JOE SANDBOX CLOUD BASIC DATA PROTECTION POLICY
Welcome to Joe Sandbox Cloud Basic, a service provided by Joe Security GmbH (“Joe Security” or“we”). The protection of your data and the preservation of your privacy are of central importance tous. This Joe Sandbox Cloud Basic Data Protection Policy (“Data Protection Policy”) illustrates whichtypes of personal data we process, how we process the personal data and for which purposes weprocess it.
1. When does this Data Protection Policy apply?
This Data Protection Policy applies to our processing of personal data in the course of your visit of our
website www.joesandbox.com. Please note that this Data Protection Policy is not applicable to theprocessing of personal data in the course of our provisioning of Joe Sandbox Cloud Pro services. For
details on the processing of personal data in the course of the provisioning of Joe Sandbox Cloud Pro
services, please refer to the Joe Sandbox Cloud Pro Data Protection Policy.
2. Who is the controller of the data processing?
Under data protection law, the controller of a particular data processing is the entity that determines
the purpose and means of that data processing.
Controller of the processing of personal data within the scope of this Data Protection Policy:
Joe Security GmbH
Christoph Merian-Ring 114153 Reinach
Switzerland
3. What personal data do we process for the provision of our website?
If you visit our website, the data that your browser automatically sends us is logged in “log files”. Thisdata includes your IP address, the website from which you came to this website (referrer), the date ofyour visit, product and version information on the browser (user agent) used by you, the operating
system used by you and language settings. The afore-mentioned data is used by us to ensure thefunctionality of our IT systems, to optimize our website and the technology behind it, for internal
statistical evaluation regarding the use of our website and to provide prosecution authorities with therequired information in case of a cyberattack. This is our legitimate overriding interest in the dataprocessing. The data is not saved together with any other personal data of yours. Further, the data is
not analyzed for marketing purposes.
We host the content of our website with the following provider: Hetzner Online GmbH (“Hetzner”),
Industriestr. 25, 91710 Gunzenhausen, Germany. For details, please refer to Hetzner´s privacy policy.
https://www.hetzner.com/de/legal/privacy-policy
4. How and for what do we use cookies?
In order to make visiting our website attractive, efficient and enable the use of specific functions, we
use what are known as cookies on various pages of our website. These are small text files which are
stored on your computer or end device. Some of the cookies we use are deleted at the end of thebrowser session, i.e., when you close your browser (known as session cookies). Other cookies are
stored on your computer or end device and allow us to recognise your browser next time you visit our
website (persistent cookies). You can configure your browser such that no cookies are stored on yourcomputer or end device, or that you are informed about the storing of cookies and can decide on an
individual basis whether to accept cookies in individual cases or not.
Information on how to delete cookies and change cookie settings in the most common browsers canbe found on the following websites:---

Google Chrome Desktop: https://support.google.com/chrome/answer/95647?hl=en
Google Chrome Mobile:
https://support.google.com/chrome/answer/2392709?hl=en&co=GENIE.Platform%3DAndro
id&oco=1
Mozilla Firefox: https://support.mozilla.org/en-US/kb/enhanced-tracking-protection-firefoxdesktop?redirectslug=enable-and-disable-cookies-website-preferences&redirectlocale=enUS
Apple Safari Mobile: https://support.apple.com/bg-bg/HT201265

Not accepting cookies can limit the functionality of using our website.
5. What personal data do we process to analyze and improve the use of our website?
This website uses Google Analytics, a web analysis service provided by Google Ireland Limited(„Google“), Gordon House, Barrow Street, Dublin 4, Irland. Google uses cookies that enable an analysisof your use of our website. The information collected by means of the cookies about your use of our
website is generally transferred to a Google server in the USA and stored there. Google will use thisinformation on our behalf to evaluate your use of the website and to compile reports on website
activities. The reports provided by Google Analytics serve to analyze the performance of our website.
We use Google Analytics only with IP anonymization activated. Due to IP anonymization, your IP
address will be shortened by Google within member states of the European Union or in other states
party to the Agreement on the European Economic Area. Only in exceptional cases will the full IP
address be transferred to a Google server in the USA and shortened there. According to Google, theIP address transmitted by your browser as part of Google Analytics will not be merged with other
Google data.
You can prevent the storage of cookies from the outset by setting your browser software accordingly(please see Section 4 above). However, if you configure your browser to reject all cookies, this may
result in a restriction of functionalities on this and other websites. In addition, you can prevent thecollection of data generated by the cookie and related to your use of the website (including your IP
address) to Google and the processing of this data by Google, by downloading and installing thebrowser add-on to disable Google Analytics here: https://tools.google.com/dlpage/gaoptout?hl=en
For more information on Google Analytics' terms of use and Google's privacy policy, please
visit https://marketingplatform.google.com/about/analytics/terms/us/ andhttps://policies.google.com/?hl=en.
6. What personal data do we process if you register for Joe Sandbox Cloud Basic services via theregistration form on our website?
Registration form
You may register for Joe Security Cloud Basic services via the registration form (“Joe Sandbox Cloud
Basic registration form”) available on our website. To register via such form, we require the following
information:-Your nameCompany webpage
Your business email address

