This page explains how HWKeeper complies with the EU General Data Protection Regulation (GDPR) and the UK GDPR. It summarises what is set out in detail in our Privacy Policy and Terms of Service, and it is the starting point for a company that must document its own compliance.
1. Our roles
- Processor for the data collected from the computers where a customer installs the agent (hardware, software, USB devices, network, location). The customer decides which devices to monitor and why; we process this data only on the customer’s instructions, as described in the Terms of Service and the Privacy Policy.
- Controller for dashboard accounts (email, name, role, sign-in events), for requests sent through the website forms, and for website analytics.
Controller or processor: Alex Semensky, operator of HWKeeper. Contact for all GDPR matters: privacy@hwkeeper.com.
2. Where data is stored
- The service, its database and its mail server run on a server located in the European Union.
- Daily backups are kept for up to 14 days.
- Some sub-processors (section 4) may process data outside the EU; see section 8.
3. Legal bases
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Providing the service: inventory, change detection, alerts, reports, tickets | Performance of a contract (6(1)(b)); for device data — the customer’s instructions as controller |
| Account security: sign-in log, rate limiting, protection against fake registrations | Legitimate interests (6(1)(f)) |
| Service emails: email confirmation, sign-in codes, alerts you configured | Performance of a contract (6(1)(b)) |
| Replying to requests from the website forms | Steps at your request before a contract (6(1)(b)) and legitimate interests (6(1)(f)) |
| Website analytics (Google Analytics) | Consent (6(1)(a)) in the EEA, the UK and Switzerland |
| Keeping or disclosing data when the law requires it | Legal obligation (6(1)(c)) |
4. Sub-processors
We use the following third parties to provide the service. We do not sell data and we do not share it with advertisers.
| Service | Purpose | Data involved |
|---|---|---|
| RuVPS (ruvps.net) — virtual server in the European Union | Running the service, the database and the mail server | All service data, encrypted in transit |
| ip-api.com | Determining the country, city and internet provider of a computer by its public IP address | Public IP addresses of computers with the agent |
| beaconDB (api.beacondb.net) | Estimating a computer’s location from nearby Wi-Fi access points, only when the customer keeps location on | Identifiers of nearby Wi-Fi access points and signal strength; no computer or user names |
| Google LLC — Google Analytics | Usage statistics of the public website | Pseudonymous visit data from the website only, with consent where required; no dashboard data |
| Telegram (Telegram FZ-LLC) | Delivering alerts, only if the customer connects a Telegram bot | Alert text: computer name, rule, description, time |
| Customer-configured webhooks | Delivering alerts to the customer’s own systems | Alert data, sent to the addresses the customer specifies |
We will announce a new sub-processor on this page at least 14 days before it starts processing customer data; account administrators are notified by email.
5. Your rights
Under the GDPR you may ask us to:
- confirm whether we process your personal data and give you a copy (access);
- correct inaccurate data (rectification);
- delete your data (erasure), including deletion of a whole account;
- restrict processing or object to processing based on legitimate interests;
- receive the data you provided in a machine-readable format (portability);
- withdraw consent at any time, for example for website analytics.
Write to privacy@hwkeeper.com from the email address of your account. We answer within 30 days. You also have the right to lodge a complaint with the supervisory authority of your country.
If your employer monitors your computer with HWKeeper, the employer is the controller of that data: please contact them first. If you write to us, we will forward your request to them and help them answer it.
6. Data processing agreement
The Terms of Service and the Privacy Policy set out how we process data on behalf of customers: only on the customer’s instructions, with the security measures described on the Security page, with the sub-processors listed above, and with deletion at the end of the service. A customer that needs a signed data processing agreement (Art. 28 GDPR) can request one at privacy@hwkeeper.com.
7. Customer responsibilities
- Install the agent only on devices your organization owns or is authorized to manage.
- Have a legal basis for monitoring and inform the people who use the devices, especially about location tracking and network discovery. Both can be turned off in the agent settings.
- Give dashboard access only to people who need it, and remove users who leave.
- Delete devices and accounts you no longer need.
8. International transfers
Service data is stored in the European Union. Where a sub-processor processes data outside the EU — for example Google LLC in the United States — the transfer relies on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework or on standard contractual clauses, as provided by that sub-processor.
9. Security
Technical and organizational measures are described on the Security page: encryption in transit, isolation of each organization’s data in the database, roles, per-device agent keys, hashed passwords and sign-in codes, backups.
10. Personal data breaches
If a breach affects personal data we process for a customer, we inform the customer’s account administrators without undue delay after becoming aware of it, and no later than 72 hours, with what we know about the breach, the data concerned and the measures taken, so that the customer can meet its own notification duties.
11. Retention and deletion
Retention periods are listed in the Privacy Policy. When a device is deleted from the account, its data is deleted with it. When an account is deleted on request, we delete its data within 30 days; copies disappear from backups within the following 14 days.
12. Children
The service is intended for companies and is not meant for people under 16.
13. Changes
We update this page when our processing changes and show the date of the current version at the top. Questions: privacy@hwkeeper.com.