F‑Secure Total privacy notice

The service sends queries on potential malicious activities or protected devices and networks to F‑Secure Security Cloud. F‑Secure Security Cloud is a cloud-based system for cyber threat analysis that is operated by F‑Secure. With the Security Cloud, F‑Secure can maintain an up-to-date overview of the global threat landscape and protect our customers against new threats the moment they are first found. While we limit the processing of any information that could be considered sensitive by our users, we collect the minimum amount of user and organization information for the purpose of providing high quality protection to our users. The collected data may contain:

• Files that are blocked by F‑Secure for a security reason, and related metadata. The metadata includes for example file hash, file name and file path. We need to analyze files and emails for malicious content and behaviors for your protection. Files are processed in a safe environment to catch harmful behaviors. Collection of this data helps F‑Secure to keep a global threat situation map that allows reacting quickly to new threats.

• Web addresses that you have tried to visit but have been blocked by F‑Secure for a security reason or which exhibit potentially malicious behavior, and related metadata. The metadata includes for example response headers. A site may get blocked based on selected protection preferences and parental control reasons. The collected information also allows protection against phishing and ransomware attacks.

The VPN feature collects online communications information. Our guiding principle is that we do not seek to spy on the exact content of your private communications. We only analyze your communications traffic to provide you the service and to keep your data transfers clean. This means that:

• we need to process some metadata (such as volume, country, IP address) of your traffic when providing the service to you;

• as an information security company, we analyze the traffic for suspicious or malicious files and destinations (i.e. URLs);

• we filter traffic based on Family Rules, which you can take into use in the application;

• we automatically screen the traffic to inhibit usage that is against our acceptable use policy; and

• the service collects statistics to give you a view of your browsing history via the service. F‑Secure is not able to identify you based on this data.

Service provisioning logging: When the service is taken into use or a license is modified at later stages of the lifecycle, the provisioning log data is collected. This is done in order to enable and diagnose successful provisioning to authorized devices, detect abuse of the service, and as a precaution for disaster recovery in case it is needed. This log contains the IP address of the client, a random device ID generated by the service, the time of access, the country code obtained via a GeoIP lookup of the client IP address, and other similar technical device data.

We do not keep any logs about connections established through the VPN service to external addresses. We cannot link the IP address of your browsing destination to you.

To protect the service against fraudulent use, we maintain temporary logs that contain the duration of the VPN sessions, the amount of data transferred, the device ID, public IP address, and host name from where the VPN client connects to our service. Traffic anomalies that look like a potential abuse of our service (such as port scanning, spamming, or DDoS attacks) are detected by our service and will be logged as well. The logs are stored for 90 days, and can be used to deal with any misuse of our service or attacks against F‑Secure.

VPN service provisioning log entries are retained for one year, after which they are deleted. VPN service log events for provisioned devices are retained for three months, after which they are deleted.

The password vault feature collects service statistics per device; for example, how many times the user has used the service, as well as the license creation time, the number of purchased licenses, and the types of services that each user has subscribed to, the devices connected to the service, as well as the unique device identifiers.

• F‑Secure provides you with an encrypted password vault;

• we monitor your chosen data to see if it has come up in any data breaches; and

• we show you what data of yours has been leaked and how to mitigate the situation.

Stored passwords and other personal data in Password Vault: Your passwords and other information, such as credit and debit card details and personal notes, are stored on servers hosted by F‑Secure and locally on your client devices in an encrypted format. The encryption key is the end-user master password, and this master password is never exposed outside the service on your device. It is also not possible to acquire a hosted password file without an authenticated client belonging to the user.

In summary, in their stored format, the files hosted by F‑Secure are not decryptable or identifiable in terms of who they belong to.

F‑Secure account information is not linked to any of the password data managed by the service.

Personal identifiers: When the identity of the service user is managed by F‑Secure, we ask for the following information about you and other users: name, username, email address, and phone number.

When the identity of the service user is managed by a service provider partner, the service provider may provide us with the same information (your email address, name, and phone number), or an alternative identifier, directly from its systems upon your subscription to our services.

• F‑Secure manages the identifiers that you wish to monitor, presents you with the findings, and otherwise processes such findings as stated in this policy.

• We ask you for an email addresses — or other identifiers — that you wish to monitor for potential breaches. You can also monitor the data of your family members for breaches, provided that you have their approval to do so.

• If you query an email address via the web tool, the full findings are only provided to the email address that you enter.

• To monitor your assets more effectively, F‑Secure engages a third-party provider for the purposes of detecting and collecting information on data breaches that relate to the data (e.g, an email address) that F‑Secure monitors for you.

When you query the breaches related to your email address via the web tool, the findings of such queries are only processed for the time necessary to deliver and present the findings to you. We store queried email addresses for a period necessary to prevent misuse of the web tool.

If you have purchased the service via our service provider partners, the account deletion is controlled by that partner. When the partner notifies us that your subscription has been terminated, F‑Secure subsequently removes the account and deletes or anonymizes personal data related to the account.

