Privacy Policy

1. INTRODUCTION AND SCOPE

BeyondNets ("BeyondNets," "we," "us," or "our") respects privacy and is committed to protecting personal information. This Privacy Policy describes how we collect, use, disclose, retain, and protect personal information through our websites, communications, business operations, managed and professional services, cybersecurity and infrastructure services, software, integrations, and NCERIO platform (collectively, the "Services").

This Policy applies when individuals visit our websites, contact us, request information or demonstrations, create or use accounts, purchase or use Services, receive communications, use NCERIO, or otherwise interact with BeyondNets.

Additional contractual privacy and security terms may apply to information BeyondNets processes on behalf of customers.

2. OUR ROLE

Depending on the circumstances, BeyondNets may act as a controller/business or as a processor/service provider.

When BeyondNets determines why and how information is processed for its own website, sales, marketing, account administration, billing, security, and business operations, BeyondNets generally acts as the controller or business.

When BeyondNets processes information contained in customer systems, networks, cloud environments, logs, configurations, security data, or other customer-provided information to deliver contracted Services, BeyondNets generally acts as a processor or service provider on behalf of that customer.

Where we act on behalf of a customer, the applicable customer generally controls the processing and privacy requests concerning that information should normally be directed to the customer. An MSA, SOW, DPA, or other agreement may provide additional terms.

3. INFORMATION WE MAY COLLECT

Depending on the interaction, BeyondNets may collect:

Contact and identity information, including name, business email, telephone number, job title, employer, business address, and account identifiers.

Account and authentication information, including usernames, roles, permissions, login activity, authentication information, MFA status, and account preferences.

Commercial and customer information, including company information, subscriptions, orders, proposals, contracts, SOWs, invoices, support history, and project information.

Communications, including emails, support requests, forms, chat interactions, SMS messages, meeting notes, tickets, and other business communications.

Website and device information, including IP address, browser, operating system, device type, referring page, pages viewed, timestamps, session information, cookie identifiers, approximate location derived from IP address, and diagnostic information.

Technical and network information, including IP addresses, hostnames, device identifiers, MAC addresses, topology, routing, VLAN, firewall, switch, wireless, server, cloud, operating system, firmware, VPN, identity, authentication, configuration, logging, backup, performance, and diagnostic information.

Cybersecurity information, including vulnerabilities, known exploited vulnerabilities, indicators of compromise, authentication events, security alerts, malware indicators, exposures, configuration weaknesses, incident-response information, and threat intelligence.

Technical or cybersecurity data may incidentally contain personal information relating to employees, contractors, customers, users, or other individuals.

4. NCERIO DATA

NCERIO may process technical and security information necessary to provide configuration analysis, security assessments, vulnerability analysis, compliance-related analysis, reporting, monitoring, network discovery, security analytics, and related functionality.

Depending on enabled features and integrations, this may include device configurations; network topology; platform identifiers; firmware and software versions; security configurations; vulnerabilities and known exploited vulnerabilities; identity and access information; authentication and MFA-related information; security and compliance-related findings; logs and events; customer-supplied documentation; user queries submitted to Ask NCERIO; and information necessary to generate reports and recommendations.

The exact information processed depends on the customer environment, integrations, enabled modules, and contracted Services.

5. ARTIFICIAL INTELLIGENCE AND ASK NCERIO

Certain BeyondNets and NCERIO capabilities may use artificial intelligence, machine learning, automated analysis, or large language models.

When a user submits a query to an AI-assisted feature, BeyondNets may process the query, authorized contextual information, generated responses, and technical metadata necessary to provide, secure, troubleshoot, and improve that feature.

Customers should submit information to AI-assisted features only when authorized to do so.

Unless expressly agreed otherwise, BeyondNets does not use Customer Confidential Information, private customer network configurations, customer security logs, customer credentials, or private Ask NCERIO conversations to train public or generally available third-party AI models.

BeyondNets may use appropriately aggregated or de-identified information that does not reasonably identify a customer or individual to improve products, analytics, security capabilities, and Services, subject to applicable law and contractual obligations.

Where third-party AI providers process customer information, applicable contractual, security, and privacy protections may also apply.

