12-01-2024 , 11:00 PM
https://www.kaspersky.com/products-and-s...acy-policy KASPERSKY – PRODUCTS AND SERVICES PRIVACY POLICY
Introduction
AO Kaspersky Lab, located at bldg. 3, 39A, Leningradskoe Shosse, Moscow, 125212, Russian Federation and all companies belonging to the group "Kaspersky" respect your privacy. Our representative in the EU for data protection is: Kaspersky Labs GmbH, Despag-Strasse 3, 85055, Ingolstadt, Germany, info@kaspersky.de, +49 (0) 841 98 18 90, according to Article 27 (1) of Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR"). Our Data Protection Officer in the EU, according to Article 37 (1) of GDPR, as well as for the other countries, may be contacted via dpo@kaspersky.com.
This Products and Services Privacy Policy (Privacy Policy) describes how we use the information you provide when you use our products and services, and the choices you can make about our use of the information. We also describe the measures we take to protect the information and how you can contact us about our privacy practices.
In connection with specific products or services offered by Kaspersky, you are provided with the agreements, terms of use, and statements that supplement this policy relating to data handling.
This policy may be changed because of changes in legislation, the requirements of the authorities or to reflect changes in our practices concerning the processing of personal data. The revised policy will be posted on our website and will be effective immediately upon being posted. You can read at any time the policy currently in effect on our website: https://www.kaspersky.com/products-and-s...acy-policy.
This version of the policy is effective as of February 28, 2022.
The Sources of Information
Kaspersky may obtain information about you from various sources, namely:
products and services;
by your signing up for a Kaspersky products or services;
in response to technical support or other communication in order to ensure the required performance of products and services;
on our websites;
in response to marketing or other communications;
through participation in an offer, program or promotion.
If you provide us with any information or material relating to another individual, you should make sure that this sharing with us and our further use as described to you from time to time are in line with applicable laws; thus, for example, you should duly inform that individual about the processing of her/his personal data and obtain her/his consent, as may be necessary under applicable laws.
You may also choose to consent to third parties disclosing information about you to us that those third parties have received.
Information Provided by Users and How We Use Information
Personal data processing by Kaspersky is always carried out in a legal and fair manner.
You will always know what kind of information you provide to Kaspersky before you start to use the products and services. The data which you provide depends on the services, products, and features you use. For more information about data you provide, please refer to End User License Agreement, Kaspersky Security Network Statement and other documentation of product and services that you use, especially:
FOR HOME USERS (B2C):
SECTION "B" OF THE EULA, WHICH DESCRIBES THE DATA THAT NEED TO BE PROCESSED IN ORDER TO PERFORM OBLIGATIONS UNDER THE CONTRACT;
KASPERSKY SECURITY NETWORK STATEMENT, WHICH DESCRIBES THE DATA THE PROCESSING OF WHICH MAY INCREASE THE REACTION SPEED OF PRODUCTS AND SERVICES IN THE EVENT OF THREATS TO INFORMATION SECURITY;
MARKETING STATEMENT, WHICH DESCRIBES THE DATA THE PROCESSING OF WHICH MAY IMPROVE THE PERFORMANCE OF PRODUCTS AND WILL ENABLE AN ASSESSMENT OF USER SATISFACTION REGARDING PRODUCT USE;
SEPARATE STATEMENTS RELATING TO SPECIFIC PRODUCT FEATURES, WHICH DESCRIBE THE DATA PROCESSED DURING THEIR USE, FOR EXAMPLE, ANTI-SPAM STATEMENT, PURCHASE STATEMENT, WEB-PORTAL STATEMENT, AND TECHNICAL SUPPORT STATEMENT. YOU CAN FAMILIARIZE YOURSELF WITH SUCH STATEMENTS WHEN YOU TURN ON THE FEATURES IN THE PRODUCT.
FOR BUSINESS USERS (B2B):
SECTION "CONDITIONS REGARDING DATA PROCESSING" OF THE EULA, WHICH DESCRIBES THE DATA THAT NEED TO BE PROCESSED IN ORDER TO PERFORM OBLIGATIONS UNDER THE CONTRACT;
KASPERSKY SECURITY NETWORK STATEMENT, WHICH DESCRIBES THE DATA THE PROCESSING OF WHICH MAY INCREASE THE REACTION SPEED OF PRODUCTS AND SERVICES IN THE EVENT OF THREATS TO INFORMATION SECURITY. FOR SOME PRODUCTS, THE IT ADMINISTRATOR OR ANY OTHER EMPLOYEE RESPONSIBLE FOR SETTING UP THE PRODUCT CAN CHOOSE THE VOLUME OF DATA TO BE PROCESSED;
SEPARATE STATEMENTS RELATING TO SPECIFIC PRODUCT FEATURES, WHICH DESCRIBE THE DATA PROCESSED DURING THEIR USE, FOR EXAMPLE, MARKETING STATEMENT, ANTI-SPAM STATEMENT, SUPPLEMENTAL STATEMENT, STATEMENT REGARDING DATA PROCESSING FOR KASPERSKY MANAGED PROTECTION, WEB PROTECTION STATEMENT, AND TECHNICAL SUPPORT STATEMENT. YOU CAN FAMILIARIZE YOURSELF WITH SUCH STATEMENTS WHEN YOU TURN ON THE FEATURES IN THE PRODUCT.
The data obtained for processing depends on the product or service, and it is recommended that users carefully read the agreements and related statements accepted during installation or usage of software or service.
Some data are non-personal, according to laws of certain countries. Regardless of the type of data and territory where data was received or processed, we use the highest standards of data protection and apply various legal, organizational, and technical measures in order to protect user data, guarantee safety and confidentiality, as well as ensure users' rights guaranteed under applicable law.
The data depends on the products and services you use, and could include the following:
License/ subscription information
It is processed in order to recognize legitimate users. This data is needed to maintain communication between the product and Kaspersky services – sending and receiving product databases, updates, etc.
Product information
Data on the product's operation and its interaction with the user is also analyzed. For example, how long does threat scanning take? Which features are used more often than others? Answers to these and other questions help developers to improve products, making them faster and easier to use.
Device data
Data such as device type, operating system, etc. may be needed so the user doesn't have to buy a new license for the security product after reinstalling the operating system. This information also helps us to analyze cyberthreats, because it shows how many devices are affected by any specific threat.
Threats detected
If a threat (new or known) is found on a device, information about that threat is sent to Kaspersky. This enables us to analyze threats, their sources, principles of infection, etc., resulting in a higher quality of protection for every user.
