Privacy Policy for Websites and Webservices
This update to Kaspersky's Privacy Policy is mostly formatting cleanup (spacing, headers, and a partner portal link update), but it also adds Kazakhstan to the list of countries outside the EU/EEA where your personal data may be processed.
Your data may now also be processed in Kazakhstan
Kaspersky added Kazakhstan to the list of non-EU/EEA countries where your personal data can be sent and processed. Data protection laws outside the EU/EEA can be weaker, so this slightly increases the number of places your information could end up, even though Kaspersky says it applies standard safeguards to these transfers.
“United Kingdom, Switzerland, Canada, Singapore, Russia, Japan, USA, Mexico, China, Azerbaijan, Turkey, Brazil, Kazakhstan.”
DATA SHARING
| 81 | 81 | ### **Description of Service** |
| 82 | 82 | |
| 83 | 83 | Kaspersky Account is a service that provides end-to-end authentication across websites, Kaspersky products and third party services, as well as the ability to manage single account settings for Kaspersky users. |
| 84 | 84 | |
| 85 | 85 | **_Account registration_**. In order to create Kaspersky Account and have access to all of its functions, you will need to provide us with your email address (which will be your user name) and a password. You can also log in with an external account (Facebook, Apple account, etc.), thus providing us with the email address of your external account. In case of using a two-factor authentication, we will also process your phone number. |
| 86 | 86 | |
| 87 | **_Account Settings._** You can view, update, correct your account information and password, set up a two-step verification via phone or app for authentication, and, also, delete your account at any time. | |
| 87 | **_Account Settings._**You can view, update, correct your account information and password, set up a two-step verification via phone or app for authentication, and, also, delete your account at any time. | |
| 88 | 88 | |
| 89 | 89 | Purpose and legal basis for processing your personal data is the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract. |
| 90 | 90 | |
| 91 | 91 | **How long do we keep your personal data** |
| 92 | 92 | |
| 93 | 93 | Data is deleted no later than 6 (six) calendar months after the account is deleted. |
| 94 | 94 | |
| 95 | 95 | If the account remains inactive for a period of 5 (five) years, it will be automatically completely deleted from our system. |
| 96 | 96 | |
| 97 | [**My Kaspersky**](https://my.kaspersky.com/) **and its customizations (hereinafter referred to as the "Service")** | |
| 97 | ### [**My Kaspersky**](https://my.kaspersky.com/) **and its customizations (hereinafter referred to as the "Service")** | |
| 98 | 98 | |
| 99 | 99 | ### **Description of Service** |
| 100 | 100 | |
| 101 | 101 | **_Account registration_**. We will only process and use this data in order to provide you the Service, unless it is allowed by applicable law or you expressly consent to a processing or use for other purposes (for example to receive useful news on Kaspersky products and services via email). You may also need to provide us your mobile phone number for the purpose of additional protection of your account from unauthorized access. We will only use your mobile phone number to send you authorization security codes. |
| 102 | 102 | |
| 103 | 103 | Purpose and legal basis for processing your personal data is the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract. |
| 132 | 132 | The legal basis for data processing is your consent. You may withdraw your consent at any time by updating your account preferences or by following the unsubscribe link in the emails. |
| 133 | 133 | |
| 134 | 134 | **How long do we keep your personal data** |
| 135 | 135 | |
| 136 | 136 | Data is deleted no later than 1 (one) calendar month after the account is deleted. |
| 137 | 137 | |
| 138 | ### [**Kaspersky Business-To-Business Portals (including Kaspersky Business Hub**](https://cloud.kaspersky.com/)**,** [**Kaspersky Endpoint Security Cloud**](https://cloud.kaspersky.com/)**,** [**Kaspersky Security Center Cloud Console**](https://ksc.kaspersky.com/)**,**[**Kaspersky Security for Microsoft Office 365**](https://cloud.kaspersky.com/)**, Kaspersky Next)** | |
| 138 | ### [**Kaspersky Business-To-Business Portals (including Kaspersky Business Hub**](https://cloud.kaspersky.com/)**,**[**Kaspersky Endpoint Security Cloud**](https://cloud.kaspersky.com/)**,**[**Kaspersky Security Center Cloud Console**](https://ksc.kaspersky.com/)**,**[**Kaspersky Security for Microsoft Office 365**](https://cloud.kaspersky.com/)**, Kaspersky Next)** | |
