under Canadian privacy legislation

If you are in Canada, the Personal Information Protection and Electronic Documents Act and, where applicable, provincial privacy legislation govern our handling of your Personal Data. You have the right to access the Personal Data we hold about you, to ask us to correct it where it is inaccurate or incomplete, and to withdraw your consent to our continued collection, use or disclosure of it, subject to legal and contractual restrictions and reasonable notice.

To exercise these rights, email us at privacy@breka.ai. We will respond within the period required by applicable law. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada or to your provincial privacy commissioner.

13. Your rights under the California Online Privacy Protection Act

In accordance with the California Online Privacy Protection Act, we agree to the following:

you may visit our site anonymously;
our Privacy Policy link includes the word “Privacy” and can be found on the home page of our website;
you will be notified of any change to this Policy on this page; and
you are able to change your Personal Data by emailing us at privacy@breka.ai.

Do Not Track signals. We do not track Users across third party websites, and we do not serve interest-based advertising. Because we do not engage in the tracking that a Do Not Track signal is designed to prevent, our practices do not change when we receive one.

14. Your rights under the California Consumer Privacy Act

If you are a California resident, you are entitled to learn what Personal Data we collect about you, to ask us to delete it, and to direct us not to sell or share it. To exercise these rights you may ask us:

What Personal Data we hold about you. If you make this request, we will provide the categories of Personal Data we have collected about you, the categories of sources from which we collected it, the business or commercial purpose for collecting it, the categories of third parties with whom we share it, and the specific pieces of Personal Data we have collected. You may make this request up to two times in a rolling twelve (12) month period, and the information provided may be limited to the Personal Data we collected in the previous twelve (12) months.

To delete your Personal Data. If you make this request, we will delete the Personal Data we hold about you as of the date of your request and direct our service providers to do the same. In some cases deletion may be accomplished by de-identification. If you delete your Personal Data, you may not be able to use functions that require it.

To stop selling or sharing your Personal Data. We do not sell or share your Personal Data with any third party for any purpose. You are the owner of your Personal Data and may request disclosure or deletion at any time.

We will not discriminate against you for exercising any of these rights. To exercise them, email us at privacy@breka.ai.

15. Analytics

We may use third party service providers to monitor and analyze the use of the Service.

16. Payments

We may provide paid products or services through the Service. We use third party payment processors, and we do not store or collect your payment card details. That information is provided directly to our payment processors, whose use of your Personal Data is governed by their own privacy policies. Our payment processors adhere to the standards set by the PCI Data Security Standard as managed by the PCI Security Standards Council.

17. Links to other sites

The Service may contain links to other sites that we do not operate. If you click a third party link you will be directed to that third party’s site, and we strongly advise you to review the privacy policy of every site you visit. We have no control over, and assume no responsibility for, the content, privacy policies or practices of any third party site or service.

18. Children’s privacy

The Service is not intended for use by children under the age of 13. We do not knowingly collect Personal Data from children under 13. If you become aware that a child has provided us with Personal Data, please contact us. If we become aware that we have collected Personal Data from a child without verification of parental consent, we will take steps to remove that information from our servers.

19. Changes to this policy

We may update this Policy from time to time. We will notify you of any change by posting the new Policy on this page and updating the effective date at the top of it. Where the change is material, we will also notify you by email or by a prominent notice on the Service before the change takes effect. You are advised to review this Policy periodically. Changes to this Policy are effective when they are posted on this page.

20. Contact us

If you have any question about this Policy, or wish to exercise any right described in it, contact us at privacy@breka.ai, or by mail at 2810 N Church St STE 90457 Wilmington, DE 19802