ConnectProtect provides managed cybersecurity services that may require us to process personal data contained in or generated by our customers’ information technology environments.

For this processing, our customer is generally the data controller and ConnectProtect is the data processor. ConnectProtect processes the data for the purpose of providing the contracted security services and in accordance with the customer’s documented instructions.

Our services may include:

• security monitoring and Security Information and Event Management (SIEM);
• collection, aggregation and normalisation of security events and logs;
• correlation and analysis of security information;
• threat and anomaly detection;
• alert generation, triage and escalation;
• security incident investigation;
• threat hunting;
• incident detection and response;
• forensic analysis;
• evidence preservation;
• vulnerability identification and management;
• containment and remediation actions where authorised by the customer;
• security reporting; and
• post-incident analysis and reporting.

Personal Data Processed by the SOC

Depending upon the customer’s systems, configuration and services purchased, security telemetry may contain personal data including:

• names and business contact information;
• usernames and email addresses;
• user and account identifiers;
• IP addresses;
• device identifiers;
• authentication and login records;
• timestamps;
• network connection and traffic metadata;
• DNS, TLS and HTTPS-related metadata;
• application and system access logs;
• operating system and software information;
• device and system inventory information;
• Active Directory users and groups;
• email or communications metadata;
• user activity and audit logs;
• endpoint and process execution telemetry;
• file metadata;
• vulnerability information;
• incident records;
• information collected during security investigations; and
• geolocation information derived from IP addresses or other technical data.

The categories of information processed will vary according to the customer’s environment and the cybersecurity services the customer has chosen.

Our services are not intended to require customers to provide special-category personal data. However, such information may appear incidentally in security logs, systems or information examined during an investigation. Where this occurs, we process that information only as necessary to provide the contracted service and in accordance with the customer’s instructions.

Data Subjects

Customer security information may relate to individuals including:

• customer administrators;
• employees;
• contractors;
• agents;
• service users;
• end users; and
• other third parties whose information is present within systems monitored or investigated by the service.

Customer Responsibilities

Our customers are responsible for determining the lawful basis for processing personal data within their environments and for providing appropriate privacy information to affected individuals.

Where ConnectProtect acts solely as a processor, questions about why personal data is being processed or requests to exercise data protection rights should generally be directed to the relevant ConnectProtect customer.