# Privacy notice

> Privacy notice: what personal data the platform processes, why, on what legal basis, for how long, and how to exercise your rights under the GDPR.

Source: https://wahukeza.com/legal/privacy

Legal

## Privacy notice

Privacy notice: what personal data the platform processes, why, on what legal basis, for how long, and how to exercise your rights under the GDPR.

Draft pending counsel review.

This text is maintained by engineering to reflect what the platform actually does. Trony Network's legal department confirms registered address, sub-processors and transfer mechanism before it is final. It is not legal advice.

## Who this applies to

This notice covers personal data processed by the Wahukeza threat-intelligence platform. It concerns two very different groups: **(a)** operators of infrastructure that attacks monitored systems, whose IP addresses we process for security; and **(b)** our customers’ authorised users (analysts and administrators) and, where we monitor a customer’s assets, that customer’s account holders. Visitors to this website are covered separately, in This website below.

## What we process, why, and on what basis

| Data | Purpose | Legal basis | Retention |
| --- | --- | --- | --- |
| Attacker IP addresses, attack telemetry | Detect and prevent attacks; threat intelligence | Legitimate interest: network security (GDPR Art. 6(1)(f), Recital 49) | Until inactive + 365 days, then deleted; individual sightings are deleted a calendar month at a time, up to one month beyond their 180-day window |
| Captured brute-force credentials, payloads | Attack analysis | Legitimate interest | Events 90 days, artifacts 180 days; events are deleted a calendar month at a time |
| Breach-exposure records (masked and hashed only) | Alert customers to compromised accounts | Processing for the customer, who is the controller | 365 days |
| Account and audit data (users, logins, actions) | Operate and secure the service | Contract / legitimate interest | Accounts until deletion; logs 365 days |
| Customer scam reports (what happened, a link, a number, an account, an IBAN, a QR payload; your network prefix only; no name, no e-mail address, no image) | Warn the bank and its other customers about a scam you report | Your own act of reporting; legitimate interest: fraud prevention (GDPR Art. 6(1)(f), Recital 47) | 90 days, then deleted. A number or account you name becomes a warning only after several independent reports or an analyst’s review |
| Public app-store listings and public social-media posts that name a protected brand (developer or channel name, title, icon, post text) | Find fake apps and scam channels impersonating the brand | Legitimate interest: fraud prevention and brand protection | Post text 90 days; a listing for as long as the brand is monitored |
| Public-code leak findings (repository, path, a masked secret and its hash, one redacted excerpt; the repository owner’s public GitHub login for at most 90 days) | Find the organisation’s leaked credentials in public code so they can be rotated | Legitimate interest: network security (GDPR Art. 6(1)(f), Recital 49) | Findings 365 days from last sight; the login 90 days, then removed |
| Availability telemetry from the organisation’s own routers and servers (traffic counters; the busiest attacking source networks as /24 (IPv6 /48) prefixes, never an individual address; target addresses only among the organisation’s own service addresses. No subscriber address or flow record leaves the organisation’s own collector) | Detect denial-of-service attacks on the organisation’s own services and say when they are over | Legitimate interest: network security (GDPR Art. 6(1)(f), Recital 49) | Per-minute counters 90 days, deleted a calendar month at a time, so up to one calendar month beyond; attack events with their prefixes 365 days |

Retention windows above are the platform defaults. A deployment may tighten them through its retention configuration, never loosen them beyond what this notice states.

We **do not** sell personal data. We **do not** perform automated decision-making that produces legal effects on private individuals. Special-category data is not intentionally processed.

## Data minimisation and security

Breach-exposure accounts are stored masked and one-way hashed, never in plaintext. Only sanitised attacker technique and infrastructure is ever shared externally; never victim data or raw payloads. Data is protected by encryption in transit, access controls, scoped API keys and audit logging. Each customer’s data is held in its **own database**.

## Sharing and recipients

-   **Threat-intelligence feeds**: attacker indicators backed by redistributable evidence may be shared with customers and their enforcement systems.
-   **Collective exchange** (opt-in): sanitised attacker observables only.
-   **Public feed** (opt-in, off by default): where a deployment switches it on, attacker IP addresses only (delayed 48 hours, capped at 1,000 entries, drawn solely from first-party sensor telemetry and exchange contributions) are published at an unauthenticated URL. No credentials, payloads, URLs or transcripts can reach it, and no identity is recorded for anyone who reads it.
-   **Sub-processors**: the hosting provider(s) of a given deployment. The authoritative list is maintained in the Data Processing Agreement and provided to customers on request.
-   **International transfers**: where personal data is transferred across borders, an adequacy decision or Standard Contractual Clauses apply as applicable; the hosting region and mechanism for a deployment are set out in the DPA.

## Your rights

Subject to legal limits, you may request access, rectification, erasure, restriction, portability and objection. We may lawfully decline to erase attacker data where retention is necessary for network security or legal claims (GDPR Art. 17(3)); such requests are assessed individually.

To exercise a right, contact the privacy address in the footer. You may also lodge a complaint with your data-protection supervisory authority.

## This website

wahukeza.com is a static site. It has no accounts or forms that store data; a request to contact us opens your own e-mail client.

-   **Without your consent** nothing is set and nothing from Google is loaded. The site remembers your choice in your browser’s local storage (key `wz-consent`), which never leaves your device.
-   **With your consent** we load Google Analytics 4 through Google Tag Manager to learn which pages are read and how visitors arrive. Google sets the `_ga` and `_ga_*` cookies (up to two years) and receives the pages you visit, the referring page, your browser and device type, approximate location derived from your IP address, and on-page interactions. We do not use it for advertising or combine it with other data.
-   **Legal basis**: your consent (GDPR Art. 6(1)(a) and the ePrivacy rules on cookies). You can withdraw it at any time through **Cookie settings** in the footer; the analytics cookies are then removed.
-   **Recipient**: Google Ireland Limited as our processor. Google may process data in the United States under the EU-US Data Privacy Framework.
-   **Hosting**: the site is served through Cloudflare, which processes connection data (including IP addresses) to deliver and protect it, and from our own server, which keeps no access logs.

## Changes

We may update this notice; the date above reflects the latest version.

Controller: Trony Network · Privacy contact: privacy@trony.network · Last updated 2026-11-07

Other documents

-   [Data processing agreement](https://wahukeza.com/legal/dpa)
-   [Records of processing](https://wahukeza.com/legal/records-of-processing)
-   [Security & trust](https://wahukeza.com/security)

The legitimate-interest assessment and the breach-response runbook are provided to customers on request.