The text message scam protection feature reviews messages that are received from an unknown sender (when the sender's number is not saved in your contacts) and collects the following information from text messages:

• The text message content (for example, any links to harmful content)

• The sender of the text message

• The request's region of origin and the language of the message.

The scam protection feature retains personal data only for the purpose of making the verdict on whether the message is a scam. The verdict is based on information extracted from the text message, including URLs. The text message is anonymized within a month of the verdict. The remaining parts of the text messages that were given a safe or unknown verdict are deleted within 18 months. We retain only non-personal information, for example the verdict and its justification, as well as malicious text messages and some examples of fully anonymized text messages to train the AI to better recognize scams.

The text message scam protection feature uses artificial intelligence (AI). We use AWS Translate to translate text messages that are not in English following a no-trace policy, which means that AWS will not retain any of your personal data. All other AI functionality is fully in our control and its sole purpose is to recognize scam text messages.

The Chrome protection feature for Android asks you to give permissions to use Accessibility Service and Display Overlay. The purpose of this feature is to visually show you which pages are safe. However, this feature does not collect any additional data from you; you can find more information about the browsing protection feature in the “Security data” section. You can revoke the permission to use Accessibility Service and Display Overlay on your Android device at any time.

We need to automatically collect and process relevant data for our services to work, to enhance them, and to provide them to you. The data is processed to:

1. provide F‑Secure services to secure our customers’ networks and devices as well as the confidentiality and availability of the data therein;

2. enable F‑Secure to detect emerging threats and security-relevant trends among all of its customers, so that our services can keep on par with evolving threats;

3. enable F‑Secure to provide a centralized security service framework across multiple continents to a large number of customers and service provider partners.

The data processing by the services is mandatory for the efficient protection of the device/network and a prerequisite for F‑Secure’s capability to provide its contracted services. As such processing is inseparable from the services that we provide to you, this gives us a valid need to process your data and a justification to do so.

For consumer products, this right takes place in the form of contract performance. In some cases, processing may take place in the form of legitimate interest and we may also have a legal obligation to process data for specified purposes.

We also reuse the above service data and security data for data analytics purposes. Data analytics are an integral part of our service delivery, as nearly all F‑Secure services are dependent on our infrastructure to properly operate. Our data analytics enables us to direct that infrastructure to support your use of the services.

Where our services collect data that is only needed for the purpose of gaining more insight on how people use the services, but is not necessary for providing our services, we do so only with your separate consent. You also have the right to withdraw your consent later, should you wish to do so. The legal grounds for data that is solely collected for analytics purposes is thus consent.

Opting out: We really appreciate your help in improving our services. However, if you want to minimize all data traffic towards F‑Secure, we respect that. Those of our services that employ additional analytics give you the choice on whether to contribute. You can opt out at any time from the subsequent collection of analytical data that is non-essential to our service provisioning.

If you have not opted in to additional analytics data collection, our messaging directed to you will be based only on the service data collection (the data that we collect in any case to provide you with the services) and some of our messaging is likely to be less relevant.

In addition to the above primary legal grounds for data collection, we may also need to use and/or continue to store data i) to meet a legal obligation to process data for specified purposes, or ii) under the grounds of legitimate interest. For an example list of situations where we may resort to such justifications, see the Other disclosures section.

In our data analytics activities, we combine analytics data with the service data. The resulting combined data set then continues to be processed based on a legitimate interest. The previously collected analytical data is retained as part of the service statistics, as its retroactive removal would break the statistics. When you cease subscribing to our services (i.e. your account is deleted), the analytical data related to your service use will be reverted to anonymous data, and we are no longer able to associate it with you.

We may transfer or disclose some of your personal data to F‑Secure group companies and our subcontractors who help us create the services.

Where our clients’ personal data needs to be transferred or disclosed to our subcontractors, we require, in our contracts with them, that they use such information solely for providing their agreed services (for example, to solve a support case, to send it to logistics partners for product delivery, or to send marketing mails on our behalf). We require our subcontractors to process data pertaining to you in a manner that is consistent with our statements herein.

F‑Secure operates globally. Consequently, some of our affiliates, subcontractors, distributors, and service provider partners are located in multiple countries, including outside the European Economic Area to ensure the global reach and availability of our services. Depending on the scope of your interactions with F‑Secure, your personal information may be stored in or accessed from multiple countries. The locations of F‑Secure affiliates can be viewed from F‑Secure’s public web pages.

When we transfer personal data to other jurisdictions, including outside the European Economic Area, we secure such transfers of personal data according to the requirements of the law. We do this by imposing appropriate technical and contractual safeguards on relevant subcontractors and F‑Secure group companies, for example by using data transfer clauses that are approved by the European Union — the fixed content of such clauses is available here.

Additionally, F‑Secure complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) as set forth by the U.S. Department of Commerce. F‑Secure has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit the Data Privacy Framework website.

In compliance with the EU-U.S. DPF, F‑Secure commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF to JAMS, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit jamsadr.com/submit for more information or to file a complaint. The services of JAMS are provided at no cost to you. If you have a complaint that we have violated the DPF Principles that has not been resolved by other means, you may have the ability to invoke binding arbitration following the procedure explained on the DPF website. F‑Secure is subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC).

