Privacy Policy

ICTL CORP TECHNOLOGY LTD (trading as "ICTL CORP") is a cybersecurity company registered in the Dubai International Financial Centre (DIFC), Dubai, United Arab Emirates.

• Registered location: DIFC, Dubai, United Arab Emirates
• Legal and privacy enquiries: legal@ictlcorp.com

For the purposes of the DIFC Data Protection Law 2020 ("DIFC DPL") and, where applicable, the EU General Data Protection Regulation ("GDPR") and the UK GDPR, ICTL CORP is the controller of the personal data described in this Policy, except where we act as a processor on behalf of a business customer (see Section 6).

Understanding our model is important to understanding how we handle data:

• Business customers only. Access to the DarkStream platform is restricted to verified organisations.
• Verified-asset access. A customer can only view exposure data that matches digital assets, such as a domain, that the customer has registered and whose ownership or control has been verified.
• No open look-ups. We do not allow customers, or anyone else, to search for or view exposure data relating to assets they do not own or control. Access controls are enforced server-side.
• Alerting is scoped to the customer's own assets. Automated alerts, sent via Telegram, email, or SMS, notify a customer only of new exposures affecting that customer's own verified assets.

We collect the following categories of data:

• Account and contact data: name, business email address, role, and company details provided at registration.
• Verified-asset data: domains and other digital assets registered by a customer, along with the verification method used to confirm ownership.
• Usage and technical data: log data, device and browser information, and interactions with the Services, collected for security and service-improvement purposes.
• Billing data: processed through our payment provider; we do not store full card numbers ourselves.
• Threat-intelligence data: exposure records matched against a customer's verified assets, described further in Section 5.

We use personal data to provide, secure, and improve the Services; to authenticate accounts and enforce access scoping; to deliver alerts; to process billing; to respond to support requests; to meet legal and regulatory obligations; and to communicate with customers about their account and material changes to the Services. Where we rely on legitimate interests as our legal basis, we balance those interests against the rights of the individuals concerned. You may request a summary of our balancing assessment at legal@ictlcorp.com.

The threat-intelligence data we process is obtained from third-party breach and leak data sources and from open-source intelligence. We did not collect this data from you directly. We apply technical and organisational measures to limit our processing to what is necessary to deliver monitoring and alerting to affected organisations.

Where a customer instructs us to monitor specific identifiers belonging to its own personnel or users, for example corporate email addresses added to its account, we process that customer-provided personal data as a processor acting on the customer's documented instructions. In that case, the customer is the controller, and the processing is governed by our Data Processing Agreement ("DPA"), which forms part of our contract with the customer. The DPA addresses confidentiality, security, sub-processing, international transfers, assistance with data-subject requests, breach notification, and deletion or return of data.

We do not sell, rent, or trade personal data. We disclose personal data only:

• to sub-processors who provide infrastructure and operational services to us under written contracts that impose equivalent data-protection and security obligations;
• to a customer, limited to exposure data relating to that customer's own verified assets;
• to professional advisers, auditors, or insurers, under confidentiality obligations;
• to competent authorities, regulators, or law enforcement where required by applicable law or to establish, exercise, or defend legal claims; and
• in connection with a corporate transaction, such as a merger, acquisition, or asset sale, subject to appropriate confidentiality and continuity safeguards.

ICTL CORP is established in the DIFC, and our infrastructure and sub-processors may be located in the European Economic Area (EEA) and other jurisdictions. Where we transfer personal data across borders, we rely on a lawful transfer mechanism, such as a determination of adequacy, the EU Standard Contractual Clauses, the DIFC DPL transfer provisions, or equivalent contractual safeguards, together with supplementary measures where appropriate. You may request information about the safeguards we apply at legal@ictlcorp.com.

We retain personal data only for as long as necessary for the purposes set out in this Policy:

• Account and contact data: for the duration of the customer relationship and a reasonable period thereafter for legal, accounting, and dispute-resolution purposes.
• Verified-asset and threat-intelligence data: for as long as the related subscription is active, and in masked or teaser form thereafter unless deletion is requested.
• Billing records: for the period required by applicable tax and accounting law.

Depending on your location and applicable law, you may have the right to request access to, correction of, or deletion of your personal data, to object to or restrict certain processing, and to request data portability. Where a customer is the controller of your data under Section 6, please direct your request to that organisation in the first instance; we will assist them in responding. Otherwise, contact us at legal@ictlcorp.com.

We apply technical and organisational measures designed to protect personal data against unauthorised access, loss, or misuse, including encryption in transit and at rest, access controls, and monitoring. Further detail is available on our Security page.

Our website uses strictly necessary cookies to function. We use analytics cookies only where permitted, and we do not use advertising or cross-site tracking cookies. Where consent is required, we obtain it through our cookie banner, and you can change your preferences at any time.

The Services are strictly B2B and are not directed to consumers or to individuals under the age of 18. We do not knowingly create accounts for, or market to, children. If we learn that we have inadvertently collected a child's personal data outside the threat-intelligence context, we will delete it.

We may update this Policy from time to time. We will post the updated version with a revised "Last updated" date and, where changes are material, provide additional notice through the Services or by email.

For any privacy or data protection enquiry, contact legal@ictlcorp.com. You may also lodge a complaint with the DIFC Commissioner of Data Protection or, if you are in the EEA or UK, with your local data protection supervisory authority.