We process the above information to enter into contracts on Joe Security Cloud Basic services withyou and to provide Joe Security Cloud Basic services to you. It is our legitimate overriding interest toenter into contracts for our services and to fulfill these contracts.
Google reCaptcha
We use the reCaptcha service provided by Google, Inc., 1600 Amphitheater Parkway Mountain View,
CA 94043, USA (“Google”) to protect the registration form on our website from unauthorized use. This
service allows us to differentiate between entries made by a human being or improperly by anautomated machine. The integration of reCAPTCHA takes place via an interface ("API") to the Google
services. By integrating reCAPTCHA, Google may collect information (including personal data) andprocess it. It cannot be ruled out that Google also transmits the information to a server in a third
country.
reCAPTCHA may use "cookies", which are text files placed on your device and which allow an analysisof the use of the websites you visit. In addition, reCAPTCHA also uses so-called WebBeacons, i.e., small
pixels or graphics. The information generated by the cookie, possibly in connection with the
WebBeacon, about your use of this website (including your IP address) is transmitted to a Google
server, possibly in the USA or other third countries, and stored there.
For more information on how reCAPTCHA works, see: https://developers.google.com/recaptcha/
For more information about Google's privacy policy, please visit: https://policies.google.com/privacy
By integrating reCAPTCHA, we pursue the purpose of determining whether entries on our website are
made by a real person or by a bot. This is our legitimate overriding interest in the data processing.
You may refuse the use of cookies by selecting the appropriate settings on your browser (please see
Section 4 above), however, please note that if you do this you may not be able to use the fullfunctionality of this website.
7. What personal data do we process for the delivery of our newsletter?
When you register for Joe Security Cloud Basic services, you can choose to subscribe to our newsletter.
The subscription to our newsletter is voluntary. By subscribing to our newsletter, you give yourconsent to the processing of your email address (as provided by you when subscribing to our
newsletter) for the purpose of the newsletter delivery.
We use the newsletter service GetResponse for our newsletter delivery. GetResponse is a service thatcan be used, inter alia, to organize and analyze the delivery of newsletters. The service is provided byGetResponse S.A., Grunwaldzka 413, 80-309 Gdansk, Poland (“GetResponse”). Your email address (asprovided by you when subscribing to our newsletter) is stored on GetResponse´s servers.
GetResponse´s servers are located in the EU and the USA, so that it cannot be ruled out that the datais transferred to the USA.
GetResponse enables us to analyze the behavior of newsletter recipients. Among other things, we cananalyze how many recipients have opened the newsletter message and how often which link in the
newsletter was clicked on.

