Privacy notice · Outerwall

Who we are

Outerwall is a cybersecurity company based in Dublin, Ireland. For the personal data described here, Outerwall decides how it is used, so we are its controller, except where we read data from a client’s systems on behalf of a partner, as set out below. You can reach us about privacy at privacy@outerwall.ai.

What we hold, and why

What we hold	Why	Lawful basis
What you send us through the application form: your name, work email, company, role, the number of organizations you protect, your PSA and your message	To reply to you and assess your application	Our legitimate interest in replying, and steps you ask for before a contract
Emails you send us	To reply to you	Our legitimate interest in replying
Contact details of people at our partners and the organizations they protect	To run the service: approvals, scope, notice of our scan addresses and alerts	Our contract with the partner, and our legitimate interests
Public information about organizations: domains, hosts, suppliers, published records and job ads, and in some cases work email addresses that appear in public breach data	To warn the organizations concerned and help protect them	Our legitimate interest, and theirs, in the security of networks and information
Settings and metadata a client lets us read from Microsoft 365, never mail, files or chats	To measure what an attacker could reach inside that client	We process it for the partner and its client under their agreement with us

This website

This website doesn’t use advertising or analytics cookies. It stores one small value in your browser for the length of your visit, so the opening animation plays only once. Its fonts and scripts come from our own site, not from third parties.

Who we share it with

Service providers that host our systems and email, and Formspree, which receives the application form for us. They act only on our instructions.
The partner that looks after an organization, when that organization or someone there contacts us.
Penetration testers, only the details a test needs, when a client orders one.
Authorities, when the law requires it.

We don’t sell personal data, and we never use what we learn about an organization to sell to it.

Transfers outside the EEA

Some of our providers, Formspree among them, are in the United States. Where personal data leaves the European Economic Area, we rely on an adequacy decision, such as the EU-US Data Privacy Framework where the provider is certified, or on the European Commission’s standard contractual clauses.

How long we keep it

Application and enquiry details for up to two years after our last contact, unless you become a partner.
Partner and client records for as long as the agreement lasts, and afterwards for as long as the law requires.
Findings from public sources while they are current, and matches from breach data only as long as they are needed to warn the organization concerned.

Your rights

You can ask for a copy of your personal data, and ask us to correct it, delete it, restrict how we use it or send it to you in a portable form. You can object to any use based on our legitimate interests, including the processing of public information about you. Email privacy@outerwall.ai and we’ll reply within a month.

You can also complain to the Data Protection Commission in Ireland, at dataprotection.ie.

How we protect it

We protect personal data with access controls, encryption, and the same walls that keep each client’s data apart from every other client’s. Only people who need it to do their work can see it.

Changes to this notice

We update this notice when our practices change. The date at the top shows when it last changed.