| 139 | 139 | |
| 140 | 140 | ### Description |
| 141 | 141 | |
| 142 | 142 | **_Account registration._** If you need to use Kaspersky Business-To-Business (B2B) products and have access to the Kaspersky products used by your company, you need to create a corporate account. To do this, you need to enter your email address (which will be used as your username) and a password. We will only process and use this data to provide you with Kaspersky B2B Portals functionality and the products used in Kaspersky B2B Portals. This data will only be processed and used for other purposes if you give your explicit consent (for example, to receive the latest news about Kaspersky products and services by email, or to be contacted about your Kaspersky product reviews). You can also provide your mobile phone number to further protect your account from unauthorized access, as well as a security question to regain access to your account if you forget your password. We will only use your mobile phone number to send security codes during your authorization. |
| 143 | 143 | |
| 144 | 144 | Purpose and lawful basis for processing your personal data is the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract. |
| 191 | 191 | Purpose and legal basis for processing your personal data is the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract. |
| 192 | 192 | |
| 193 | 193 | ### **How long do we keep your personal data** |
| 194 | 194 | |
| 195 | 195 | You can delete your account at any time in the Account settings or by submitting a request to our Customer Service. Once your account has been deleted, your personal data will be held in Kaspersky's database until the retention period has expired, but you will no longer be able to access the Kaspersky CompanyAccount website using the deleted account. |
| 196 | 196 | |
| 197 | ### [**Kaspersky Partner Portal**](https://partners.kaspersky.com/) **and Kaspersky Order Management System** | |
| 197 | ### [**Kaspersky Partner Portal**](https://www.kasperskypartners.com/) **and Kaspersky Order Management System** | |
± CHANGEDKaspersky Partner Portal link updated The hyperlink for 'Kaspersky Partner Portal' now points to kasperskypartners.com instead of partners.kaspersky.com. This is just an updated web address, not a change in what data is collected or how it's used. | ||
| 198 | 198 | |
| 199 | 199 | ### **Description of Service** |
| 200 | 200 | |
| 201 | 201 | We may request personal data when you place an order, register a product, request a service, answer a survey, enter a contest, and when you correspond with us or engage in other activities on our website. |
| 202 | 202 | |
| 203 | 203 | You make all decisions regarding whether or not to proceed with any activity that requests personal data. However, please note that if you do not wish to provide the requested data, you may not be able to complete the transaction. |
| 279 | 279 | - Processors: Service providers which we use for the provision of certain services e.g. vendors. As far as such external service providers need to have access to personal data, we ensure that any such access is limited to the extent necessary for the provision of the respective service. Furthermore, such external service providers of course have to submit themselves to comply with all applicable data protection regulations. |
| 280 | 280 | - Public bodies: Authorities and state institutions, such as public prosecutors' offices, courts or tax authorities, to which we may have to transmit personal data in individual cases. |
| 281 | 281 | - Private bodies: Private bodies to which we transfer your personal data on the basis of a legal provision or your consent. |
| 282 | 282 | |
| 283 | 283 | #### **WHERE WE PROCESS PERSONAL DATA / THIRD COUNTRY TRANSFERS** |
| 284 | 284 | |
| 285 | The personal data provided by users to Kaspersky can be processed in countries outside the European Union (EU) or the European Economic Area (EEA) and can include the following: United Kingdom, Switzerland, Canada, Singapore, Russia, Japan, USA, Mexico, China, Azerbaijan, Turkey, Brazil. | |
| 285 | The personal data provided by users to Kaspersky can be processed in countries outside the European Union (EU) or the European Economic Area (EEA) and can include the following: United Kingdom, Switzerland, Canada, Singapore, Russia, Japan, USA, Mexico, China, Azerbaijan, Turkey, Brazil, Kazakhstan. | |
