Privacy Policy

Deployment of Difenso Solutions through Azure Marketplace and AWS Marketplace

Last updated: August 1st 2026

1. Purpose of this Policy

This Privacy Policy explains how Difenso collects, uses, stores, protects and shares personal data in connection with the marketing, deployment, use and support of its solutions made available through Azure Marketplace and AWS Marketplace.

This Policy applies in particular to:

• prospects, customers, administrators, technical contacts and business contacts;

• authorized users of Difenso solutions;

• individuals whose personal data may be included in logs, alerts, security events, metadata or content processed by Difenso solutions;

• interactions with Difenso through its websites, forms, demonstrations, support channels or business communications.

This Policy supplements, but does not replace, the privacy policies of Microsoft Azure Marketplace and AWS Marketplace, which remain applicable to the processing activities they carry out as independent data controllers.

2. Identity of the Data Controller

For processing activities carried out for its own purposes, the data controller is:

Difenso
Legal form: SAS
Registered address: 47 quai du Président Carnot 92210 Saint-Cloud
Company registration number: 811.099.019 RCS Nanterre
Privacy contact: privacy@difenso.com
Support contact: support@difenso.com

Where applicable, Difenso’s Data Protection Officer or GDPR contact may be reached at: dpo@difenso.com

3. Respective Roles of Difenso, Customers, Microsoft and AWS

Depending on the context, Difenso may act as either a data controller or a data processor.

3.1 Difenso as Data Controller

Difenso acts as a data controller when it determines the purposes and means of processing, including for:

• managing prospects, customers and business relationships;

• managing subscriptions purchased through Azure Marketplace or AWS Marketplace;

• billing, contractual follow-up and administration;

• customer support;

• service improvement;

• security of Difenso’s own systems;

• legal, regulatory and contractual compliance;

• B2B marketing communications, where permitted.

3.2 Difenso as Data Processor

Where Difenso solutions process personal data on behalf of a customer, including logs, security events, metadata, configurations, technical identifiers or customer-provided content, Difenso generally acts as a data processor within the meaning of the GDPR.

In this case:

• the customer remains the data controller;

• Difenso processes the data only on the customer’s documented instructions;

• the detailed terms are set out in the applicable agreement, Data Processing Agreement, terms of use or specific Marketplace offer terms.

3.3 Role of Microsoft and AWS

Microsoft and AWS process certain data relating to accounts, subscriptions, transactions, billing, security and operation of their marketplaces in accordance with their own policies and terms. Difenso does not control processing activities carried out by Microsoft or AWS for their own purposes.

4. Categories of Personal Data Collected

Difenso may process the following categories of personal data.

4.1 Identification and Contact Data

• first name and last name;

• job title;

• company name;

• business address;

• business email address;

• business phone number;

• Marketplace account or subscription identifiers;

• customer ID, tenant ID, subscription ID, account ID or equivalent identifiers.

4.2 Contractual, Business and Administrative Data

• information about subscribed offers;

• subscription start and end dates;

• service level;

• history of business communications;

• quote, demo or meeting requests;

• billing information transmitted or made available through the relevant marketplace.

4.3 Technical and Usage Data

• IP address;

• connection logs;

• technical identifiers;

• browser type, operating system and cloud environment;

• usage metrics;

• timestamps;

• administration logs;

• application errors;

• performance data;

• solution configuration;

• information required for activation, deployment, support and maintenance.

4.4 Security Data and Events Processed by Difenso Solutions

Depending on the deployed solution and the configuration selected by the customer, Difenso may process:

• event logs;

• security alerts;

• network or system metadata;

• usernames or business identifiers;

• IP addresses;

• technical fingerprints;

• indicators of compromise;

• information relating to security incidents;

• data contained in files, flows or systems analyzed where the customer transmits or makes such data available to the solution.

Difenso recommends that customers limit the transmission of personal data to what is strictly necessary, in accordance with the principles of data minimization and privacy by design.

4.5 Support Data

• support requests;

• tickets;

• technical traces;

• screenshots provided by the customer;

• files or logs voluntarily submitted;

• history of exchanges with support teams.

4.6 Browsing Data and Cookies

Where Difenso operates its own websites or portals, it may use cookies or similar technologies to ensure service operation, measure audience, secure access or improve user experience. A separate cookie policy may specify the purposes, retention periods and consent management methods.

