Draft — pending legal review
Legal
Privacy Notice
This notice explains how [Legal entity name], [Registered address], Greece (“we”), processes personal data in connection with Pharos. It covers two groups of people: (A) our customers, their users and visitors to this website, and (B) people whose data may appear in public sources processed through the Service.
Contact: privacy@pharos.example. [Data Protection Officer contact, if appointed, to be added.]
A. Customers, users and website visitors
What we process and why
| Data | Purpose | Lawful basis (GDPR) |
|---|---|---|
| Account data: name, business email, role, MFA status | Provide the Service, secure accounts | Contract, Art. 6(1)(b) |
| Company data: legal name, country, VAT ID, verification records | Verify customers, prevent abuse | Contract and legitimate interests, Art. 6(1)(b), (f) |
| Billing data: plan, invoices, payment status (card details stay with the payment provider) | Billing and tax | Contract and legal obligation, Art. 6(1)(b), (c) |
| Audit data: actions, declared purposes, IP addresses | Security, accountability, abuse prevention | Legitimate interests, Art. 6(1)(f) |
| Website: server logs (IP address, user agent) | Operate and secure the website | Legitimate interests, Art. 6(1)(f) |
This website does not use advertising or analytics cookies. It loads web fonts from Google Fonts (Google Ireland Ltd.), which receives your IP address when the fonts are fetched.
Retention
Account and audit data are kept for the life of the account and up to [X] years afterwards to defend legal claims. Billing records are kept as long as Greek tax law requires. Server logs are kept for at most 30 days.
B. People whose data appears in public sources
What the Service does
Verified business customers use Pharos to investigate internet infrastructure: domains, subdomains, IP addresses, name servers, certificates and exposed web services. The sources are public DNS records, certificate transparency logs, RDAP/WHOIS registration data, reverse DNS and public HTTP responses. These records can include personal data, such as a domain registrant’s name or email address, or a name in a certificate.
Roles
For investigation data, the customer is the controller and we act as its processor under our DPA. We are controller for our own safeguards described below.
Why you were not told individually
We do not contact people individually when public data about them is processed, because that would involve disproportionate effort (Art. 14(5)(b) GDPR). This public notice, together with the opt-out below, is how we inform you.
Safeguards
- Customers must be businesses, accept our Acceptable Use Policy and declare a purpose for every investigation.
- We do not process data about anyone known or likely to be under 18; signals of a minor lead to redaction and review.
- We never use the contents of breached credentials. The Service only offers existence checks for a customer’s own domains.
- Person searches are not available at launch. When introduced, they will require business verification and a declared legal basis.
- Evidence is kept only for the customer’s plan retention period (7 to 90 days by default) and then deleted.
Opt-out (suppression list)
You can ask not to be searched. We store your identifier (email, phone, username, or name and date of birth) only as a keyed hash (HMAC-SHA256), never in plain text. It is checked before an investigation starts and again before results are shown. We process it as controller on the basis of legitimate interests (Art. 6(1)(f)) and keep it until you ask us to remove it.
Recipients and transfers
We use the service providers listed on our Subprocessors page. Data is hosted in the EU. Where a provider processes data outside the EEA, we rely on an adequacy decision or Standard Contractual Clauses.
Your rights
You can ask for access, rectification, erasure, restriction, portability, and object to processing based on legitimate interests. Use our Privacy requests page or email privacy@pharos.example. We answer within one month (Art. 12 GDPR); for complex requests this can be extended by two months, and we will tell you why. We may ask you to confirm your identity.
If a request concerns investigation data, we forward it to the customer that controls it and help them answer.
You may complain to the Hellenic Data Protection Authority (HDPA), our lead supervisory authority (www.dpa.gr), or to the authority where you live or work.
Security and breaches
We protect data with encryption, sandboxed tool execution, strict tenant isolation and audited staff access. If a personal data breach is likely to result in a risk to people, we notify the HDPA within 72 hours, and the affected people where the risk is high.
Changes
We will publish changes on this page and update the version date. Material changes are also announced to customers by email.