1. Introduction and Scope

This Privacy Policy (the "Policy") describes how Network Telescope ("we", "us", "our", or the "Firm") collects, uses, discloses, retains, and protects personal information in connection with the Network Telescope website (the "Site") and certain limited categories of information collected in the ordinary course of our research and intelligence operations. This Policy is supplemental to, and does not modify, any contractual privacy or data-processing obligations governing a specific engagement.

This Policy applies to visitors to the Site, to individuals who submit inquiries to us, to prospective and current clients, and to natural persons whose personal information we may incidentally encounter through our public-internet research. It does not apply to the personal data of our clients' end users processed under separate contractual arrangements, which is governed by the relevant engagement agreement and any applicable data-processing addendum.

2. Definitions

Capitalised terms used in this Policy have the meanings given to them in our Terms of Service. In addition, for the purposes of this Policy:

• "Personal Data" means any information relating to an identified or identifiable natural person, as defined under applicable data protection law, including without limitation the EU and U.K. General Data Protection Regulations and the California Consumer Privacy Act, as amended.
• "Processing" means any operation performed on Personal Data, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, restriction, erasure, or destruction.
• "Data Subject" means an identified or identifiable natural person to whom Personal Data relates.
• "Controller" and "Processor" have the meanings ascribed to them under applicable data protection law.

3. Information We Collect Through the Site

We collect the following categories of information through the Site:

• Inquiry data. Information you voluntarily submit through our contact, opt-out, or dispatch forms, including without limitation your name, organisational affiliation, email address, postal address, telephone number, and the substantive content of your communication.
• Engagement-prospect data. Information you provide in the course of discussing a prospective engagement, including the identity of the prospective client, the scope of contemplated work, and any preliminary technical or commercial parameters.
• Operational logs. Standard server access logs, including IP address, user agent string, timestamp, referrer (where transmitted by your browser), requested resource, response code, and approximate geographic region inferred from IP. These logs are used for security, abuse prevention, capacity planning, and service reliability.
• Subscription data. Where you subscribe to our research dispatch, the email address you provide and the date of subscription. We do not collect demographic or behavioural data for the purpose of marketing segmentation.

We do not use third-party advertising trackers, behavioural retargeting pixels, or session replay technologies on the Site. We do not sell Personal Data and we do not engage in cross-context behavioural advertising.

4. Information Collected Through Research Operations

In the ordinary course of our Public-Internet Reconnaissance, we collect information that has been voluntarily exposed by hosts on the public internet, including without limitation service banners, TLS certificates, DNS records, HTTP response headers and bodies, and the metadata of unsolicited traffic captured by our network telescope, honeypots, and sinkholes. This collection is conducted in accordance with our Transparency disclosures, including the probe-attribution procedures specified by RFC 9511 (Attribution of Internet Probes).

Where such information incidentally contains Personal Data (for example, where an exposed service banner reveals the email address of a system administrator), we process that Personal Data solely for the legitimate purposes of internet measurement, threat intelligence, and the protection of network operators and end users from harm. We do not aggregate, enrich, or commercialise such incidentally collected Personal Data outside the scope of the foregoing purposes.

5. Purposes of Processing and Lawful Bases

We process Personal Data only for specified, explicit, and legitimate purposes, and only where we have an appropriate lawful basis to do so. The purposes for which we process Personal Data, and the corresponding lawful bases under applicable European and U.K. data protection law, are:

• Responding to inquiries — performance of pre-contractual measures or our legitimate interest in operating a professional services firm.
• Negotiating and performing engagements — performance of a contract to which the Data Subject is party, or in which the Data Subject's organisation is party.
• Processing opt-out requests — compliance with our voluntary attribution undertaking and our legitimate interest in conducting responsible research.
• Securing and maintaining infrastructure — our legitimate interest in operating, securing, and improving the Site and our services.
• Conducting internet measurement and threat intelligence — our legitimate interest in conducting public-interest research into the security and integrity of the internet, balanced against the rights and freedoms of Data Subjects.
• Compliance with legal obligations — compliance with laws, regulations, court orders, and lawful requests of public authorities.
• Sending research dispatches — consent, which may be withdrawn at any time via the unsubscribe mechanism in each dispatch.

6. Disclosure of Personal Data

We do not disclose Personal Data to third parties except:

• to service providers and subprocessors acting on our behalf under written confidentiality obligations and, where applicable, data-processing terms no less protective than those required by applicable law;
• to professional advisers, including legal counsel, accountants, and auditors, under duties of professional confidentiality;
• to a successor entity in connection with a merger, acquisition, reorganisation, or sale of substantially all of our assets, subject to the protections of this Policy continuing to apply;
• where required by applicable law, regulation, or valid legal process issued by a court of competent jurisdiction or an authority acting within its lawful remit;
• to defend or enforce our legal rights, or to protect the rights, property, or safety of Network Telescope, our personnel, our clients, or the public; or
• with the Data Subject's prior, specific, and informed consent.

