Lupasafe Privacy Policy v1.5

Last updated: 25 September 2026. Version 1.5 aligns the retention periods with the confirmed model, updates the roles, subprocessors and security frameworks, and processes the comments from the legal review.

Version history

• v1.5 (current, 25-09-2026, Dutch) - this page

• v1.4 (10-09-2026, English) - lupasafe.com/legal/lupasafe_privacy_statement.html

• v1.2 (November 2024, PDF) - Privacystatement_Lupasafe_v.1.2.pdf

Summary

At Lupasafe your digital safety comes first, and we collect and process personal data in a responsible way. We value your privacy. In this privacy policy we want to make clear for which purposes and in which way we process data, and which rights apply.

This privacy policy describes how Lupasafe processes personal data. Lupasafe provides its service to business customers, directly or through an IT partner (MSP). In that relationship the customer is the controller, any MSP acts as a processor, and Lupasafe processes the data as a (sub)processor solely on the instructions of the customer. The arrangements about this are set out in the data processing agreement. Employees of a customer can gain access through their employer; the employer determines that access.

Purpose of the data processing

Lupasafe gives organisations insight into their cyber risks through dark web monitoring, vulnerability and email scans, phishing simulations, security awareness training, endpoint and Microsoft 365 audits, and compliance reporting. We make sure that your personal data is treated confidentially and processed in accordance with the General Data Protection Regulation (GDPR). Your personal data may be processed for the following purposes:

1. Concluding and performing an agreement

2. Providing services, products and information

3. Invoicing paid services or products

4. Sending user information, service notifications and other non-commercial messages

5. Meeting legal and regulatory obligations, including audits

Compliance with the GDPR

Lupasafe is committed to compliance with the GDPR. We collect only the necessary data and process it carefully, and we offer data subjects the rights they have under the GDPR, including the right of access, rectification and erasure. Your personal data is processed on the basis of your consent or, where applicable, legitimate interests. Our privacy practice is aimed at protecting your data, and we continuously update our security measures. Personal data and customer data are stored and processed within the EU in Microsoft Azure (Amsterdam, the Netherlands). Technical scan and test data are processed on OVHcloud (EU).

Collection of data

• Customers: When doing business we collect the necessary personal data of customers, representatives, contact persons and employees, including email addresses, business telephone numbers and company addresses.

• User of the Lupasafe platform: The required data includes:

• Name

• Email address

• IP address

• Relevant tags from Microsoft Entra ID, including the office location

• Based on phishing and awareness results we compile an awareness profile for each employee.

If Lupasafe software is installed, additional data may be processed based on its use.

Third party authentication and data sharing

Integration with Google Workspace and Microsoft Entra ID

Lupasafe integrates with Google Workspace and Microsoft Entra ID (formerly Azure AD) to provide seamless authentication and user management. When you connect your account, we collect the following information:

• Email address

• First name

• Last name

Purpose of the data collection

This data is used solely to:

• Authenticate users and give access to the Lupasafe platform

• Create user lists for cybersecurity awareness training

• Display user information in your organisation's dashboard

• Enable communication about cyber risks and service updates

Sharing and disclosure of data

We do not sell user data to third parties.

We do not use this data for advertising or marketing purposes outside our own services.

Your data may be accessed by or shared with:

• Microsoft Azure (Amsterdam, the Netherlands): Our hosting provider, where your data is stored and processed securely with ISO and NEN certifications

• Authorised Lupasafe employees: Solely for service delivery, technical support and security monitoring

We do not transfer your data to other third parties, except where this is required by law or on the basis of legal obligations.

Compliance with the Google API Services User Data Policy

Our use of information received through Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

Access to your data

Only authorised Lupasafe employees have access to your personal data, and your employer has access to the dashboard for insight into cyber risks. Contact your employer to find out who has access to the dashboard.

Protection against unauthorised access

Lupasafe takes technical and organisational measures to prevent unauthorised access, copying, modification, loss or disclosure of personal data. All interactions between endpoints and the Lupasafe servers are logged and monitored.

Retention periods

Retention and deletion. During the contract Lupasafe keeps your data for as long as the contract runs; audit logs are automatically deleted after approximately 3 months and invoicing data is kept for 7 years (statutory retention obligation). At your request we delete data within 30 days. On termination we delete customer data from the live production environment within 30 days (from the portal within approximately 1 day) and fully from the encrypted backups within 2 months at the latest. Backups are located within the EU (Microsoft Azure). On request you receive a written deletion confirmation.

Legal bases for the data processing

Data is processed on the basis of three GDPR legal bases:

1. Performance of the agreement: Necessary data, such as name and payment details, for service delivery and invoicing.

2. Legitimate interest: To inform customers if their usernames or passwords are publicly available after data breaches.

3. Consent: For processing for which you give us explicit consent, for example analytics and tracking cookies. You can withdraw your consent at any time.

Suppliers

We set high requirements for our suppliers, who process data solely on our instructions. Relevant suppliers include:

• Microsoft Azure (Amsterdam): hosting, ISO 27001 and SOC 2.

• OVHcloud (EU): scan and test environment.

• Have I Been Pwned (Australia): checking for leaked email addresses, with an SCC safeguard.

The current list of subprocessors is set out in the data processing agreement.

Exercising your privacy rights

You can contact us by email, telephone or post to exercise your rights:

• Access

• Rectification

• Erasure

• Restriction

• Data portability

Cookies

Lupasafe uses technical and functional cookies for the operation of the website and for ease of use. Our cookies are essential for the functioning of the website and are intended to improve your experience by remembering settings and optimising our content. For analytics and tracking cookies (including HubSpot and Google) we ask for your consent in advance (opt-in); you can refuse these or withdraw your consent later. Functional cookies are necessary for the operation of the website.

Data protection

Lupasafe follows strict protocols to protect your data, such as encryption and access control. Our security framework aligns with:

• NIS2 cybersecurity law

• ISO 27001

• Cyber Essentials Standard

Data breaches

In the event of a (suspected) data breach we inform the customer concerned (the controller) without delay. Where the law requires this, we report to the Dutch Data Protection Authority within 72 hours. We cooperate in the investigation and in limiting the consequences.

Data processing outside the EU

Lupasafe processes data within the EU. One processing activity takes place outside the EU: email addresses are checked against Have I Been Pwned (Australia) to detect data breaches. This transfer is covered by the EU Standard Contractual Clauses (SCC).

Closing note

We may update this privacy policy. The most recent version is available on our website. If you have questions or complaints, please contact us at support@lupasafe.com. You also have the right to lodge a complaint with the privacy supervisory authority. In the Netherlands this is the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).

For further questions:

Visiting address: Boylestraat 28, 6718 XM Ede, the Netherlands

Postal address: Grebbeweg 19B, 3902 HG Veenendaal, the Netherlands

Contact: info@lupasafe.com, +31 85 200 5579

Data Protection Officer: mr. F. Ebbers, dataprotection@lupasafe.com