Who we are and scope
DarkRisk (Pty) Ltd, registration number 2026/686205/07 (“DarkRisk”, “we”, “us”, or “our”) provides a Cyber Risk Management platform, websites, and related support and professional services (together, the “Services”). This Privacy Policy applies when you visit darkrisk.io or another website that links to it, use our Services, communicate with us, attend an event, apply for a role, or otherwise interact with DarkRisk. It also explains how we handle information about the organisations our Services assess.
We are a responsible party under South Africa’s Protection of Personal Information Act 4 of 2013 (“POPIA”) for personal information we determine how and why to process. Where a customer submits personal information to the Services and controls its processing, DarkRisk acts as that customer’s operator or processor under our data processing terms. The customer’s privacy notice and instructions govern that processing, and requests about that information should usually be directed to the customer.
We apply POPIA as our primary privacy framework and, where applicable to a particular processing activity, the EU General Data Protection Regulation (“GDPR”) and other applicable data protection laws. “Personal information” in this policy includes “personal data” under the GDPR and, where POPIA applies, information relating to an identifiable natural or existing juristic person. Our Information Officer can be reached at compliance@darkrisk.io.
Information we process
The information we process depends on how you interact with DarkRisk.
Account and business contact information
Name, work email address, telephone number, employer, role, account credentials, multi-factor authentication settings, team membership, communication preferences, and records of our communications.
Customer and service information
Information entered, uploaded, connected, or generated when customers use the Services. This may include vendor records, assessments, questionnaires and answers, evidence and documents, comments, remediation activity, contact details of vendor staff, and other customer-directed content (“Customer Data”).
Information about organisations we assess
To produce ratings and findings, we observe the internet-facing systems of organisations that customers monitor, such as domains, DNS and email records, certificates, open services and website technology, as described in our Scanning practices. We also record public claims that an organisation has suffered a breach, with basic details of what was affected, and published news coverage. This information is about organisations, which POPIA protects as juristic persons. It can incidentally include personal information, such as a name or business email address in a public record or news article. We do not collect passwords, credentials or personal accounts from breach data.
Transaction information
Subscription, contract, billing, invoicing, and payment status information. DarkRisk does not collect or store payment card data.
Device, usage and security information
IP address, browser and device type, operating system, approximate location inferred from IP, referring pages, dates and times of access, pages or features used, diagnostic events, log data, and security records such as sign-ins, multi-factor checks and protected account actions.
Sales, events, support, and recruitment
Information you provide when requesting a demonstration, subscribing to an update, attending an event, asking for support, completing a survey, or applying for a role. Recruitment information may include a CV, qualifications, employment history, interview notes, references, and work-eligibility details.
Please do not provide special personal information, such as information about health, religion, race, biometrics or criminal behaviour, or information about children, unless it is necessary, lawful and agreed with DarkRisk in writing.
How we collect information
- Directly from you, including when you create an account, contact us, complete a form or questionnaire, or use the Services.
- From your organisation or other users, such as an administrator who invites you or a customer who asks you to complete a vendor assessment.
- Automatically, through service logs, cookies, and similar technology when you use our websites or Services, and through our observation of internet-facing systems.
- From lawful third-party and public sources, including business partners, integrations you authorise, security data providers, public breach announcements, news publishers, company websites, and public databases.
Supplying account, contact and billing information is necessary to create an account and provide the Services; if you do not supply it, we cannot provide them. Other information, such as marketing preferences, is voluntary. If you provide personal information about another person, you must be authorised to do so and must give that person any notice or obtain any consent required by law.
Purposes and legal bases
We process personal information to:
- provide, administer, support, and secure the Services;
- create accounts, authenticate users, and manage permissions;
- deliver assessments, ratings, reports, and customer-requested workflows;
- observe internet-facing systems and publish risk information to customers who monitor the organisations concerned;
- process subscriptions, invoices, payments, and contractual records;
- respond to enquiries, demonstrations, support requests, and feedback;
- monitor reliability, prevent abuse and fraud, investigate incidents, and troubleshoot;
- analyse and improve the performance, usability, and functionality of our Services;
- send service messages and, where permitted, relevant marketing communications;
- manage suppliers, business partners, events, and recruitment;
- establish, exercise, or defend legal claims and enforce our agreements; and
- comply with law, lawful requests, and regulatory obligations.
Under POPIA, we process information where it is necessary for a contract with you, where the law requires it, where it protects your legitimate interest, where it pursues our or a third party’s legitimate interests in a lawful and proportionate way, or with your consent. Assessing the security of organisations that customers depend on is a legitimate interest of those customers and of DarkRisk. Laws that require us to keep certain records include the Companies Act 71 of 2008, the Tax Administration Act 28 of 2011 and the Value-Added Tax Act 89 of 1991.
Where the GDPR applies, we rely on one or more of these legal bases: performance of a contract or steps requested before entering one; compliance with a legal obligation; our legitimate interests or those of a third party, where those interests are not overridden by your rights; and consent, where consent is required. You may withdraw consent at any time without affecting earlier lawful processing.
Ratings and artificial intelligence
Ratings, scores and findings are produced automatically from the information described above. They describe the security of organisations, not individuals. DarkRisk does not itself take decisions about anyone on the basis of them, and our terms require customers to apply meaningful human review before relying on them for a decision that has legal consequences for, or substantially affects, a person or organisation.
Where artificial intelligence is enabled for a customer, information relevant to a task, such as questionnaire answers or documents, may be processed by AI model providers acting as our operators. They may not use it to train their models. The providers, routes and opt-outs are described in our AI declaration at trust.darkrisk.io.