Information on installed applications
This information helps to create lists of harmless applications and prevents security products from mistakenly identifying such applications as malicious. This data is also used to update and extend program categories for features like Parental Control and Application Startup Control. In addition, this information helps us to offer users security solutions that best match their needs.
URLs visited
URLs can be sent to be checked whether they are malicious. This information also helps to create lists of harmless websites and prevents security products from mistakenly identifying such websites as malicious. This data is also used to update and extend website categories for solutions like Kaspersky Safe Kids and provide better protection for financial transactions in such products as Kaspersky Fraud Prevention. In addition, this information helps us to offer users security solutions that best match their needs. Information about logins and passwords, if contained in the initial browser request from the user, is removed from the visited URL addresses up to the hostname or IP address. In any case, it is not Kaspersky's purpose to process user logins and passwords, and Kaspersky takes all reasonable and sufficient measures to avoid processing these data.
Operating System events
New malware can often be identified only by its suspicious behavior. Because of this, the product analyzes data on processes running on the device. This makes it possible to identify early on processes that indicate malicious activity and to prevent any damaging consequences, such as the destruction of user data.
Suspicious files and files that could be exploited by intruders
If an (as yet) unknown file, exhibiting suspicious behavior is detected on a device, it can be automatically sent for a more thorough analysis by machine learning-based technologies and, in rare cases, by a malware analyst. The 'suspicious' category includes mainly executable files (.exe). For the purpose of reducing the likelihood of false positives, executable and non-executable harmless files or their parts may be sent.
Wi-Fi connection data
This information is analyzed in order to warn users of insecure (i.e., poorly protected) Wi-Fi access points, helping to prevent personal data from being inadvertently intercepted.
User contact data
Email addresses are used for authorization on the Kaspersky web portals (My Kaspersky, Kaspersky CompanyAccount, Kaspersky Endpoint Security Cloud, etc.), which enables users to manage their protection remotely. Email addresses are used to send security messages to (e.g., containing important alerts) to users of Kaspersky products. Users can also choose to specify the names (or nicknames) by which they would like to be addressed on the My Kaspersky portal and in emails. Contact information is provided by users at their own discretion.
Dump and trace files
By checking the special box in the product settings, users can also share error reports with Kaspersky servers. This information helps (1) during analysis of errors that occurred in the product and to modify it accordingly so that it will function more effectively moving forward, and (2) in the investigation of infection of a user's computer in order to mitigate threats to a user's system.
Emails
During your use of the anti-spam functionality, Kaspersky scans emails and uses information about them to protect you from spam and fraud. When you indicate to Kaspersky that an email is spam or has been incorrectly identified by the software as spam, you help us analyze it and enable a higher quality of protection for users.
Data about stolen device
The Anti-theft feature provides certain remote access and control functions designed to protect data on your mobile phone in case of theft, as well allows you to receive information about the location of the stolen device. Anti-theft has to store data about your phone and approved users for these functions to work.
Data for child protection feature
If a parent or holder of parental responsibility wants to use the child protection feature like Kaspersky Safe Kids, he or she can receive information about the child's device and information about the child's location. Additionally, the parent or holder of parental responsibility can configure parameters in order to block or permit specific websites and/or allow or prevent certain applications from running on the child's device. Kaspersky does not collect children's data beyond the framework of such feature.
Unique identifier of the mobile device
This device identifier is generated on user device on Android 8 and higher, using the Advertising ID of the device. We do not process the Advertising ID in clear text; we process only its hash sum. In case user has reset the value of the Advertising ID, the new value of the unique identifier of the mobile device will be associated with the old value, which is necessary for the correct use of the device with services.
KASPERSKY WILL ONLY PROCESS PERSONAL DATA FOR PARTICULAR, PRE-DETERMINED PURPOSES THAT ARE LEGITIMATE WITH REGARD TO APPLICABLE LAW, AND THAT ARE RELEVANT TO KASPERSKY'S BUSINESS.
To ensure the performance of a contract with users and to ensure the required performance of products and services for customers.
To protect the user from known threats to information security.
To verify that the license is legal.
To update the anti-virus databases.
To increase the effectiveness of the protection of devices, networks, and information systems, in particular to provide a faster response to new information and network security threats, to increase the effectiveness of the performance of the software's protection component, to decrease the probability of false positive.
To detect advanced and previously unknown cybersecurity threats and reduce response times to them. More details are available below in the "Threat Intelligence for Protection of Cyber Space" section.
To improve user experience and our products and services, including features, functionalities, and interfaces.
To provide technical support of products and services for customers and to improve the quality of products and services.
To acquire an aggregated overview of products for home users by conducting statistical research and analyses. More details are available below in the "Product Statistical Research" section.
To provide users with personalized information and offers from Kaspersky, including in relation to product features, maintaining security levels, support and other help-related materials, as well as Kaspersky and third-party products and services, marketing offers, discounts, and promotional materials, based on user interests and preferences.
Threat Intelligence for Protection of Cyber Space
New generations of malware appear all the time, many using new, sophisticated techniques to bypass existing security solutions. In this constantly shifting environment, protection is only as effective as the ability to closely analyze the threat landscape and distill data into actionable intelligence for our users. To achieve this, security solutions must apply a cloud approach that combines the widest possible scope of threat data handling with the most intelligent data processing technologies.
Our infrastructure is designed to receive and process complex global cyberthreat data, transforming it into the actionable threat intelligence that powers our products. A key source of threat-related data comes from our users. By sharing their data and allowing it to be stored and analyzed by artificial intelligence and experts, they help us to ensure that users around the world are protected against the newest cyberthreats. In particular, KSN helps us to respond rapidly to emerging cyberthreats while delivering the highest possible effectiveness of protection and helping reduce the number of false positives.
The amount of data you allow our infrastructure to receive depends on the product used, its configuration settings and preferences.
This approach offers numerous benefits for users and cyber space overall, including:
Detection of advanced and previously unknown malware;
Reduced detection errors (false positives);
Significant reduction in response times to new threats.
Product Statistical Research
To better understand how we can improve the experience of current users, develop our products and services, determine potential markets, and pursue business opportunities, we perform research and conduct statistical analyses to acquire an aggregated overview of products for home users. Of course, we do so always for a legitimate reason and with a legal basis. In addition, we make sure to implement technical and organizational measures to ensure a high level of data protection. For example, when we conduct statistical analysis on data, they first undergo a de-identification process for that purpose. This is consistent with our privacy principles (see below for more details in the section "Privacy Principles").