± CHANGEDKazakhstan added to list of countries where data may be processed Kaspersky now says your personal data can also be processed in Kazakhstan, in addition to the countries already listed. | ||
| 286 | 286 | |
| 287 | 287 | Kaspersky has taken appropriate security measures to protect your personal data in accordance with security and privacy best practices, including, utilizing the European Commission's Standard Contractual Clauses for transfers of personal data between its group companies, which requires all group companies to protect personal data being processed from the European Economic Area to an equivalent standard to that required under European Union data protection law. Where we share your personal data with a third party service provider outside of the European Economic Area and Switzerland, we ensure prior to the transfer that, outside of exceptional cases permitted by statutory law, the recipient either possesses an appropriate level of data protection or appropriate safeguards exist. You can obtain a copy of the appropriate safeguards by contacting us at [click here](https://support.kaspersky.com/privacy). |
| 288 | 288 | |
| 289 | 289 | To the extent required by the local applicable laws, we will choose a cross-border data transfer mechanism in line with the applicable requirements of the local applicable laws and satisfy the conditions and complete the relevant procedures or adopt the protection measures required for the cross-border data transfer. |
| 290 | 290 | |
| 291 | 291 | #### **YOUR DATA SUBJECT RIGHTS AND HOW TO EXERCISE THEM** |
| 295 | 295 | - **Right to be informed**. You have the right to be provided with clear, transparent and easily understandable information about how we use your personal data, and your rights. |
| 296 | 296 | - **Right of access**. You have the right to request confirmation as to whether or not we are processing your personal data; if this is the case, you have a right of access to such processing |
| 297 | 297 | - **Right to rectification**. You have the right to request the rectification of inaccurate personal data that we process about you. Furthermore, you may demand that incomplete data will be completed. |
| 298 | 298 | - **Right to erasure (Right to be forgotten)**. In certain cases you are entitled to obtain from us the erasure of your personal data. |
| 299 | 299 | - **Right to restriction of processing**. In certain cases you are entitled to obtain from us restriction of the processing your personal data, for example if you contest the accuracy of the personal data or the processing is unlawful and you oppose the erasure of the personal data and requests the restriction of their use instead. |
| 300 | 300 | - **Right to data portability**. If you have made the data available to us based on a contract or consent, you are entitled to request the transfer of your personal data. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. |
| 301 | - **Right to object** | |
− REMOVEDDuplicate 'Right to object' bullet removed A short, redundant bullet point titled 'Right to object' was removed from the list of data rights. The full explanation of this right, in its own paragraph right after the list, is unchanged and still describes the right in detail. | ||
| 302 | 301 | |
| 303 | 302 | **Right to object on a case-by-case basis** You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on our legitimate interests (Art. 6 (1) f) GDPR); including profiling based on these provisions. We will then no longer process such personal data for those purposes, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is necessary for the establishment of, exercise of, or defence against any legal claims. |
| 304 | 303 | |
| 305 | 304 | **Objection to data processing for the purpose of direct marketing** |
| 306 | 305 | |
| 307 | 306 | To the extent we process your personal data for the purpose of direct marketing you have the right to object at any time to the processing of personal data concerning you for these purposes. If you object to the processing for direct marketing purposes, we will no longer process your personal data for these purposes. |
ALSO IN THIS CHANGE, NOT TIED TO ONE LINE
- ± CHANGEDMinor formatting fixes
Small formatting tweaks were made: a missing space was added after 'Account Settings', a section heading was added above the 'My Kaspersky' section, and spacing between linked product names in the B2B Portals heading was adjusted. None of these change what the policy actually says.