GLOBAL SECURE WEB - PRIVACY POLICY Effective Date: August 19, 2026 This Privacy Policy explains how Global Secure Web ("Global Secure Web," "we," "us," or "our"), accessible at https://globalsecureweb.com/, collects, uses, stores, shares, and protects personal data when you use our website, create an account, or route traffic through our services. We provide web security, distributed denial-of-service (DDoS) mitigation, and web application firewall (WAF) services. We are committed to protecting privacy and complying with applicable data protection laws, including the EU General Data Protection Regulation (GDPR – Regulation (EU) 2016/679). 1. WHO WE ARE (DATA CONTROLLER) Global Secure Web is the data controller for personal data processed in connection with our website, customer accounts, and billing. For network traffic processed on behalf of our customers (visitors to websites protected by our services), we generally act as a data processor. For questions about this policy or our data practices, contact us at: Main site index contactable form(s) If required under applicable law, our Data Protection Officer (DPO) can be reached at the same contactable form(s). 2. INFORMATION WE COLLECT We collect information in two main categories: A. Information you provide directly When you register for an account, subscribe to services, update billing details, or contact support, we may collect: - Full name and contact details (email address, phone number if provided) - Account credentials (username and password, stored in hashed form) - Billing and payment information (processed via secure third-party payment providers; we do not store full card numbers) - Company name and related business information - Communications with our support team B. Information collected automatically When you visit our website or when end-users access websites protected by our services: - IP addresses - Browser type and user-agent string - URLs requested and HTTP headers - TLS/SSL session information - Device and connection information - Approximate location derived from IP address - Log data related to security events, threats, and service performance We also use cookies and similar technologies on our website. See Section 8 for details. We do not intentionally collect special categories of personal data (sensitive data) unless you voluntarily provide it. 3. HOW WE USE YOUR INFORMATION AND LEGAL BASES We process personal data for the following purposes and on the following legal bases under Article 6 GDPR: - To create and manage your account, provide our services, and fulfill contracts → Contractual necessity - To process payments and maintain billing records → Contractual necessity and legal obligation - To detect, prevent, and mitigate cyber threats, DDoS attacks, malicious traffic, and abuse → Legitimate interests (security and service integrity) and, where applicable, contractual necessity - To improve and secure our infrastructure and services → Legitimate interests - To communicate with you about your account, service updates, or support requests → Contractual necessity or legitimate interests - To send marketing communications (only with your consent or where otherwise permitted) → Consent - To comply with legal obligations, respond to lawful requests, and protect our rights → Legal obligation and legitimate interests Our legitimate interests include ensuring network security, preventing fraud and abuse, and maintaining the availability and integrity of our services. We balance these interests against your rights and freedoms. 4. COOKIES AND SIMILAR TECHNOLOGIES We use cookies and similar technologies on our website to: - Enable essential site functionality - Remember preferences - Analyze traffic and improve performance (with consent where required) - Support security features You can manage cookie preferences through your browser settings or our cookie banner (where available). Essential cookies cannot be disabled as they are necessary for the service to function. 5. HOW WE SHARE INFORMATION We do not sell, rent, or trade personal data for commercial or marketing purposes. We may share data only in the following limited circumstances: - With trusted sub-processors and service providers (e.g., cloud infrastructure, payment processors, email delivery) that help us operate our services. These parties are bound by data processing agreements and may only process data on our instructions. - With our customers, when we act as a processor and process traffic data on their behalf. - When required by law, court order, or governmental authority, or to protect our rights, safety, or the rights of others. - In connection with a corporate transaction (merger, acquisition, or sale of assets), subject to appropriate safeguards. All sub-processors are required to provide data protection standards consistent with this policy and applicable law. 6. INTERNATIONAL DATA TRANSFERS We primarily process data within the European Economic Area (EEA). When data is transferred outside the EEA (for example, to sub-processors in other countries), we ensure appropriate safeguards are in place, such as: - Adequacy decisions by the European Commission - Standard Contractual Clauses (SCCs) approved by the European Commission - Other lawful transfer mechanisms You may request more information about these safeguards by contacting us. 7. DATA RETENTION We retain personal data only for as long as necessary for the purposes described in this policy, or as required by law. - Account and billing data: retained for the duration of the customer relationship plus applicable statutory limitation and accounting periods (typically up to 7–10 years where required by law). - Network and security logs: retained for short periods necessary for threat detection, service operation, and security investigations (generally days to a few weeks, longer only if needed for active investigations or legal obligations). - Support communications: retained as long as needed to resolve issues and for a reasonable period thereafter. When data is no longer needed, we securely delete or anonymize it. Backup systems may retain residual copies for a limited additional period before automatic overwrite. 8. YOUR RIGHTS Under the GDPR and applicable laws, you have the following rights regarding your personal data (subject to certain exceptions): - Right of access – obtain confirmation and a copy of your data - Right to rectification – correct inaccurate or incomplete data - Right to erasure (“right to be forgotten”) – request deletion of your data - Right to restriction of processing - Right to data portability - Right to object to processing based on legitimate interests - Right to withdraw consent at any time (where processing is based on consent) - Right to lodge a complaint with a supervisory authority To exercise these rights, contact us at our index site contactable forms and or type(s). We will respond within the timeframes required by law (generally within one month). We may need to verify your identity before fulfilling requests. Note: When we process data as a processor on behalf of a customer, certain requests may need to be directed to that customer. 9. SECURITY MEASURES We implement appropriate technical and organizational measures to protect personal data, including: - Encryption of data in transit (TLS 1.3) and at rest (AES-256 where applicable) - Access controls, multi-factor authentication, and least-privilege principles - Regular security monitoring, logging, and vulnerability management - Secure development and operational practices While we take strong precautions, no method of transmission or storage is completely secure. We continuously work to improve our security posture. 10. CHILDREN’S PRIVACY Our services are not directed to children under 16 (or the applicable age of digital consent). We do not knowingly collect personal data from children. If we become aware that we have collected such data, we will take steps to delete it. 11. CHANGES TO THIS POLICY We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Material changes will be notified by posting the updated policy on our website and updating the effective date. Continued use of our services after changes take effect constitutes acceptance of the revised policy where permitted by law. 12. CONTACT US AND SUPERVISORY AUTHORITY For any questions, requests, or concerns about this Privacy Policy or our data practices: See main contact types on our index site. You also have the right to lodge a complaint with your local data protection supervisory authority. In the European Union, you can find the relevant authority at https://www.edpb.europa.eu/about-edpb/our-members_en . This Privacy Policy is governed by the laws of Belgium, without regard to conflict of law principles.