Legal Bases for Data Processing
The legal basis we use depends on the purpose of processing personal data, which may be the following:
Contract – according to point (b) of Article 6 (1) GDPR, in cases where we have to process certain data necessary to perform a contract, such as when a user accepts the EULA to use the software;
Consent – according to point (a) of Article 6 (1) GDPR, in cases where a user chooses to send us data relating to the KSN Statement, Marketing Statement, Antispam Statement, Supplemental Statement, Statement regarding Data Processing for Kaspersky Managed Protection, Statement regarding Data Processing for Web Control (previously called Statement regarding Data Processing for Parental Control), Statement regarding Data Processing for Call Filter, Protect a Friend Statement, or Technical Support Statement;
Legal obligation – according to point © of Article 6 (1) GDPR, in cases where we have to process data to meet legal requirements, such as for tax purposes;
Legitimate interest – according to point (f) of Article 6 (1) GDPR, in cases where we have legitimate interests as a cybersecurity company, except where such interests are overridden by the interests or fundamental rights and freedoms of the user. Such cases include processing scenarios where data undergo de-identification in order to increase data protection in preparation for running statistical analyses on them, and where personal data is stored in our infrastructure and analyzed for recent and potential cyberthreats by using artificial intelligence and/or relying on the expertise of our specialists. Recital 49 of the GDPR acknowledges that it is a legitimate interest of a company to process personal data to the extent necessary and proportionate in order to ensure network and information security. Under certain local laws, you may be entitled to exercise rights in respect of your personal data, such as those described in the section Your Rights and Options. If you wish to exercise such right, please contact us via https://support.kaspersky.com/general/privacy.
LIMITATION OR RESTRICTION DATA PROCESSING
IF YOU CHOOSE NOT TO PROVIDE DATA THAT IS NECESSARY IN ORDER FOR A PRODUCT OR FEATURE TO WORK, YOU MAY NOT BE ABLE TO USE THAT PRODUCT OR FEATURE. THIS OBLIGATORY DATA IS LISTED IN THE END USER LICENSE AGREEMENT. THE KASPERSKY SECURITY NETWORK STATEMENT OR MARKETING STATEMENT CONTAINS A LIST OF DATA THAT USERS CAN DECIDE TO PROVIDE TO US AT ANY TIME BY CHECKING THE CORRESPONDING BOX IN THE PRODUCT SETTINGS (THEY CAN ALSO REVERSE THIS DECISION WHENEVER THEY CHOOSE).
What we aren't going to process
Through its products and services, Kaspersky never process "sensitive" personal data such as religion, political views, sexual preference, or health, or other special categories of personal data. We do not wish to receive any such data and will not request it from you.
Kaspersky's products must be installed and used by an adult. Children may use the device where Kaspersky's product was installed only with permission from their parents or holder of parental responsibility. Except for "Data for child protection feature", we do not intend to process personal data of children, nor do we want to receive such personal information of children.
Provision of Information
We may only disclose the Information as follows:
Within the Group of Companies Kaspersky. Data can be shared.
Service Providers. We also may share your information with vendors that provide services to us, including companies that provide web analytics, data processing, advertising, e-mail distribution, payment processing, order fulfillment, and other services.
Law enforcement or government agency. Kaspersky has strict principles and internal procedures in regard to requests from law enforcement and government agencies worldwide. Every request we receive goes through legal verification to ensure our compliance with applicable laws and procedures. More detailed information about Kaspersky's principles can be found at https://www.kaspersky.com/transparency-center.
Please note that some of our products, for example Kaspersky VPN Secure Connection, use services of third parties whose privacy practices differ from Kaspersky's. If you provide personal data to any of those services, your data is governed by their privacy statements. You are responsible for acquainting yourself with the data processing rules and procedures described in the relevant privacy statements.
Where we process Information
The personal data provided by users to Kaspersky can be processed in the following countries, including countries outside European Union (EU) or the European Economic Area (EEA):
Within the EU or EEA:
Germany
Netherlands
France
United Kingdom
Sweden
Italy
Spain
Romania
Outside of the EU or EEA:
Switzerland
Canada
Singapore
Russia
Japan
USA
Mexico
China
Azerbaijan
Brazil
Argentina
Israel
UAE
South Korea
Australia
Belarus
The list of countries where the data provided by the user may be processed can change. You can acquaint yourself with the current list of countries in the version of the Privacy Policy on the website https://www.kaspersky.com/products-and-s...acy-policy.
According to our general business practice, the data received from users in the EU are processed on servers located in the EU and Russia.
The personal data may be processed at destinations outside the EU or EEA some of which have not been determined by the European Commission to have an adequate level of data protection. It may also be processed by staff operating outside EU or EEA who work for us or for one of our service providers. In the absence of adequacy decisions or appropriate safeguards recognized by the European Commission, there may be risks for the user if the personal data is transmitted outside of the EU or EEA.
Whenever data is processed, we use the highest level of standards for data protection and apply a variety of legal measures in order to protect user data, guarantee safety and confidentiality, and ensure users' rights. To learn more about the European Commission's decisions on the adequacy of the protection of personal data in the countries where Kaspersky processes data, please visit: ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en.
Your Rights and Options
You have certain rights regarding your personal data. We also offer you certain options about what personal data you provide to us, how we use that information, and how we communicate with you.
In most cases you can choose not to provide personal data to us when you use Kaspersky's products, services, and websites. You may also refrain from submitting information directly to us. However, if you do not provide personal data when requested, you may not be able to benefit from the full range of Kaspersky products and services and we may not be able to provide you with information about products, services, and promotions.
You can at any time choose not to receive marketing communications by e-mail, if you have previously subscribed to receive them, by clicking on the unsubscribe link within the marketing e-mails you receive from us.
If your employer provides your personal data to Kaspersky, you may have certain options with respect to Kaspersky's use or disclosure of the information. Please contact your employer to learn about and to exercise your options.
To the extent provided by applicable law, you may withdraw any consent you previously provided to us, or object at any time on legitimate grounds, to the processing of your personal data. We will apply your preferences going forward. In some circumstances, withdrawing your consent to Kaspersky's use or disclosure of your personal data will mean that you cannot take advantage of certain Kaspersky products or services.
Subject to applicable law, you may have the following rights:
To obtain confirmation that we hold personal data about you;
To request access to and receive information about your personal data;
To receive copies of your personal data that you provided to us, also in a machine-readable format and have it sent to another data controller, where technically possible;
To update and correct inaccuracies in your personal data;
To object to the processing of your personal data;
To have the information blocked, anonymized or deleted, as appropriate; as well as
To lodge a complaint with a supervisory authority.
The right to access personal data may be limited in some circumstances by the requirements of local law or technological measures, including where the data has been anonymized and therefore does not relate to an identified or identifiable natural person. If you wish to exercise these rights, you may at any time directly contact us at https://support.kaspersky.com/general/privacy.