We do not sell customer data
DarkRisk does not sell Customer Data or personal information. We do not share Customer Data with third parties for their own advertising, and we do not use Customer Data to train general-purpose artificial intelligence models.
We may create aggregated or de-identified information that cannot reasonably be linked to an identifiable person or customer. We may use that information for analytics, security research, benchmarking, and improving our Services, subject to our contractual commitments and applicable law.
Third-party services and platform policies
DarkRisk relies on selected infrastructure providers, subprocessors, and other third parties to deliver the Services. Our current subprocessor disclosures are maintained at trust.darkrisk.io. That list may change as our Services develop; customers receive notice of new subprocessors as our data processing terms describe.
If you connect a third-party account or integration, we receive and use the data authorised through that connection only to provide, secure, and support the requested functionality. We comply with applicable provider API terms and do not use data received through a customer-authorised integration to train general-purpose AI or machine-learning models. You can usually revoke an integration through the relevant provider or your DarkRisk account settings.
Third-party websites and services have their own privacy practices. This policy does not govern a third party acting independently of DarkRisk.
International transfers
DarkRisk and its service providers may process information in South Africa and other countries. Those countries may have privacy laws that differ from the laws where you live.
For transfers from South Africa, we apply section 72 of POPIA and use a permitted basis, such as a recipient bound by law, binding corporate rules or a binding agreement that provides adequate protection, your consent, or another statutory ground. For personal data protected by the GDPR, we use an approved transfer mechanism where needed, such as an adequacy decision or the European Commission’s Standard Contractual Clauses, together with supplementary safeguards where appropriate.
Retention
We keep personal information only for as long as necessary for the purpose for which it was collected, including to provide the Services, meet our contractual commitments, maintain security and audit records, resolve disputes, and comply with legal, tax, accounting, and regulatory requirements.
When a customer agreement ends and the customer’s organisation is deleted, we keep its Customer Data for 180 days, so the organisation can be restored or its data exported, and then delete it, unless the law requires us to keep it. We keep financial, tax and company records, including the customer’s name and the dates its organisation was created and deleted, for the periods the law requires, and records of the support we provided. A user’s sign-in account can give access to more than one customer, so it is not deleted with a customer’s data: we delete accounts that have not given access to any customer for at least 120 days. Other retention periods depend on the nature and sensitivity of the information, the risk from unauthorised use or disclosure, customer instructions, and legal requirements. When retention is no longer authorised or required, we delete, destroy, or de-identify the information. Copies in backups are deleted or overwritten within 30 days and remain protected until then.
Security
We use appropriate technical and organisational measures designed to preserve the confidentiality, integrity, and availability of personal information, including encryption in transit and at rest, role-based access control, multi-factor authentication and audit logging. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
Learn about our security programme and vulnerability reporting process at security.darkrisk.io. Please report suspected security issues through the channels listed there, rather than in a public forum.
If we have reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and the people affected as soon as reasonably possible, as section 22 of POPIA requires, and as other applicable law requires.
Your privacy rights
Depending on where you are and which law applies, you may have the right to:
- be informed about our collection and use of your personal information;
- ask whether we hold your information and request access to it;
- request correction of inaccurate, incomplete, outdated, or misleading information;
- request deletion or destruction where we are no longer authorised to retain it;
- object, on reasonable grounds, to processing based on legitimate interests, including the assessment of your organisation;
- request restriction of certain processing;
- withdraw consent where processing is based on consent;
- object at any time to direct marketing;
- receive certain information in a structured, commonly used, machine-readable format;
- not be subject to a decision based solely on automated processing that has legal or similarly significant effects, where applicable; and
- complain to DarkRisk, the Information Regulator, or another applicable supervisory authority.
To make a request, email compliance@darkrisk.io. Describe the request and the account, organisation or interaction it concerns. We will ask for the information we reasonably need to verify your identity and authority before acting. Rights are not absolute; we may decline or limit a request where the law permits, including to protect another person’s rights, to continue processing for compelling legitimate grounds, or to comply with a legal duty to keep records. We will explain our decision where required. A request for records may also be made under ourPAIA manual.
If DarkRisk processes the information solely for a customer, we may direct the request to that customer or assist it in responding. Authorised agents may submit requests where applicable law allows, subject to verification of their authority.
Marketing choices
You can opt out of promotional email at any time by using the unsubscribe link in the message or contacting us. We may still send non-promotional messages that are necessary for your account, a transaction, security, or the operation of the Services.
We send direct marketing by electronic communication only as section 69 of POPIA allows: to our customers about similar services, or with your consent, and always with a free way to object to further marketing.
Children
The Services are designed for organisations and are not directed to children under 18. We do not knowingly collect a child’s personal information. If you believe a child has provided personal information to us, please contact us so that we can investigate and delete it.
Trademarks
DarkRisk, the DarkRisk name and logo, and the names, logos, product names, service names, designs, and slogans associated with our Services are trademarks or other protected brand assets of DarkRisk (Pty) Ltd. This policy does not grant permission to use them. Other names and marks belong to their respective owners. Our terms of service govern use of our Services and intellectual property.
Changes to this policy
We may update this policy as our Services, practices, or legal obligations change. The effective date at the top shows when the current version applies. If a change is material, we will give additional notice where required, such as through the Services, on our website, or by email. Earlier versions may be requested from our Information Officer.
Contact and complaints
Questions, privacy requests, objections or concerns can be sent to our Information Officer at compliance@darkrisk.io. Please contact us first if you have a concern; we will investigate and aim to resolve it fairly and promptly.
You may also lodge a complaint with the South African Information Regulator at POPIAComplaints@inforegulator.org.za or through its complaints service. If the GDPR applies, you may complain to the data protection authority in the EEA country where you live or work, or where you believe an infringement occurred.