5. Sources of Personal Data

Difenso may receive data:

• directly from the customer, its users or administrators;

• through Azure Marketplace;

• through AWS Marketplace;

• through Difenso portals, APIs, forms or interfaces;

• through the cloud environments in which the solutions are deployed;

• through support, CRM, billing or monitoring tools used by Difenso;

• through partners or resellers, where contractually and legally permitted.

6. Purposes and Legal Bases

Difenso processes personal data for the following purposes.

6.1 Marketplace Subscription Management

Purposes:

• offer activation;

• provisioning;

• license management;

• access rights verification;

• monitoring Azure Marketplace or AWS Marketplace subscriptions;

• managing renewals, suspensions or terminations.

Legal basis:

• performance of a contract or pre-contractual measures;

• Difenso’s legitimate interest in managing its services and subscriptions.

6.2 Provision and Operation of Difenso Solutions

Purposes:

• deployment;

• technical operation;

• monitoring;

• administration;

• maintenance;

• incident resolution;

• improving availability and performance.

Legal basis:

• performance of the customer contract;

• legitimate interest in ensuring service continuity, security and quality;

• where Difenso acts as processor, processing on the customer’s instructions.

6.3 Security, Cybersecurity and Abuse Prevention

Purposes:

• incident detection;

• analysis of security events;

• prevention of unauthorized access;

• prevention of fraud, abuse and unlawful use;

• logging;

• vulnerability management;

• protection of Difenso and customer systems.

Legal basis:

• legitimate interest of Difenso, the customer and users in securing systems;

• legal obligation, where applicable;

• performance of a contract.

6.4 Customer Support

Purposes:

• handling support requests;

• diagnosis;

• bug fixing;

• technical assistance;

• monitoring support quality.

Legal basis:

• performance of a contract;

• legitimate interest in responding to requests and improving the service.

6.5 Sales and Customer Relationship Management

Purposes:

• responding to information requests;

• organizing demonstrations;

• following up with prospects and customers;

• managing B2B commercial communications;

• satisfaction surveys;

• providing information about developments in Difenso solutions.

Legal basis:

• legitimate interest in B2B marketing and customer relationship management;

• consent where required;

• pre-contractual measures.

6.6 Billing, Accounting and Compliance

Purposes:

• administration;

• payment follow-up;

• accounting, tax and legal obligations;

• dispute management;

• responding to requests from competent authorities.

Legal basis:

• legal obligation;

• performance of a contract;

• legitimate interest in defending Difenso’s rights.

7. Sensitive Data

Difenso solutions are not designed to intentionally collect special categories of personal data within the meaning of Article 9 GDPR, such as health data, political opinions, religious beliefs, biometric data or data relating to sex life.

However, depending on the configuration chosen by the customer or the content transmitted to the solution, such data may accidentally appear in logs, files, tickets or analyzed flows. The customer is responsible for ensuring that data transmitted to Difenso is adequate, relevant and limited to what is necessary.

8. Recipients of Personal Data

Personal data may be accessed, within the limits of their responsibilities, by the following recipients:

• authorized Difenso personnel;

• support, security, operations, sales, legal or finance teams;

• technical service providers;

• cloud hosting providers;

• monitoring, ticketing, CRM, email, billing or cybersecurity providers;

• Microsoft, in connection with Azure Marketplace;

• AWS, in connection with AWS Marketplace;

• authorized partners or resellers, where the customer purchased or subscribed through a partner channel;

• administrative, judicial or regulatory authorities, where required by law.

Difenso does not sell customers’ or users’ personal data.

9. Sub-processors

Difenso may use sub-processors to provide its services, including for:

• hosting;

• monitoring;

• support;

• security;

• email delivery;

• sales management;

• billing;

• technical analysis;

• maintenance.

The list of applicable sub-processors is available upon request or in the contractual documentation for the relevant offer. Where Difenso acts as a processor, it undertakes to impose confidentiality, security and data protection obligations on its own sub-processors in accordance with the GDPR.

10. Transfers Outside the European Economic Area

Difenso favors, where possible, processing and hosting of personal data within the European Economic Area or in the cloud regions selected by the customer.

Transfers outside the EEA may nevertheless occur, in particular where:

• the customer selects a cloud region outside the EEA;

• Microsoft, AWS or another provider processes certain data from a third country;

• technical support requires access from a third country;

• an authorized sub-processor is located outside the EEA.