If you wish to object to data processing or withdraw your consent in cases where you use our free products, you must stop using and/or uninstall the product. If you wish to exercise your right to remove the already sent data, please contact us directly to request deletion via https://support.kaspersky.com/general/privacy.
If we fall short of your expectations in processing your personal data or you wish to make a complaint about our privacy practices, please relate this to us, as it gives us an opportunity to fix the problem. You may contact us by using the contact details provided in the "How to Contact Us" section below. To assist us in responding to your request, please give full details of the issue. We attempt to review and respond to all complaints within a reasonable time.
The Privacy Principles
Personal data processing at Kaspersky is based on the following principles:
Consent and choice
Presenting to the users the choice whether or not to send their personal data except where the users cannot freely withhold consent or where applicable law specifically allows the processing of personal data without the natural person's consent. The user's election must be freely given, specific and made on a knowledgeable basis;
Informing users, before obtaining consent, about their rights under the individual participation and access principle;
Providing users, before obtaining consent, with the information indicated by the openness, transparency and notice principle; and
Explaining to users the implications of granting or withholding consent.
Purpose legitimacy and specification
Ensuring that the purpose(s) complies with applicable law and relies on a permissible legal basis;
Communicating the purpose(s) to users before the information is used for the first time for a new purpose;
Using language for this specification which is both clear and appropriately adapted to the circumstances.
Data processing limitation
Gathering of personal data to that which is within the bounds of applicable law and strictly necessary for the specified purpose(s).
Deleting and disposing or anonymizing of personal data whenever the purpose for personal data processing has expired, there are no legal requirements to keep the personal data, or whenever it is practical to do so.
Use, retention and disclosure limitation
Limiting the use, retention and disclosure of personal data to that which is necessary in order to fulfil specific, explicit and legitimate purposes;
Limiting the use of personal data to the purposes specified by Kaspersky prior to receiving the data, unless a different purpose is explicitly required by applicable law;
Retaining personal data only as long as necessary to fulfill the stated purposes (e.g. retaining personal data required for the license for the period of the relevant license agreement between you and Kaspersky, normally 1 year plus, if applicable, any renewal period, depending on the product's license terms), and thereafter securely destroying or anonymizing it;
Retaining personal data for as long as necessary in order to fulfill legal obligations, comply with laws, resolve disputes, including in cases of litigation, proceedings, or investigations;
Retaining personal data for as long as necessary in order to fulfill legitimate interests; and
Locking (i.e. archiving, securing and exempting the personal data from further processing) any personal data when and for as long as the stated purposes have expired, but where retention is required in order to comply with applicable laws.
Accuracy and quality
Ensuring that the personal data processed is accurate, complete, up-to-date (unless there is a legitimate basis for keeping outdated data), adequate and relevant for the purpose of use;
Ensuring the reliability of personal data provided from a source other than from users before it is processed;
Verifying, through appropriate means, the validity and correctness of the claims made by the user prior to making any changes to the personal data (in order to ensure that the changes are properly authorized), where it is appropriate to do so;
Establishing personal data processing procedures to help ensure accuracy and quality; and
Establishing control mechanisms to periodically check the accuracy and quality of personal data processing.
Openness, transparency and notice
Providing users with clear and easily accessible information about Kaspersky's policies;
Establishing procedures and practices with respect to the processing of personal data;
Including in notices the fact that personal data is being processed, the purpose for which this is done, the types of privacy stakeholders to whom the personal data might be disclosed, and the identity of the entity which determines the above and on how to contact;
Disclosing the options and means offered by Kaspersky to users for the purposes of limiting the processing of, and for accessing, correcting and removing their information;
Giving notice to users when major changes in the personal data handling procedures occur.
Individual participation and access
Giving users the ability to contact us (by using the contact details provided in the "How to Contact Us") and review their personal data, provided their identity is first authenticated with an appropriate level of assurance and such access is not prohibited by applicable law;
Allowing users (by using the contact details provided in the "How to Contact Us" or by using interface of our products and services) to challenge the accuracy and completeness of the personal data and have it amended, corrected or removed as appropriate and possible in the specific context;
Providing any amendment, correction or removal to personal data processors and third parties to whom personal data had been disclosed, where they are known; and
Establishing procedures to enable users to exercise these rights in a simple, fast and efficient way, which does not entail undue delay or cost.
Information Security: How We Protect Your Privacy
Information security is Kaspersky's core business. All data and all information provided by you is confidential by default. Kaspersky will therefore always apply technical and organizational data security measures for the protection of personal data that are adequate and appropriate, taking into account the concrete risks resulting from the processing of personal data as well as up-to-date security standards and procedures. In order to, among other reasons, identify and fulfill the appropriate level of protection, Kaspersky classifies processing systems with personal data and implements cascading sets of protective measures.
Kaspersky also maintains physical, electronic and procedural safeguards to protect the information against loss, misuse, damage or modification and unauthorized access or disclosure. Some of the other central features of our information security program are:
The Information Security Department, which designs, implements and provides oversight to our information security program;
A determination of personal data safety hazards in the course of processing in a Kaspersky processing system;
Application of appropriate information security tools;
Performance evaluation of applied personal data security measures before commissioning processing systems;
Implementing controls to identify, authenticate and authorize access to various services or websites;
Discovering the facts surrounding unauthorized access to personal data and adopting corresponding measures;
Recovery of personal data that was modified or destructed;
Establishing access rules to personal data processed in Kaspersky processing systems and also recording and accounting for all actions undertaken with personal data in these systems;
Encryption between our clients and servers (and between our various data centers);
We restrict access of our employees and contractors who need to know the information in order to process it for us and who are subject to strict contractual confidentiality obligations, to personal information. They may be disciplined or their contract terminated if they fail to meet these obligations;
Monitoring of our systems infrastructure to detect weaknesses and potential intrusions;
Monitoring measures taken to ensure the security of personal data;
Providing Kaspersky personnel with relevant training and continually updating our security practices in light of new risks and developments in technology.
How to Contact Us
If you have any questions or comments about this Privacy Policy, Kaspersky's privacy practices or if you would like us to update or remove information or preferences you provided to us, please visit https://www.kaspersky.com/global-privacy-policy, or you may contact our Kaspersky EU representative via e-mail or phone: Kaspersky Labs GmbH, Ingolstadt, Germany, info@kaspersky.de, +49 (0) 841 98 18 90, according to point (a) of Article 13 (1) and Article 27 (1) of GDPR, or you may contact our Data Protection Officer in the EU, according to point (b) of Article 13 (1) and Article 37 (1) of GDPR, as well as for the other countries, via dpo@kaspersky.com.