7. Subprocessors and Service Providers

We engage a limited number of service providers to support the Site and our operations, including cloud infrastructure providers, email delivery services, and analytics tooling. All such providers are bound by written contractual obligations restricting the processing of Personal Data to the purposes for which it was disclosed, and requiring appropriate technical and organisational measures to protect that data. A current list of material subprocessors is available on request to contact@networktelescope.com.

8. International Data Transfers

Network Telescope operates infrastructure in multiple jurisdictions. Personal Data we collect may be transferred to, stored in, and processed in countries other than the country in which it was originally collected. Where Personal Data is transferred from the European Economic Area, the United Kingdom, or other jurisdictions imposing restrictions on cross-border transfer, we rely on appropriate safeguards, including the Standard Contractual Clauses approved by the European Commission and, where applicable, the U.K. International Data Transfer Addendum. Additional information regarding the safeguards applicable to specific transfers is available on request.

9. Retention

We retain Personal Data only for so long as is necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements. In particular:

• Inquiry data is retained for the duration of the inquiry and for a reasonable period thereafter to maintain a record of our communications, ordinarily not exceeding three (3) years.
• Opt-out requests are retained indefinitely to ensure ongoing exclusion of the relevant network from active scanning.
• Server access logs are retained for a limited operational period and are then deleted or aggregated such that they cease to identify any natural person.
• Subscription data is retained until the Data Subject unsubscribes or the dispatch is discontinued.
• Engagement records are retained in accordance with the applicable Statement of Work and our professional record-keeping obligations.

10. Security

We implement administrative, technical, organisational, and physical safeguards designed to protect Personal Data against unauthorised access, accidental loss, alteration, destruction, or disclosure. Such measures include access controls, encryption in transit and at rest where appropriate, logging and monitoring, vulnerability management, and employee confidentiality obligations. No system, however, is perfectly secure, and we make no guarantee of absolute security. In the event of a confirmed breach of Personal Data, we shall notify affected Data Subjects and competent supervisory authorities to the extent and within the time periods required by applicable law.

11. Cookies and Similar Technologies

The Site uses a minimal set of strictly necessary technical cookies and equivalent storage mechanisms required for the basic operation of the Site, the maintenance of session state, and the prevention of abuse. The Site does not use analytics, advertising, or behavioural-profiling cookies. Where you have configured your browser to transmit a Global Privacy Control or similar opt-out signal, we honour that signal to the extent applicable to our limited cookie usage.

12. Do Not Track

Different browsers offer different mechanisms for expressing tracking preferences, and there is no industry-wide standard for interpreting "Do Not Track" headers. Because we do not engage in cross-site tracking or behavioural advertising, our practices are unaffected by the presence or absence of any such signal.

13. Children's Privacy

The Site is not directed to children, and we do not knowingly collect Personal Data from individuals under the age of sixteen (16). If you believe that a child has provided Personal Data to us, please contact us at contact@networktelescope.com and we shall take appropriate steps to delete such information.

14. Your Rights

Subject to applicable law and to any limitations or exceptions provided thereunder, Data Subjects may have the following rights with respect to their Personal Data:

• the right to be informed about the processing of their Personal Data;
• the right to access their Personal Data and to request a copy thereof;
• the right to rectify inaccurate or incomplete Personal Data;
• the right to erasure of Personal Data in certain circumstances (the "right to be forgotten");
• the right to restrict processing in certain circumstances;
• the right to object to processing carried out on the basis of legitimate interests;
• the right to data portability with respect to Personal Data processed by automated means on the basis of consent or contract;
• the right to withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of prior processing;
• the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects the Data Subject; and
• the right to lodge a complaint with a competent supervisory authority.

We do not engage in automated decision-making, including profiling, that produces legal or similarly significant effects on Data Subjects.

15. How to Exercise Your Rights

To exercise any of the rights described above, please contact us at contact@networktelescope.com. We may require additional information to verify your identity before responding to a request, in order to protect the security of the requested data. We shall respond to verifiable requests within the time period prescribed by applicable law, and shall not charge a fee unless the request is manifestly unfounded, excessive, or repetitive.

16. California Privacy Rights

If you are a California resident, you may have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, including the right to know the categories of Personal Information collected, the categories of sources, the business or commercial purpose of collection, and the categories of third parties to which such information is disclosed; the right to delete; the right to correct; the right to limit the use and disclosure of sensitive Personal Information; and the right to opt out of sale or sharing. We do not sell or share Personal Information as those terms are defined under the CCPA.

17. Marketing Communications

Where you have subscribed to our research dispatch or have otherwise consented to receive marketing communications from us, you may withdraw that consent at any time by following the unsubscribe instructions included in each communication, or by contacting us at contact@networktelescope.com. Withdrawal of consent does not affect transactional communications relating to a current engagement.

18. Changes to This Policy

We may revise this Policy from time to time. The "last updated" date at the top of this Policy reflects the most recent revision. We shall endeavour, but are not required, to provide advance notice of material changes. Continued use of the Site after revisions are posted constitutes acceptance of the revised Policy.

19. Contact and Data Protection Inquiries

Questions, requests, or complaints regarding this Policy or our processing of Personal Data should be directed to contact@networktelescope.com. Where required by applicable law, we shall designate a data protection officer or representative, whose contact details will be made available on request.