Privacy Notice
Company and scope
EnigmaCyber LLC is the controller for business enquiries and related processing on /us. Address: 1209 MOUNTAIN ROAD PL NE STE N, ALBUQUERQUE, NM 87110 USA. New Mexico company; principal address. Privacy: privacy@getenigmalabs.com. Support: support@getenigmalabs.com. General enquiries: hello@getenigmalabs.com.
Enigma Labs Technology Limited (DIFC) operates the shared website before a region is selected. This notice also describes customer service data and the human resources information of EnigmaCyber LLC’s own staff and applicants. When we process information on another organisation’s instructions, its privacy information and the relevant engagement and processing agreement also apply. Our public DPA applies when incorporated into that engagement. Our website and services are intended for businesses and are not directed to children.
Information, purposes and legal grounds
We collect the name, business contact details, company, country where supplied, service interests and correspondence you provide to respond, arrange services and provide support.
| Category | Examples |
|---|---|
| Identifiers and contact information | Names, email addresses, telephone numbers, online identifiers and IP addresses |
| Professional information | Employer, job title and professional-profile details |
| Commercial and correspondence information | Service interests, enquiries, proposals, support messages and order instructions |
| Internet and technical activity | Browser/network details, security and delivery logs, privacy choices, campaign-dependent email opens and clicks |
| Audio information | Telephone and VoIP recordings |
Request/network information, verification tokens, rate-limit identifiers and privacy choices support delivery and security. Providing information is voluntary, but without the details needed to respond we may be unable to help. Do not send credentials or unnecessary sensitive information through general enquiries.
For prospecting and supplementing business contact records, we purchase leads and obtain enrichment information from third-party suppliers and collect information from public websites and professional profiles, including LinkedIn. These records may include names, job titles, employers, work email addresses, telephone numbers, locations and LinkedIn profiles.
We record telephone and VoIP calls to document customer instructions, troubleshoot issues, resolve disputes and record acceptance of orders. We tell you before recording begins and obtain consent where required. Otherwise, we rely on our legitimate interests in maintaining an accurate record for those purposes. If you do not want a recorded call, you can use email instead. We do not offer an unrecorded telephone service.
Customer service data
Customers may provide personal information or authorise access to it when we deliver, secure and support their IT and cybersecurity services. Depending on the engagement, this can include staff and other individuals’ identifiers and contact details, employment information, account and access records, security and system logs, communications and information held in customer systems. Authorised service work can also involve financial or payment-card information, health information, criminal-offence records or children’s information.
We process this information for the customer’s instructed service purposes, with the scope and safeguards required for the data concerned. The customer determines the relevant individuals, data and purposes. Customer service records follow its lawful retention, return and deletion instructions and applicable mandatory requirements. For requests concerning this data, contact the responsible customer or privacy@getenigmalabs.com; we assist the customer and comply with obligations that apply directly to us.
Human resources information
We handle the HR records of EnigmaCyber LLC’s own staff, contractors and job applicants. Purposes include recruitment, payroll, benefits, leave administration, performance reviews, training, staff IT and security administration, employment-law compliance and resolving employment-related claims.
The information depends on the function and can include identity and contact details, applications, qualifications and work history; job, compensation, payment and tax information; benefits, attendance and leave records; performance and training records; and staff accounts, access and security records. Where necessary and permitted for those purposes, records can include health or disability information, criminal or background-check information and trade-union membership. We receive information from the individual and from sources used for the relevant HR function, such as references or authorised checks.
Access and disclosure are limited to authorised staff, providers supporting those functions, and authorities or advisers where needed for the stated employment, compliance or claims purposes.
Recruitment records are retained while an application is considered and afterwards only as needed for applicable recruitment-record duties or related claims. Payroll and tax records follow the statutory periods applying to the record. Other personnel, benefits, leave, performance, training and staff-security records are retained while needed for the employment function and afterwards only for necessary benefits administration, applicable recordkeeping duties or specific claims. We retain only the information needed for each continuing purpose.
Use privacy@getenigmalabs.com for HR privacy questions, choices and requests. We do not retaliate against individuals for exercising their applicable privacy rights. The rights section below explains how to make a request or complaint.
Marketing and email tracking
We use business contact details to promote our services, including details supplied directly to us, purchased from lead suppliers or collected from public professional sources. Purchasing a record or finding it publicly does not by itself establish permission to send marketing. Where applicable data-protection law permits it, the basis for relevant business outreach is our legitimate interest in promoting our services. Consent is required where the applicable channel rules require it; SMS exceptions depend on the recipient and sending arrangement. WhatsApp marketing requires prior opt-in for the company named in the permission.
Submitting an enquiry does not subscribe you to marketing. Our website forms offer optional, initially unticked choices for email, live telephone calls, SMS and WhatsApp/Signal messages, as available on the form. Choices apply to the named regional company and supplied contact details; they do not authorise automated or prerecorded marketing calls. An unchecked choice does not withdraw an earlier permission.