© 2022 AO Kaspersky Lab
Introduction
AO Kaspersky Lab, located at bldg. 3, 39A, Leningradskoe Shosse, Moscow, 125212, Russian Federation and all companies belonging to the group "Kaspersky" respect your privacy. Our representative in the EU for data protection is: Kaspersky Labs GmbH, Despag-Strasse 3, 85055, Ingolstadt, Germany, info@kaspersky.de, +49 (0) 841 98 18 90, according to Article 27 (1) of Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR"). Our Data Protection Officer in the EU, according to Article 37 (1) of GDPR, as well as for the other countries, may be contacted via dpo@kaspersky.com.
This Products and Services Privacy Policy (Privacy Policy) describes how we use the information you provide when you use our products and services, and the choices you can make about our use of the information. We also describe the measures we take to protect the information and how you can contact us about our privacy practices.
In connection with specific products or services offered by Kaspersky, you are provided with the agreements, terms of use, and statements that supplement this policy relating to data handling.
This policy may be changed because of changes in legislation, the requirements of the authorities or to reflect changes in our practices concerning the processing of personal data. The revised policy will be posted on our website and will be effective immediately upon being posted. You can read at any time the policy currently in effect on our website: https://www.kaspersky.com/products-and-s...acy-policy.
This version of the policy is effective as of February 28, 2022.
The Sources of Information
Kaspersky may obtain information about you from various sources, namely:
products and services;
by your signing up for a Kaspersky products or services;
in response to technical support or other communication in order to ensure the required performance of products and services;
on our websites;
in response to marketing or other communications;
through participation in an offer, program or promotion.
If you provide us with any information or material relating to another individual, you should make sure that this sharing with us and our further use as described to you from time to time are in line with applicable laws; thus, for example, you should duly inform that individual about the processing of her/his personal data and obtain her/his consent, as may be necessary under applicable laws.
You may also choose to consent to third parties disclosing information about you to us that those third parties have received.
Information Provided by Users and How We Use Information
Personal data processing by Kaspersky is always carried out in a legal and fair manner.
You will always know what kind of information you provide to Kaspersky before you start to use the products and services. The data which you provide depends on the services, products, and features you use. For more information about data you provide, please refer to End User License Agreement, Kaspersky Security Network Statement and other documentation of product and services that you use, especially:
FOR HOME USERS (B2C):
SECTION "B" OF THE EULA, WHICH DESCRIBES THE DATA THAT NEED TO BE PROCESSED IN ORDER TO PERFORM OBLIGATIONS UNDER THE CONTRACT;
KASPERSKY SECURITY NETWORK STATEMENT, WHICH DESCRIBES THE DATA THE PROCESSING OF WHICH MAY INCREASE THE REACTION SPEED OF PRODUCTS AND SERVICES IN THE EVENT OF THREATS TO INFORMATION SECURITY;
MARKETING STATEMENT, WHICH DESCRIBES THE DATA THE PROCESSING OF WHICH MAY IMPROVE THE PERFORMANCE OF PRODUCTS AND WILL ENABLE AN ASSESSMENT OF USER SATISFACTION REGARDING PRODUCT USE;
SEPARATE STATEMENTS RELATING TO SPECIFIC PRODUCT FEATURES, WHICH DESCRIBE THE DATA PROCESSED DURING THEIR USE, FOR EXAMPLE, ANTI-SPAM STATEMENT, PURCHASE STATEMENT, WEB-PORTAL STATEMENT, AND TECHNICAL SUPPORT STATEMENT. YOU CAN FAMILIARIZE YOURSELF WITH SUCH STATEMENTS WHEN YOU TURN ON THE FEATURES IN THE PRODUCT.
FOR BUSINESS USERS (B2B):
SECTION "CONDITIONS REGARDING DATA PROCESSING" OF THE EULA, WHICH DESCRIBES THE DATA THAT NEED TO BE PROCESSED IN ORDER TO PERFORM OBLIGATIONS UNDER THE CONTRACT;
KASPERSKY SECURITY NETWORK STATEMENT, WHICH DESCRIBES THE DATA THE PROCESSING OF WHICH MAY INCREASE THE REACTION SPEED OF PRODUCTS AND SERVICES IN THE EVENT OF THREATS TO INFORMATION SECURITY. FOR SOME PRODUCTS, THE IT ADMINISTRATOR OR ANY OTHER EMPLOYEE RESPONSIBLE FOR SETTING UP THE PRODUCT CAN CHOOSE THE VOLUME OF DATA TO BE PROCESSED;
SEPARATE STATEMENTS RELATING TO SPECIFIC PRODUCT FEATURES, WHICH DESCRIBE THE DATA PROCESSED DURING THEIR USE, FOR EXAMPLE, MARKETING STATEMENT, ANTI-SPAM STATEMENT, SUPPLEMENTAL STATEMENT, STATEMENT REGARDING DATA PROCESSING FOR KASPERSKY MANAGED PROTECTION, WEB PROTECTION STATEMENT, AND TECHNICAL SUPPORT STATEMENT. YOU CAN FAMILIARIZE YOURSELF WITH SUCH STATEMENTS WHEN YOU TURN ON THE FEATURES IN THE PRODUCT.
The data obtained for processing depends on the product or service, and it is recommended that users carefully read the agreements and related statements accepted during installation or usage of software or service.
Some data are non-personal, according to laws of certain countries. Regardless of the type of data and territory where data was received or processed, we use the highest standards of data protection and apply various legal, organizational, and technical measures in order to protect user data, guarantee safety and confidentiality, as well as ensure users' rights guaranteed under applicable law.
The data depends on the products and services you use, and could include the following:
License/ subscription information
It is processed in order to recognize legitimate users. This data is needed to maintain communication between the product and Kaspersky services – sending and receiving product databases, updates, etc.
Product information
Data on the product's operation and its interaction with the user is also analyzed. For example, how long does threat scanning take? Which features are used more often than others? Answers to these and other questions help developers to improve products, making them faster and easier to use.
Device data
Data such as device type, operating system, etc. may be needed so the user doesn't have to buy a new license for the security product after reinstalling the operating system. This information also helps us to analyze cyberthreats, because it shows how many devices are affected by any specific threat.
Threats detected
If a threat (new or known) is found on a device, information about that threat is sent to Kaspersky. This enables us to analyze threats, their sources, principles of infection, etc., resulting in a higher quality of protection for every user.
Information on installed applications
This information helps to create lists of harmless applications and prevents security products from mistakenly identifying such applications as malicious. This data is also used to update and extend program categories for features like Parental Control and Application Startup Control. In addition, this information helps us to offer users security solutions that best match their needs.