The processing of your personal data takes place on the basis of your consent. You can unsubscribefrom the newsletter at any time. We provide a link for this purpose in each newsletter message.
More information on the handling of user data by GetResponse can be found in the GetResponse
Privacy Policy. https://www.getresponse.com/legal/privacy
8. What personal data do we process when using a Content Delivery Network?
We use a Content Delivery Network offered by Cloudflare Inc., 101 Townsend St. San Francisco, CA
94107, USA (“Cloudflare“). A Content Delivery Network is an online service that is used to deliver, inparticular, large media files (such as graphics, page content or scripts) through a network of regionally
distributed servers connected via the Internet. In the course of this, Cloudflare receives access to, interalia, the connection data as specified in Section 3 above. The use of Cloudflare's Content Delivery
Network helps us to optimize the loading speeds of our website.
The data processing is based on our legitimate overriding interest in the secure and efficient provision,as well as the improvement of the stability and functionality of our website.
Cloudflare has a certification according to the EU-US Data Privacy Framework (DPF). The DPF is anagreement between the European Union and the USA, which is intended to ensure compliance with
European data protection standards for data processing in the USA. Every company certified under
the DPF undertakes to comply with these data protection standards. For more information, please
visit the following link: https://www.dataprivacyframework.gov/s/participant-search/participantdetail?contact=true&id=a2zt0000000GnZKAA0&status=Active
You can find more information about security and privacy at Cloudflare here:
https://www.cloudflare.com/privacypolicy/.
9. With whom do we share sample files, documents, URLs or e-mails (“Samples”) submitted by you?
If you intend to submit Samples to have them analyzed by Joe Sandbox Cloud Basic services, please
note, that the complete Sample and the corresponding analysis results will be published onwww.joesandbox.com and accessible to anyone in each case.
Therefore, you may only submit Samples that you wish to publicly share.
You must not submit any Sample that contains confidential information and/or personal data without
lawful permission. You shall be responsible for any conflict arising out of your submission ofconfidential information and/or personal data involved in a Sample.
10. With whom do we share personal data?
It may be necessary for us to disclose personal data to the following categories of recipients:- Service providers: We may share personal data with the service providers as described in thisData Protection Policy.
- Authorities and courts: If we are requested to do so by authorities or courts and are legallyobliged to do so, we will disclose personal data to these or other authorized third parties.
Section 9 above shall remain unaffected.

11. How do we protect your data?
This website uses TLS encryption for security reasons and to protect confidential information (e.g.,
requests you send us via our website). We secure our website and other systems by technical andorganizational measures against loss, destruction, modification or access of your data by unauthorized
persons.
12. How long do we keep your data?
We store personal data only as long as necessary for the intended purpose in each case or as requiredby law.
13. What rights do you have with regard to your personal data?
Within the framework of the data protection law applicable to you and to the extent provided therein,
you may have, in particular, the following rights:
Right of access: You can obtain from us confirmation as to whether or not personal data concerning
you is being processed by us. Where that is the case, you can obtain from us access to the personal
data and information regarding, inter alia, the purposes of the processing, the categories of recipientsto whom your personal data has been or will be disclosed, where possible the envisaged period forwhich the personal data will be stored (as applicable).
Right to rectification: You have the right to have inaccurate personal data concerning you rectified.
Right to erasure: You can obtain from us the erasure of your personal data stored by us, where areason for erasure applies, such as: the personal data is no longer necessary in relation to the purposes
for which it was collected or otherwise processed; you withdraw your consent and there is no otherlegal ground for the processing; you object to the processing and there are no overriding legitimate
grounds for the processing; the personal data has been unlawfully processed.
Right to restriction of processing: Under certain conditions, you can obtain from us restriction ofprocessing of the personal data concerning you.
Right to notification: Where you have exercised your right to rectification or erasure of personal data,or restriction of processing, we may be obliged to communicate this rectification or erasure of
personal data or restriction of processing to each recipient to whom the personal data concerning you
has been disclosed, unless this proves impossible or involves disproportionate effort.
Right to data portability: You may have the right to receive the personal data concerning you, which
you have provided to us, in a structured, commonly used and machine-readable format, and totransmit those data to another controller without hindrance from us.
Right to object: You may have the right to object to processing of personal data concerning you.
If you have any requests of this kind, please direct them to the addresses stated in Section 14 below.

14. How can you contact us with questions about data protection?
If you have any questions or requests relating to this Data Protection Policy, feel free to contact us.
You can reach us by email to privacy@joesecurity.org or by post to the following address:
Joe Security GmbH
Christoph Merian-Ring 114153 Reinach
Switzerland
If and to the extent our data processing is subject to the EU General Data Protection Regulation (GDPR)
and you have a question or request in this regard, please contact our representative in the EU, using
the contact information below:
Rickert Rechtsanwaltsgesellschaft mbH- Joe Security GmbH Colmantstraße 1553115 Bonn
Germany
art-27-rep-joesecurity@rickert.law
15. How can we change this Data Protection Policy?
We reserve the right to change this Data Protection Policy at any time. The respective current version
published on our website shall apply. In case of changes to this Data Protection Policy we will provide
the updated version with the revision date here on our website.
Version: 19.12.2023