Depending on the campaign, marketing emails may measure opens and link clicks, including emails to contacts obtained from external sources. Where applicable law requires consent for this measurement, we obtain it before tracking your opens or clicks. You may withdraw tracking consent at any time by contacting privacy@getenigmalabs.com. The website form offers a separate optional choice for this measurement; selecting email marketing alone does not grant tracking permission. Browser-cookie choices do not subscribe you to marketing.
For choices made through our website forms, we record your choices, the company and contact details concerned, when and where the choices were made, and the privacy information presented.
You may withdraw consent or object to direct marketing at any time, through an unsubscribe link, by replying “STOP” where available, or by contacting privacy@getenigmalabs.com. This does not affect your enquiry or services.
An opt-out stops marketing from Enigma Labs OÜ, Enigma Labs Technology Limited and EnigmaCyber LLC across all channels, including email, SMS and WhatsApp. We apply opt-outs without undue delay and within 24 hours of receipt, or sooner where required by law. We maintain a do-not-contact list to prevent further marketing; the block remains effective if your details appear in a later purchased or imported list.
We do not sell or rent contact data or provide it to advertising platforms for targeted advertising.
AI-assisted replies
We use AI services to handle enquiries. For each enquiry the system receives the message you sent, your contact details and our earlier correspondence and records about you or your company. It may look up public professional sources about you or your company, such as your company website or LinkedIn profile. It uses this to classify and route the enquiry, draft a reply, update the helpdesk and customer record for your enquiry and schedule follow-up contact about it.
Replies about complaints, legal or privacy matters, active incidents or security reports are always reviewed by a member of staff before sending. Other replies, including indicative information about our services and pricing, may be sent automatically. The system can contact only you and our staff and can change only your record. Where you have chosen marketing contact, follow-up messages may also include information about our services; they follow the marketing choices and opt-out rules in the Marketing section and our do-not-contact list. No acceptance of a customer, binding price, contract or access to services is agreed by the system; these require a person and the engagement process described in our Website Terms.
The system runs under instructions set and controlled by our staff and operates only for the purposes above. Our AI providers are contractually barred from using your information to train their models. Prompts and outputs are logged and reviewable, and access to the tooling is limited to authorised staff using multi-factor authentication. Our deployment follows the OECD AI Principles, the NIST AI Risk Management Framework 1.0 and the Dubai AI Ethics Guidelines. AI replies can be inaccurate; email support@getenigmalabs.com to request handling by a person. You may object to this processing or ask for human handling at any time.
Recipients and shared services
Enigma Labs Technology Limited (DIFC) manages shared services and handles EU and US enquiries on behalf of the relevant regional company. We use providers of cloud hosting and security, customer-record management, email and message delivery, helpdesk/chat, AI-assisted support and privacy-preference management for these purposes. Enquiries are recorded in our customer-management and helpdesk systems.
Our companies in Estonia, the DIFC and the United States may provide shared processing services for the responsible regional company. We also use business-contact and enrichment suppliers, telephone/VoIP services and call-recording providers.
International processing
Our shared-service arrangements involve the DIFC company in the United Arab Emirates. Enquiry records are stored in Japan; email, helpdesk and consent records are stored in the United States. Call recordings and any transcripts are stored in the United States, EU countries and Japan. Authorised staff may access enquiries from EU countries, the United Kingdom, the United States, Canada and New Zealand. Automated and marketing emails may be sent through EU and US regions. Sending regions do not describe every storage or support location. AI processing may also take place in other countries where our providers and their subprocessors operate.
EnigmaCyber LLC is a United States company and does not receive personal information from the EU or DIFC companies. Enigma Labs Technology Limited (DIFC) and the providers described above process /us enquiries for us under written processing agreements. Applicable US law does not restrict these international transfers. If you are located in a country whose law restricts transfers of your information, contact privacy@getenigmalabs.com for information about the arrangements that apply.
Retention and security
We limit retention to the purposes described in this notice and applicable legal requirements. The periods below apply to active records; residual backup copies follow the separate backup limit. An earlier applicable deletion requirement takes priority. Where particular records remain necessary for a legal obligation or a specific claim, they are kept for that purpose rather than for further marketing.