URLs visited
URLs can be sent to be checked whether they are malicious. This information also helps to create lists of harmless websites and prevents security products from mistakenly identifying such websites as malicious. This data is also used to update and extend website categories for solutions like Kaspersky Safe Kids and provide better protection for financial transactions in such products as Kaspersky Fraud Prevention. In addition, this information helps us to offer users security solutions that best match their needs. Information about logins and passwords, if contained in the initial browser request from the user, is removed from the visited URL addresses up to the hostname or IP address. In any case, it is not Kaspersky's purpose to process user logins and passwords, and Kaspersky takes all reasonable and sufficient measures to avoid processing these data.
Operating System events
New malware can often be identified only by its suspicious behavior. Because of this, the product analyzes data on processes running on the device. This makes it possible to identify early on processes that indicate malicious activity and to prevent any damaging consequences, such as the destruction of user data.
Suspicious files and files that could be exploited by intruders
If an (as yet) unknown file, exhibiting suspicious behavior is detected on a device, it can be automatically sent for a more thorough analysis by machine learning-based technologies and, in rare cases, by a malware analyst. The 'suspicious' category includes mainly executable files (.exe). For the purpose of reducing the likelihood of false positives, executable and non-executable harmless files or their parts may be sent.
Wi-Fi connection data
This information is analyzed in order to warn users of insecure (i.e., poorly protected) Wi-Fi access points, helping to prevent personal data from being inadvertently intercepted.
User contact data
Email addresses are used for authorization on the Kaspersky web portals (My Kaspersky, Kaspersky CompanyAccount, Kaspersky Endpoint Security Cloud, etc.), which enables users to manage their protection remotely. Email addresses are used to send security messages to (e.g., containing important alerts) to users of Kaspersky products. Users can also choose to specify the names (or nicknames) by which they would like to be addressed on the My Kaspersky portal and in emails. Contact information is provided by users at their own discretion.
Dump and trace files
By checking the special box in the product settings, users can also share error reports with Kaspersky servers. This information helps (1) during analysis of errors that occurred in the product and to modify it accordingly so that it will function more effectively moving forward, and (2) in the investigation of infection of a user's computer in order to mitigate threats to a user's system.
Emails
During your use of the anti-spam functionality, Kaspersky scans emails and uses information about them to protect you from spam and fraud. When you indicate to Kaspersky that an email is spam or has been incorrectly identified by the software as spam, you help us analyze it and enable a higher quality of protection for users.
Data about stolen device
The Anti-theft feature provides certain remote access and control functions designed to protect data on your mobile phone in case of theft, as well allows you to receive information about the location of the stolen device. Anti-theft has to store data about your phone and approved users for these functions to work.
Data for child protection feature
If a parent or holder of parental responsibility wants to use the child protection feature like Kaspersky Safe Kids, he or she can receive information about the child's device and information about the child's location. Additionally, the parent or holder of parental responsibility can configure parameters in order to block or permit specific websites and/or allow or prevent certain applications from running on the child's device. Kaspersky does not collect children's data beyond the framework of such feature.
Unique identifier of the mobile device
This device identifier is generated on user device on Android 8 and higher, using the Advertising ID of the device. We do not process the Advertising ID in clear text; we process only its hash sum. In case user has reset the value of the Advertising ID, the new value of the unique identifier of the mobile device will be associated with the old value, which is necessary for the correct use of the device with services.
KASPERSKY WILL ONLY PROCESS PERSONAL DATA FOR PARTICULAR, PRE-DETERMINED PURPOSES THAT ARE LEGITIMATE WITH REGARD TO APPLICABLE LAW, AND THAT ARE RELEVANT TO KASPERSKY'S BUSINESS.
To ensure the performance of a contract with users and to ensure the required performance of products and services for customers.
To protect the user from known threats to information security.
To verify that the license is legal.
To update the anti-virus databases.
To increase the effectiveness of the protection of devices, networks, and information systems, in particular to provide a faster response to new information and network security threats, to increase the effectiveness of the performance of the software's protection component, to decrease the probability of false positive.
To detect advanced and previously unknown cybersecurity threats and reduce response times to them. More details are available below in the "Threat Intelligence for Protection of Cyber Space" section.
To improve user experience and our products and services, including features, functionalities, and interfaces.
To provide technical support of products and services for customers and to improve the quality of products and services.
To acquire an aggregated overview of products for home users by conducting statistical research and analyses. More details are available below in the "Product Statistical Research" section.
To provide users with personalized information and offers from Kaspersky, including in relation to product features, maintaining security levels, support and other help-related materials, as well as Kaspersky and third-party products and services, marketing offers, discounts, and promotional materials, based on user interests and preferences.
Threat Intelligence for Protection of Cyber Space
New generations of malware appear all the time, many using new, sophisticated techniques to bypass existing security solutions. In this constantly shifting environment, protection is only as effective as the ability to closely analyze the threat landscape and distill data into actionable intelligence for our users. To achieve this, security solutions must apply a cloud approach that combines the widest possible scope of threat data handling with the most intelligent data processing technologies.
Our infrastructure is designed to receive and process complex global cyberthreat data, transforming it into the actionable threat intelligence that powers our products. A key source of threat-related data comes from our users. By sharing their data and allowing it to be stored and analyzed by artificial intelligence and experts, they help us to ensure that users around the world are protected against the newest cyberthreats. In particular, KSN helps us to respond rapidly to emerging cyberthreats while delivering the highest possible effectiveness of protection and helping reduce the number of false positives.
The amount of data you allow our infrastructure to receive depends on the product used, its configuration settings and preferences.
This approach offers numerous benefits for users and cyber space overall, including:
Detection of advanced and previously unknown malware;
Reduced detection errors (false positives);
Significant reduction in response times to new threats.
Product Statistical Research
To better understand how we can improve the experience of current users, develop our products and services, determine potential markets, and pursue business opportunities, we perform research and conduct statistical analyses to acquire an aggregated overview of products for home users. Of course, we do so always for a legitimate reason and with a legal basis. In addition, we make sure to implement technical and organizational measures to ensure a high level of data protection. For example, when we conduct statistical analysis on data, they first undergo a de-identification process for that purpose. This is consistent with our privacy principles (see below for more details in the section "Privacy Principles").