In such cases, Difenso ensures that the transfer is based on an appropriate mechanism, such as:

• an adequacy decision by the European Commission;

• the European Commission’s Standard Contractual Clauses;

• the EU-US Data Privacy Framework for eligible certified U.S. organizations;

• additional contractual, organizational and technical safeguards where necessary.

11. Retention Periods

Difenso retains personal data only for as long as necessary for the purposes described in this Policy, unless a legal obligation or legitimate need requires longer retention.

As an indication:

• customer account data: for the duration of the contract, then archived according to applicable legal limitation periods;

• billing and accounting data: for the applicable legal period, generally up to 10 years;

• support data: for the duration required to process the ticket, then limited archiving;

• technical and security logs: for a period proportionate to security, diagnosis, audit and compliance needs;

• marketing data: in accordance with applicable recommendations, unless the individual objects earlier;

• data processed on behalf of the customer: according to the customer’s instructions and the retention periods set out in the contract.

12. Data Security

Difenso implements appropriate technical and organizational measures to protect personal data against destruction, loss, alteration, unauthorized disclosure or unauthorized access.

These measures may include, depending on the relevant services:

• access control;

• strong authentication;

• authorization management;

• encryption of data in transit;

• encryption of data at rest where applicable;

• logging;

• environment segmentation;

• security monitoring;

• backups;

• vulnerability testing;

• incident management;

• confidentiality commitments;

• staff awareness;

• regular review of security measures.

As no security measure is absolute, Difenso encourages customers to configure the solutions in accordance with security best practices, particularly in relation to access, administration, logging, encryption and secret management.

13. Confidentiality

Difenso undertakes to preserve the confidentiality of data processed in connection with its services. Authorized personnel, providers and sub-processors are subject to appropriate confidentiality obligations.

14. Personal Data Breach

In the event of a personal data breach likely to affect data processed by Difenso:

• where Difenso acts as data controller, it assesses the risk and, where necessary, notifies the competent supervisory authority and affected individuals in accordance with the GDPR;

• where Difenso acts as data processor, it informs the customer without undue delay after becoming aware of the breach, in accordance with the applicable agreement, so that the customer can comply with its own obligations.

15. Data Subject Rights

Subject to the conditions set out under applicable law, individuals have the following rights:

• right of access;

• right to rectification;

• right to erasure;

• right to restriction of processing;

• right to object;

• right to data portability;

• right to withdraw consent where processing is based on consent;

• right to define instructions regarding the fate of their data after death, where French law applies;

• right to lodge a complaint with the CNIL or any other competent supervisory authority.

Requests may be sent to:

privacy@difenso.com / dpo@difenso.com

Where Difenso acts as a processor on behalf of a customer, requests relating to data processed in the customer environment should generally be addressed directly to the customer acting as data controller. Difenso will assist the customer to the extent provided in the applicable agreement.

16. Children’s Data

Difenso solutions are intended for professionals and organizations. They are not intended for children, and Difenso does not knowingly collect personal data relating to children in connection with the marketing of its Marketplace solutions.

17. Automated Decision-Making and Profiling

Unless otherwise indicated in the documentation specific to a solution, Difenso does not make decisions producing legal effects or similarly significantly affecting an individual solely on the basis of automated processing.

Certain solutions may, however, generate scores, alerts, recommendations or technical classifications intended to assist the customer’s security teams. These outputs must be interpreted and used by the customer in accordance with its own internal procedures.

18. Relationship with Azure and AWS Marketplaces

The purchase, subscription, billing or management of a Difenso solution through Azure Marketplace or AWS Marketplace also involves data processing by Microsoft or AWS. Such processing is governed by their own terms and privacy policies.

Difenso may receive from Microsoft or AWS certain information necessary for:

• identifying the subscription;

• activating the solution;

• managing the customer relationship;

• providing support;

• sales follow-up;

• contractual compliance;

• internal sales and usage metrics, within the limits authorized by the applicable terms.

19. Changes to this Policy

Difenso may amend this Policy to reflect changes in its services, practices, legal obligations or marketplace requirements.

The update date will be indicated at the top of this Policy. In the event of material changes, Difenso may inform customers by any appropriate means.

20. Contact

For any question relating to this Policy or the protection of personal data, you may contact Difenso at:

Difenso
Address: 47 quai du Président Carnot 92210 Saint-Cloud
Privacy email: privacy@difenso.com
DPO or GDPR contact: dpo@difenso.com
Support email: support@difenso.com