6. CREDENTIALS AND SECRETS

Providing managed technology and cybersecurity Services may require BeyondNets to process credentials, API keys, tokens, certificates, authentication information, or other secrets.

BeyondNets will use such information only as reasonably necessary to provide, secure, administer, or support applicable Services and will apply safeguards appropriate to its sensitivity.

Customers should provide credentials using approved secure methods rather than ordinary unencrypted communications whenever reasonably possible.

7. SOURCES OF INFORMATION

We may collect information directly from individuals and customer organizations; automatically through websites and Services; through customer-authorized systems, devices, integrations, and APIs; from service providers and technology vendors; from security and threat-intelligence sources; from publicly available sources; and from other sources permitted by law.

8. HOW WE USE INFORMATION

We may use information to provide, operate, secure, configure, maintain, monitor, and troubleshoot Services; conduct security and configuration assessments; detect and investigate security events; generate reports and recommendations; provide NCERIO and AI-assisted functionality; authenticate users; administer accounts; respond to support requests; communicate with customers; process orders and billing; manage contracts; improve and develop Services; maintain reliability; prevent fraud and abuse; comply with law; maintain records; establish or defend legal claims; perform internal analytics; and market Services where permitted.

Where applicable law requires a legal basis, processing may rely on contract performance, steps requested before contract formation, legal obligations, legitimate interests, consent, security interests, or another recognized lawful basis.

9. COOKIES, ANALYTICS, AND SIMILAR TECHNOLOGIES

BeyondNets websites may use cookies and similar technologies for essential functionality, security, session management, preferences, analytics, performance measurement, and marketing where applicable.

Analytics information may include device information, IP address, browser information, pages viewed, approximate location, referral information, and interaction data.

Where required by law, BeyondNets will provide appropriate notices, consent mechanisms, or preference controls.

10. HOW WE DISCLOSE INFORMATION

BeyondNets may disclose information to authorized employees and contractors; hosting, cloud, data-center, security, monitoring, software, communications, payment, and billing providers; professional advisers; customer-authorized third parties; subprocessors used to provide contracted Services; governmental authorities where legally required; and other parties authorized by the individual or customer.

BeyondNets does not disclose customer information merely because that information is technically accessible to BeyondNets.

Where BeyondNets acts as a processor or service provider, use of subprocessors may also be governed by an applicable DPA or customer agreement. We take reasonable steps to require providers processing protected customer information to maintain appropriate confidentiality, privacy, and security obligations.

11. SALE, SHARING, AND TARGETED ADVERTISING

BeyondNets does not sell personal information for monetary consideration.

Because definitions of "sale," "sharing," and "targeted advertising" vary under U.S. state privacy laws, BeyondNets will evaluate advertising, analytics, cookies, and similar technologies and provide notices and opt-out mechanisms where legally required.

12. MARKETING, EMAIL, AND SMS

BeyondNets may send business and marketing communications where permitted by law. Recipients may unsubscribe from marketing email through the provided unsubscribe mechanism or by contacting BeyondNets. Marketing opt-outs do not prevent necessary transactional, account, security, billing, or service communications.

For SMS communications, message frequency may vary and message/data rates may apply. Consent to marketing texts is not a condition of purchase where prohibited by law. Users may use applicable STOP and HELP mechanisms where supported.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties.

BeyondNets will not use SMS consent information for unrelated third-party marketing except as permitted by law and properly disclosed.

13. DATA RETENTION

BeyondNets retains information only as long as reasonably necessary for the purposes for which it was collected, including providing Services, maintaining security and business records, satisfying contractual and legal obligations, resolving disputes, enforcing agreements, and maintaining appropriate backup and audit records.

Retention varies according to information type and sensitivity, customer instructions, contractual obligations, security requirements, legal or regulatory requirements, backup cycles, and legitimate business needs.

Customer data processed on behalf of a customer may be returned, deleted, or retained according to the applicable agreement, DPA, retention schedule, technical capabilities, and legal requirements.

14. INFORMATION SECURITY

BeyondNets uses administrative, technical, and physical safeguards designed to protect information from unauthorized access, use, alteration, loss, destruction, or disclosure.

Depending on the system and risk, safeguards may include access controls, authentication, encryption, logging, monitoring, network security, secure configuration, backups, vulnerability management, and personnel security practices.