Legal Bases for Data Processing
The legal basis we use depends on the purpose of processing personal data, which may be the following:
Contract – according to point (b) of Article 6 (1) GDPR, in cases where we have to process certain data necessary to perform a contract, such as when a user accepts the EULA to use the software;
Consent – according to point (a) of Article 6 (1) GDPR, in cases where a user chooses to send us data relating to the KSN Statement, Marketing Statement, Antispam Statement, Supplemental Statement, Statement regarding Data Processing for Kaspersky Managed Protection, Statement regarding Data Processing for Web Control (previously called Statement regarding Data Processing for Parental Control), Statement regarding Data Processing for Call Filter, Protect a Friend Statement, or Technical Support Statement;
Legal obligation – according to point © of Article 6 (1) GDPR, in cases where we have to process data to meet legal requirements, such as for tax purposes;
Legitimate interest – according to point (f) of Article 6 (1) GDPR, in cases where we have legitimate interests as a cybersecurity company, except where such interests are overridden by the interests or fundamental rights and freedoms of the user. Such cases include processing scenarios where data undergo de-identification in order to increase data protection in preparation for running statistical analyses on them, and where personal data is stored in our infrastructure and analyzed for recent and potential cyberthreats by using artificial intelligence and/or relying on the expertise of our specialists. Recital 49 of the GDPR acknowledges that it is a legitimate interest of a company to process personal data to the extent necessary and proportionate in order to ensure network and information security. Under certain local laws, you may be entitled to exercise rights in respect of your personal data, such as those described in the section Your Rights and Options. If you wish to exercise such right, please contact us via https://support.kaspersky.com/general/privacy.
LIMITATION OR RESTRICTION DATA PROCESSING
IF YOU CHOOSE NOT TO PROVIDE DATA THAT IS NECESSARY IN ORDER FOR A PRODUCT OR FEATURE TO WORK, YOU MAY NOT BE ABLE TO USE THAT PRODUCT OR FEATURE. THIS OBLIGATORY DATA IS LISTED IN THE END USER LICENSE AGREEMENT. THE KASPERSKY SECURITY NETWORK STATEMENT OR MARKETING STATEMENT CONTAINS A LIST OF DATA THAT USERS CAN DECIDE TO PROVIDE TO US AT ANY TIME BY CHECKING THE CORRESPONDING BOX IN THE PRODUCT SETTINGS (THEY CAN ALSO REVERSE THIS DECISION WHENEVER THEY CHOOSE).
What we aren't going to process
Through its products and services, Kaspersky never process "sensitive" personal data such as religion, political views, sexual preference, or health, or other special categories of personal data. We do not wish to receive any such data and will not request it from you.
Kaspersky's products must be installed and used by an adult. Children may use the device where Kaspersky's product was installed only with permission from their parents or holder of parental responsibility. Except for "Data for child protection feature", we do not intend to process personal data of children, nor do we want to receive such personal information of children.
Provision of Information
We may only disclose the Information as follows:
Within the Group of Companies Kaspersky. Data can be shared.
Service Providers. We also may share your information with vendors that provide services to us, including companies that provide web analytics, data processing, advertising, e-mail distribution, payment processing, order fulfillment, and other services.
Law enforcement or government agency. Kaspersky has strict principles and internal procedures in regard to requests from law enforcement and government agencies worldwide. Every request we receive goes through legal verification to ensure our compliance with applicable laws and procedures. More detailed information about Kaspersky's principles can be found at https://www.kaspersky.com/transparency-center.
Please note that some of our products, for example Kaspersky VPN Secure Connection, use services of third parties whose privacy practices differ from Kaspersky's. If you provide personal data to any of those services, your data is governed by their privacy statements. You are responsible for acquainting yourself with the data processing rules and procedures described in the relevant privacy statements.
Where we process Information
The personal data provided by users to Kaspersky can be processed in the following countries, including countries outside European Union (EU) or the European Economic Area (EEA):
Within the EU or EEA:
Germany
Netherlands
France
United Kingdom
Sweden
Italy
Spain
Romania
Outside of the EU or EEA:
Switzerland
Canada
Singapore
Russia
Japan
USA
Mexico
China
Azerbaijan
Brazil
Argentina
Israel
UAE
South Korea
Australia
Belarus
The list of countries where the data provided by the user may be processed can change. You can acquaint yourself with the current list of countries in the version of the Privacy Policy on the website https://www.kaspersky.com/products-and-s...acy-policy.
According to our general business practice, the data received from users in the EU are processed on servers located in the EU and Russia.
The personal data may be processed at destinations outside the EU or EEA some of which have not been determined by the European Commission to have an adequate level of data protection. It may also be processed by staff operating outside EU or EEA who work for us or for one of our service providers. In the absence of adequacy decisions or appropriate safeguards recognized by the European Commission, there may be risks for the user if the personal data is transmitted outside of the EU or EEA.
Whenever data is processed, we use the highest level of standards for data protection and apply a variety of legal measures in order to protect user data, guarantee safety and confidentiality, and ensure users' rights. To learn more about the European Commission's decisions on the adequacy of the protection of personal data in the countries where Kaspersky processes data, please visit: ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en.
Your Rights and Options
You have certain rights regarding your personal data. We also offer you certain options about what personal data you provide to us, how we use that information, and how we communicate with you.
In most cases you can choose not to provide personal data to us when you use Kaspersky's products, services, and websites. You may also refrain from submitting information directly to us. However, if you do not provide personal data when requested, you may not be able to benefit from the full range of Kaspersky products and services and we may not be able to provide you with information about products, services, and promotions.
You can at any time choose not to receive marketing communications by e-mail, if you have previously subscribed to receive them, by clicking on the unsubscribe link within the marketing e-mails you receive from us.
If your employer provides your personal data to Kaspersky, you may have certain options with respect to Kaspersky's use or disclosure of the information. Please contact your employer to learn about and to exercise your options.
To the extent provided by applicable law, you may withdraw any consent you previously provided to us, or object at any time on legitimate grounds, to the processing of your personal data. We will apply your preferences going forward. In some circumstances, withdrawing your consent to Kaspersky's use or disclosure of your personal data will mean that you cannot take advantage of certain Kaspersky products or services.
Subject to applicable law, you may have the following rights:
To obtain confirmation that we hold personal data about you;
To request access to and receive information about your personal data;
To receive copies of your personal data that you provided to us, also in a machine-readable format and have it sent to another data controller, where technically possible;
To update and correct inaccuracies in your personal data;
To object to the processing of your personal data;
To have the information blocked, anonymized or deleted, as appropriate; as well as
To lodge a complaint with a supervisory authority.
The right to access personal data may be limited in some circumstances by the requirements of local law or technological measures, including where the data has been anonymized and therefore does not relate to an identified or identifiable natural person. If you wish to exercise these rights, you may at any time directly contact us at https://support.kaspersky.com/general/privacy.