Customer service data and HR records follow the retention criteria in their respective sections above. The table covers the other records described in this notice; it does not extend a customer’s deletion deadline or a mandatory HR-record requirement.
| Information | Retention criteria |
|---|---|
| Enquiries and proposals | For enquiries that do not become engagements, up to 24 months after your last substantive contact with us, and less if the information is no longer needed or an earlier deletion duty applies. Necessary contract or legal-claim evidence is retained separately under the applicable requirement |
| Support and chat correspondence | Routine tickets and chat transcripts: up to 24 months after resolution, and less if the information is no longer needed or an earlier deletion duty applies. Necessary contract, incident or dispute evidence is retained separately for the relevant purpose and applicable period |
| Purchased, enriched and other marketing contacts | Inactive marketing profiles are deleted within 36 months of collection or your latest substantive marketing reply or request, whichever is later, sooner if no longer needed or an earlier deletion duty applies. Campaign sends and recorded opens or clicks do not restart this period. An objection or withdrawal ends the corresponding marketing use earlier; necessary do-not-contact records are kept separately |
| Call recordings | Routine recordings: up to 6 months after the call, and less if the information is no longer needed or an earlier deletion duty applies. Necessary evidence of an accepted order, incident or dispute is retained separately for that purpose and the applicable period |
| Email engagement events | Records linked to an identifiable recipient: up to 6 months after each open or click, followed by deletion or irreversible anonymisation, sooner if no longer needed or an earlier deletion duty applies |
| Minimal consent evidence | While we rely on the consent, then for up to 36 months after we last rely on it, shorter if no longer needed or an earlier deletion duty applies |
| Minimal privacy-request records | While handling the request, then for up to 36 months after closure, shorter if no longer needed or an earlier deletion duty applies |
| Do-not-contact records | While needed to honour the objection, including when contact details reappear in a later list |
| Accounting and tax records | For the statutory period applying to the record type and relevant company, calculated from the relevant financial or tax year-end, filing date or other starting event specified by law |
| Necessary legal-claim evidence | Only while needed to establish, exercise or defend a claim, considering when the claim arises or becomes known, the applicable limitation period and any extension, and any unresolved proceedings or enforcement. Only relevant information is retained |
| Website access, delivery and security logs | Routine logs: up to 6 months from collection, and less if no longer needed or an earlier deletion duty applies. Necessary incident or dispute evidence is retained separately for that purpose and the applicable period |
| Separate AI prompts, outputs and diagnostic logs | Up to 6 months from creation, deleted sooner if no longer needed or an earlier deletion duty applies. Messages retained as part of an enquiry or support conversation follow the corresponding retention period |
| Routine backup copies | Up to 12 months from each copy’s creation, shorter when no longer needed or an earlier legal or contractual deletion duty applies. Deleted records stay outside normal use until the backup copy expires |
Access to customer personal data is restricted by operational need and multi-factor authentication is required.
Applicable law and rights
This notice applies to people whose information EnigmaCyber LLC processes for the purposes described above, including residents throughout the United States. Applicable US federal and state privacy laws, including New Mexico law, govern within their scope. Canadian PIPEDA and applicable provincial privacy laws, Brazil’s LGPD and other mandatory territorial rules may also apply. Choosing /us does not waive those rights.
Your privacy rights depend on the law governing the processing. They can include confirmation that we process your information; access to that information and a portable copy; correction or deletion; information about its sources, uses and recipients; and rights to object, restrict processing or withdraw consent. US state laws may also provide rights to opt out of sale, sharing for cross-context behavioural advertising, targeted advertising and profiling that produces legal or similarly significant effects.
To make a request, email privacy@getenigmalabs.com or write to our address above. Identify EnigmaCyber LLC and the request you wish to make. An authorised representative may contact us on your behalf. For requests requiring verification, we may ask for information reasonably necessary to confirm your identity or the representative’s authority. We will respond within the applicable legal deadline and explain any refusal. We do not discriminate against you for exercising privacy rights.
To appeal a refusal, reply to our decision or email privacy@getenigmalabs.com with “Privacy appeal” and explain why you disagree. We will explain the outcome within the applicable legal deadline. If we deny your appeal, we will provide the appropriate regulator’s complaint route. You may also complain directly to the competent privacy regulator or state attorney general.
Browser storage and choices
Intercom live chat is optional and loads only after functionality consent for this company and policy version. It processes technical browser/network information and the messages you submit through our US-hosted helpdesk. You can withdraw chat consent in privacy settings; email and contact forms remain available. Ending a browser chat session does not erase messages already submitted, which follow the enquiry or support retention periods above.
The regional URL identifies the company. A trusted hosting country signal may suggest a region on an unprefixed entry URL; visitors can choose another. We do not create a region-preference cookie or use browser time-zone or external IP-lookup signals for routing. Privacy choices are kept separately by company and policy version; use the privacy settings control to change them.
We do not load advertising or analytics scripts. Global Privacy Control (GPC) does not automatically withdraw a live-chat choice you have saved. Live chat requires separate functionality consent, which you can refuse or withdraw through privacy settings. We do not apply separate behaviour to the older Do Not Track (DNT) signal.
The Cookie and Browser Storage Policy describes browser storage and how to manage it. Browser settings and email-marketing choices are separate.
Changes and existing agreements
We publish revisions here and update the effective date. We notify you of material changes through a prominent website notice or direct communication, as required by law.
Existing agreements and historical responsibilities are not transferred by the domain migration. Historical documents are in the legal directory.