No security program, system, network, or transmission method can guarantee absolute security.

15. SECURITY INCIDENTS

BeyondNets maintains processes intended to identify, investigate, contain, and respond to security incidents affecting systems or information under its control.

Where BeyondNets processes personal information for a customer, incident-notification obligations will be governed by applicable law and the applicable customer agreement or DPA. This Policy does not expand contractual notification obligations beyond applicable law or agreement.

16. INTERNATIONAL DATA TRANSFERS

BeyondNets and its providers may process information in the United States and other countries in which they operate. Where required by law, appropriate safeguards will be used for international transfers.

Customers with specific data-residency requirements should address those requirements in the applicable agreement before using relevant Services.

17. U.S. STATE PRIVACY RIGHTS

Residents of certain U.S. states may have rights under applicable privacy laws, potentially including rights to access or know personal information; correct inaccuracies; delete certain information; obtain portable copies; opt out of certain sales, sharing, or targeted advertising; limit certain uses of sensitive information; and appeal certain privacy-request decisions.

Availability and scope depend on applicable law and circumstances. BeyondNets will not unlawfully discriminate against individuals for exercising applicable privacy rights.

Where California law applies, eligible residents may have rights under the CCPA/CPRA. BeyondNets does not sell personal information for monetary consideration. If BeyondNets engages in conduct legally considered "sharing" for cross-context behavioral advertising, applicable disclosures and opt-out mechanisms will be provided.

18. PRIVACY REQUESTS

Individuals seeking to exercise applicable privacy rights may contact BeyondNets using the privacy contact method published on the official BeyondNets website.

Requests should provide enough information to identify the requester and understand the request. BeyondNets may reasonably verify identity and authority before responding. Authorized agents may be required to provide evidence of authority.

If information is processed solely on behalf of a customer, BeyondNets may direct the requester to that customer or assist the customer as required by law or contract.

19. CHILDREN'S PRIVACY

BeyondNets Services are intended primarily for businesses and professional users and are not directed to children under 13. BeyondNets does not knowingly collect personal information directly from children under 13 through general-public Services without appropriate authorization or another lawful basis.

If BeyondNets learns that information was collected from a child in circumstances prohibited by applicable law, appropriate steps will be taken.

20. CUSTOMER RESPONSIBILITIES

Customers are responsible for ensuring they have appropriate authority and lawful bases to provide personal information to BeyondNets and authorize its processing as part of the Services.

Customers are responsible for providing privacy notices to their employees, users, customers, contractors, and other individuals where required.

21. THIRD-PARTY LINKS AND SERVICES

BeyondNets websites and Services may contain links to or integrations with third-party websites, applications, and services. BeyondNets is not responsible for the privacy practices of independent third parties. Users should review applicable third-party privacy policies.

22. BUSINESS TRANSACTIONS AND LEGAL DISCLOSURES

Information may be disclosed or transferred in connection with an actual or proposed merger, acquisition, financing, reorganization, bankruptcy, asset sale, or similar corporate transaction, subject to applicable confidentiality protections and law.

BeyondNets may preserve or disclose information when reasonably necessary to comply with law, regulation, subpoena, court order, or legal process; respond to lawful governmental requests; protect rights, property, safety, systems, or users; investigate fraud, abuse, or security incidents; enforce agreements; or establish, exercise, or defend legal claims.

Where legally permitted and appropriate, BeyondNets may notify affected customers of governmental demands involving customer-controlled information.

23. PRIVACY SIGNALS

Where BeyondNets is legally required to recognize a qualifying universal opt-out mechanism, including an applicable Global Privacy Control signal, BeyondNets will process that signal as required by applicable law.

Because browser "Do Not Track" standards are not universally defined, BeyondNets may not respond to ordinary Do Not Track signals except where required by law.

24. CHANGES TO THIS PRIVACY POLICY

BeyondNets may update this Privacy Policy as Services, technologies, vendors, legal requirements, and privacy practices change. The revised Policy will display an updated effective date.

Where required by law, BeyondNets will provide additional notice or obtain consent before materially different processing begins.

25. CONTACT US

Questions or privacy requests may be submitted using the contact information or privacy-request method published on the official BeyondNets website.