Privacy notice

ETE FAROS LTD, registered in Cyprus, is the data controller for your account, billing and support data. You can reach us at info@etefaros.eu.

For the Microsoft 365 configuration data we assess on your behalf, you are the controller and we act as your processor under a data processing agreement included in our terms.

• Account data (name, work email, job title, phone, language) — to create and secure your account. Lawful basis: performance of a contract.
• Company and billing data (legal name, registration and VAT number, billing address, invoices) — to invoice you and meet tax obligations. Lawful basis: contract and legal obligation.
• Tenant assessment data (security settings, policy names, role assignments, sign-in and MFA registration status, affected account identifiers) — to produce findings and remediation plans. Lawful basis: contract, processed on your instructions.
• Usage and audit data (sign-ins, assessments run, actions taken) — for security, abuse prevention and plan limits. Lawful basis: legitimate interests.
• Support messages and AI advisor questions — to answer you and improve guidance. Lawful basis: contract and legitimate interests.
• Strictly necessary cookies and, with your consent, analytics cookies. Lawful basis: your consent for anything optional.

• We never read the contents of your mailboxes, files, chats or documents.
• We never write to or change your tenant configuration.
• We never sell personal data or use it for advertising.
• We never use your tenant data to train AI models for other customers.

• Cloud hosting, database and authentication provider — hosting of the application and your data, EU region.
• Payment provider — subscription billing, invoicing and VAT handling.
• AI model provider — processes the assessment context needed to answer your advisor questions; inputs are not used to train models.
• Microsoft Graph — the source of the read-only configuration data we assess, on your instruction.
• European Commission VIES service — validation of the VAT number you enter.

Where a processor is outside the EEA, transfers rely on the European Commission's Standard Contractual Clauses together with supplementary safeguards.

• Account and organisation data: for as long as your account exists, then deleted within 30 days.
• Assessment results, findings and pen-test runs: kept to show your history, and deleted within 30 days of account deletion.
• Invoices and tax records: seven years, as required by Cyprus tax law.
• Security and audit logs: up to 12 months.

You have the right to access, rectify, erase and port your personal data, to restrict or object to processing, and to withdraw consent at any time (including cookie consent, via the cookie settings link in the footer). Automated decision-making with legal effect is not used.

To exercise a right, email info@etefaros.eu. We respond within one month. You may also complain to the Office of the Commissioner for Personal Data Protection in Cyprus, or your local supervisory authority.

Access to your data is isolated per organisation and enforced at database level. Data is encrypted in transit, tenant credentials are stored server-side and are never exposed to the browser, and access to production data is limited to authorised staff on a need-to-know basis.

If we change this notice materially we will tell you in the application and, where required, ask you to accept the new version.