Company and privacy information

Business identity

This service is operated by ABC CYBER LTD, a private limited company registered in England and Wales under company number 16941187.

Registered office: Brundrett House, Sandbach Road South, Alsager, Stoke-on-Trent, England, ST7 2LT.

Questions and data-protection requests may be sent in writing to the registered office. Mark correspondence for the attention of Data Protection.

Data processed by Alerts

Alerts stores local user identities and roles, customer tenant and mailbox identifiers, encrypted message subjects, previews, recipients and Microsoft message identifiers, sender details, delivery times, local review state, audit events and encrypted Microsoft service credentials in its private PostgreSQL database.

Full message bodies are retrieved live from Microsoft Graph when an authorised user opens a message and are not stored by Alerts. Attachments are not downloaded or stored by Alerts; Microsoft performs forwarding from the monitored mailbox. Microsoft SSO authenticates linked users but is not the Alerts data store. This information is used to provide contracted security monitoring, authorised review and forwarding, mailbox scoping and security auditing.

For monitored customer mailbox data, ABC Cyber normally acts as a processor and the customer determines the lawful basis. Where ABC Cyber acts as controller for its own account, security and audit information, it relies on legitimate interests in administering and securing its business systems and, where applicable, legal obligations.

Cookies and similar storage

Alerts uses only strictly necessary cookies for authenticated sessions and short-lived OAuth security flow. Interface storage is cleared on logout. No advertising cookies, behavioural analytics, tracking pixels, social widgets or public third-party embeds are used.

Data sharing and retention

Authorised ABC Cyber users, the relevant customer, Microsoft 365 and necessary contracted hosting providers may process data. Forwarded messages are disclosed to the recipients entered by an authorised operator. Where a provider transfers personal data outside the UK, ABC Cyber uses an applicable UK adequacy regulation or approved safeguard.

Collected message metadata is automatically deleted according to MESSAGE_RETENTION_DAYS, which defaults to 90 days. Full bodies and attachments are not retained by Alerts. Sessions and consent states expire automatically. Customer deletion removes the customer's locally stored messages, consent state and associated audit detail; Microsoft enterprise applications and Exchange RBAC assignments require separate offboarding.

Your rights and complaints

Depending on the circumstances, individuals may have rights of access, correction, erasure, restriction, objection and data portability. They may also complain to the UK Information Commissioner's Office. Rights can be exercised by writing to the registered office above. Identity verification may be required before disclosing or changing personal data.