We only do global or cross-border data transfers for a good reason and after assessing the resulting privacy risk. When we transfer your personal data onward to a third party, we remain liable under the DPF Principles if the data is processed in a manner inconsistent with the DPF Principles.

We store more sensitive customer data within Finland or the European Economic Area and keep it under our own control.

There are circumstances not covered by this privacy policy where the use or disclosure of personal data may be justified or permitted, or where we may be obligated by applicable laws to disclose information without acquiring your consent or independent of service provisioning.

For example, F‑Secure respects lawful warrants, court orders of the jurisdictions applicable to us, and public authorities, including to meet national security or law enforcement requirements.

Similarly, there may be other circumstances where there is a justifiable legitimate interest to disclose limited sets of information to a third party. Examples of such disclosures include cases where we need to protect ourselves against liability or to prevent fraudulent activity, where we analyze your use of our products to ensure that our products are working the way you would expect them to and that we are able to react to adverse experiences, where it is necessary to solve or contain an ongoing problem, or where we need to meet the legitimate information requirements of our insurers or governmental regulatory agencies. In any such action, we will act according to the applicable laws.

We may also need to transfer your personal data as part of a corporate transaction, such as a sale, merger, spin-off, or other corporate reorganization of F‑Secure, where the information is provided to the new controlling entity in the regular course of business. F‑Secure group discloses and transfers data internally as required by our then current operational model. We do, however, limit the disclosures internally to only those group companies, units, teams, and individuals who have a need to know such information for the intended purposes of processing it.

We weigh each disclosure requirement carefully and take the possibility of such disclosure requests into account when deciding where and how we store your personal data.

While we collect the majority of the above-mentioned data directly from you or your device, we also receive data from our affiliates, distribution partners (such as operators and retailers), and corporate entities from whom you have purchased the services. Such entities may be our resellers, but also include our external webstore partners. We also acquire some basic personal data (order data on purchases) and aggregate analytical data from app stores in which our services are sold. Such other sources may further include subcontractors who have provided you with support for our services, or advertising partners who have assisted us in conducting our marketing activities.

We do this to create a seamless customer experience and to have the necessary information for solving support cases.

Typical examples of third-party sources are:

• information on your purchase made in our external webstore,

• we acquire your credentials from previous sign-in data from our operator reseller partner, so that we can provide our service to you directly,

• we acquire your contact data from corporate decision-maker registries for marketing purposes, and

• when you use your social media account to register to our services, we collect the email address from your account to enable us to authenticate your registration and to contact you.

Because of the technical environment (that is, the internet, the app store ecosystem, and social media), we are not able to do all of the collection and activities related to data analytics ourselves. We have to exchange some data (such as Android marketing identifier and other like identifiers) with our online analytics and marketing partners to enable our digital analytics and marketing activities. The vast majority of the data that we have on you is not shared with others.

Some of our subcontractors who provide us with analytical capabilities for our products may also create and publish aggregate reports on the data that they have collected. In such cases, the statistics and aggregate reports do not contain any data that could be linked to any individual person.

Our services are provided in conjunction with our partners and our services and websites may embed or interoperate with third-party services. This privacy document only applies to personal data as long as that data is within F‑Secure’s realm of influence. Where your personal data is processed by other entities for their independent purposes, such other party is responsible for processing your personal data in a justified manner in accordance to their policies as well as for fulfilling your rights under data protection laws.

The most prevalent such scenarios are the following:

• Webstore: Our webstore is partially run by a third-party reseller. While the data you enter in the registration phase is handled under F‑Secure policies, our webstore providers’ policies apply to the actual purchase and related activities.

• Device location queries: When you query the location of your device via our services, the map provider needs to process the related geographical data. On publication of this notice, F‑Secure uses Google maps in our device location and search features. Google privacy policies shall apply accordingly to your use of these features.

Definitions

This is what we mean when we make certain references within this policy.

Client, you, refers to any data subjects who buy, register for use, or use our services, whose devices and data traffic are protected by our services, or who may have submitted personally identifiable information to us. This information may have been submitted through the use of our services, websites, telephone, email, registration forms, or other similar channels.

Personal data refers to any information on private individuals that is identifiable to them or their family or household members. This information may include names, email and mailing addresses, telephone numbers, billing and account information, and other, more technical information that can be linked to you, your device, or the behavior of either, that we process while providing our services.

Services refer to any services or products that are manufactured or distributed by F‑Secure, including software, web solutions, tools, and related support services.

Service provider partner refers to a third party that sells and distributes F‑Secure products, for example mobile and broadband service providers, banks, and insurance companies. The F‑Secure product may be co-branded with the service provider’s brand.

Website refers to the f-secure.com website or any other website that F‑Secure hosts or controls, including subsites and browser-based service portals.

Changes

This version of the policy clarifies, updates, and replaces the previous version. To continue keeping this document up to date, we will make changes and additions to this from time to time also in the future.

We will publish the changed policy document on our website or at another interaction point where it has previously been made available. If the changes are significant, we may also notify you by other means. Any changes will apply starting from the date that we publish the revised policy document.