If you wish to object to data processing or withdraw your consent in cases where you use our free products, you must stop using and/or uninstall the product. If you wish to exercise your right to remove the already sent data, please contact us directly to request deletion via https://support.kaspersky.com/general/privacy.
If we fall short of your expectations in processing your personal data or you wish to make a complaint about our privacy practices, please relate this to us, as it gives us an opportunity to fix the problem. You may contact us by using the contact details provided in the "How to Contact Us" section below. To assist us in responding to your request, please give full details of the issue. We attempt to review and respond to all complaints within a reasonable time.
The Privacy Principles
Personal data processing at Kaspersky is based on the following principles:
Consent and choice
Presenting to the users the choice whether or not to send their personal data except where the users cannot freely withhold consent or where applicable law specifically allows the processing of personal data without the natural person's consent. The user's election must be freely given, specific and made on a knowledgeable basis;
Informing users, before obtaining consent, about their rights under the individual participation and access principle;
Providing users, before obtaining consent, with the information indicated by the openness, transparency and notice principle; and
Explaining to users the implications of granting or withholding consent.
Purpose legitimacy and specification
Ensuring that the purpose(s) complies with applicable law and relies on a permissible legal basis;
Communicating the purpose(s) to users before the information is used for the first time for a new purpose;
Using language for this specification which is both clear and appropriately adapted to the circumstances.
Data processing limitation
Gathering of personal data to that which is within the bounds of applicable law and strictly necessary for the specified purpose(s).
Deleting and disposing or anonymizing of personal data whenever the purpose for personal data processing has expired, there are no legal requirements to keep the personal data, or whenever it is practical to do so.
Use, retention and disclosure limitation
Limiting the use, retention and disclosure of personal data to that which is necessary in order to fulfil specific, explicit and legitimate purposes;
Limiting the use of personal data to the purposes specified by Kaspersky prior to receiving the data, unless a different purpose is explicitly required by applicable law;
Retaining personal data only as long as necessary to fulfill the stated purposes (e.g. retaining personal data required for the license for the period of the relevant license agreement between you and Kaspersky, normally 1 year plus, if applicable, any renewal period, depending on the product's license terms), and thereafter securely destroying or anonymizing it;
Retaining personal data for as long as necessary in order to fulfill legal obligations, comply with laws, resolve disputes, including in cases of litigation, proceedings, or investigations;
Retaining personal data for as long as necessary in order to fulfill legitimate interests; and
Locking (i.e. archiving, securing and exempting the personal data from further processing) any personal data when and for as long as the stated purposes have expired, but where retention is required in order to comply with applicable laws.
Accuracy and quality
Ensuring that the personal data processed is accurate, complete, up-to-date (unless there is a legitimate basis for keeping outdated data), adequate and relevant for the purpose of use;
Ensuring the reliability of personal data provided from a source other than from users before it is processed;
Verifying, through appropriate means, the validity and correctness of the claims made by the user prior to making any changes to the personal data (in order to ensure that the changes are properly authorized), where it is appropriate to do so;
Establishing personal data processing procedures to help ensure accuracy and quality; and
Establishing control mechanisms to periodically check the accuracy and quality of personal data processing.
Openness, transparency and notice
Providing users with clear and easily accessible information about Kaspersky's policies;
Establishing procedures and practices with respect to the processing of personal data;
Including in notices the fact that personal data is being processed, the purpose for which this is done, the types of privacy stakeholders to whom the personal data might be disclosed, and the identity of the entity which determines the above and on how to contact;
Disclosing the options and means offered by Kaspersky to users for the purposes of limiting the processing of, and for accessing, correcting and removing their information;
Giving notice to users when major changes in the personal data handling procedures occur.
Individual participation and access
Giving users the ability to contact us (by using the contact details provided in the "How to Contact Us") and review their personal data, provided their identity is first authenticated with an appropriate level of assurance and such access is not prohibited by applicable law;
Allowing users (by using the contact details provided in the "How to Contact Us" or by using interface of our products and services) to challenge the accuracy and completeness of the personal data and have it amended, corrected or removed as appropriate and possible in the specific context;
Providing any amendment, correction or removal to personal data processors and third parties to whom personal data had been disclosed, where they are known; and
Establishing procedures to enable users to exercise these rights in a simple, fast and efficient way, which does not entail undue delay or cost.
Information Security: How We Protect Your Privacy
Information security is Kaspersky's core business. All data and all information provided by you is confidential by default. Kaspersky will therefore always apply technical and organizational data security measures for the protection of personal data that are adequate and appropriate, taking into account the concrete risks resulting from the processing of personal data as well as up-to-date security standards and procedures. In order to, among other reasons, identify and fulfill the appropriate level of protection, Kaspersky classifies processing systems with personal data and implements cascading sets of protective measures.
Kaspersky also maintains physical, electronic and procedural safeguards to protect the information against loss, misuse, damage or modification and unauthorized access or disclosure. Some of the other central features of our information security program are:
The Information Security Department, which designs, implements and provides oversight to our information security program;
A determination of personal data safety hazards in the course of processing in a Kaspersky processing system;
Application of appropriate information security tools;
Performance evaluation of applied personal data security measures before commissioning processing systems;
Implementing controls to identify, authenticate and authorize access to various services or websites;
Discovering the facts surrounding unauthorized access to personal data and adopting corresponding measures;
Recovery of personal data that was modified or destructed;
Establishing access rules to personal data processed in Kaspersky processing systems and also recording and accounting for all actions undertaken with personal data in these systems;
Encryption between our clients and servers (and between our various data centers);
We restrict access of our employees and contractors who need to know the information in order to process it for us and who are subject to strict contractual confidentiality obligations, to personal information. They may be disciplined or their contract terminated if they fail to meet these obligations;
Monitoring of our systems infrastructure to detect weaknesses and potential intrusions;
Monitoring measures taken to ensure the security of personal data;
Providing Kaspersky personnel with relevant training and continually updating our security practices in light of new risks and developments in technology.
How to Contact Us
If you have any questions or comments about this Privacy Policy, Kaspersky's privacy practices or if you would like us to update or remove information or preferences you provided to us, please visit https://www.kaspersky.com/global-privacy-policy, or you may contact our Kaspersky EU representative via e-mail or phone: Kaspersky Labs GmbH, Ingolstadt, Germany, info@kaspersky.de, +49 (0) 841 98 18 90, according to point (a) of Article 13 (1) and Article 27 (1) of GDPR, or you may contact our Data Protection Officer in the EU, according to point (b) of Article 13 (1) and Article 37 (1) of GDPR, as well as for the other countries, via dpo@kaspersky.com.
© 2022 AO Kaspersky Lab