Aftra Privacy Policy

Effective Date: 19.06.2025
This privacy policy applies to the processing of personal data directly provided by you or
collected as a result of you visiting this website. If we process your personal data in a different
context or circumstances a separate notice will apply.

Who are we?
Information We Collect
How We Use Your Information
Data Retention and Deletion
Who Might Access or Receive Your Personal Data?
Marketing
International Operations
Compliance and Certifications
Security Measures
Your Rights and Responsibilities
Cookies and Tracking Technologies
Data sharing
Data Breach Response
Contact Information
Changes to this Privacy Policy

Who Are We?

We are Aftra ehf. (“Aftra,” “we,” “our,” or “us”), a limited liability company, incorporated in Iceland (reg. no. 571023-2020), whose registered office is at Borgartúni 37, 105 Reykjavík, Iceland.

We at Aftra recognize the importance of security and privacy and one of our main priorities is the privacy of our users and the protection of their personal data. We highly value the trust you place in us when you share your personal data, and we are dedicated to protecting it. This Privacy Policy describes how we process your personal data and outlines your rights in accordance with the Icelandic Regulation about Persónuvernd og vinnslu persónuupplýsinga nr. 90/2018 and the EU General Data Protection Regulation (GDPR) no. 2016/679 and other applicable data protection laws.

Aftra acts as a data controller within the meaning of Act No. 90/2018 on Data Protection and the Processing of Personal Data for the personal data necessary to provide our services, information gathered through customer support interactions, and data collected when you visit our website or interact with us on social media. Our approach to data privacy is centered on transparency, security, and giving you control over your information.

We recognize that information privacy is an ongoing responsibility, and so we will from time to time update this Privacy Policy as we undertake new personal data practices or adopt new privacy policies or practices. By using our services, you agree to the practices described in this Privacy Policy.

Information We Collect

As a result of you visiting our website, we may collect or otherwise process your personal data in the following ways:

• Information you provide directly:

  • When you provide your personal data on a contact form (e.g., name, email address, company).

  • When you contact us by other means, such as email or telephone (e.g., name, email address, phone number, and any information you choose to provide in your communication).

• Anonymized Customer Data:
  Aftra ensures that all customer data is anonymized and cannot be directly linked to individuals unless explicitly required as part of real-time scanning or customer-defined actions.

• Employee-Specific Data:
  Our real-time scanning features may collect data related to employees of customer organizations, such as exposure of employee credentials in breaches. It is the customer's responsibility to obtain consent from their employees where required by applicable law.

• Internal Network Configuration:
  To identify vulnerabilities and protect customer networks, we may collect internal network configurations and scan systems as part of our services. This data is handled securely and is not shared outside the scope of our agreement with the customer.

• Public Data From OSINT Databases:
  We collect DNS, domain information, and other publicly available data from Open-Source Intelligence (OSINT) databases. No sensitive or private data is collected through these sources.

• Information collected automatically:

  • Information provided by your web browser (e.g., browser type, language).

  • Information collected through the use of cookies and similar technologies (e.g., IP address, browsing behavior, website usage data). See the "Cookies and Tracking Technologies" section below for more details.

How We Use Your Information

Any personal data that you provide to us may be retained by us to provide a requested service, or for our legitimate interests as a business. You do not have to give us any of your personal data in order to use most of the website. However, if you wish to take advantage of some of the services we provide on our website, you will need to provide certain information. In general, our legal basis for processing your personal data is that it is in our legitimate interests to do so, although we would refrain from doing so if our legitimate interests were overridden by your interests or fundamental rights and freedoms. We have an interest in operating our business in the most customer-focused and professional way, and our processing of personal data is done in accordance with this.

Data Retention and Deletion

Customer data is retained for up to three (3) months after the termination of a customer’s agreement. All customer data is automatically deleted upon account termination unless otherwise required by applicable laws or regulations.

Upon termination of the agreement of service, and at your choice, we will delete or return all personal data to you and delete existing copies. If the return of data requires substantial work on our part, such work will be subject to a service fee in accordance with our then-current price list.

Who Might Access or Receive Your Personal Data?

Aftra does not sell personal or customer data. Recipients of personal data provided as a result of your visiting this website will generally only consist of our employees who require access to fulfill their job duties. In certain circumstances, we may share anonymized or aggregated data under the following conditions:

• Service Providers: We may share your data with trusted third-party service providers who assist us in operating our website, conducting our business, serving you or to perform essential services on our behalf, such as:

  • Cloud hosting providers.

  • Analytics providers.

  • Marketing platforms.

• Legal and Regulatory Authorities: We may be compelled to provide information we hold to third parties, such as regulatory or law enforcement authorities, to comply with applicable laws, regulations, government requests, or legal processes. We would only do so in compliance with the law and where strictly necessary.

• With Consent: When explicitly authorized by the customer.

Marketing

If you have requested services or updates, we may occasionally send you emails that you have requested. In accordance with applicable marketing laws, we may also send you information that we feel may interest you and/or are relevant to your business. Such mailings may include details of our products, newsletters, updates, and invitations to our various events. We will only send you such marketing communications if you have opted in to receive them, or as otherwise permitted by law, and we will always offer you the option to opt out of any future marketing communications.

International Operations

We serve customers globally, ensuring compliance for each customer with local regulations.