DPIA ESET

© 202 5 - 6 Ministerie van Justitie en Veiligheid. Auteursrechten voorbehouden. Niets uit dit rapport mag worden verveelvoudigd en/of openbaar gemaakt door middel van druk, fotokopie, microfilm, digitale verwerking of anderszins, zonder voorafgaande schriftelijke toes temming van SLM Rijk . DPIA on the use of ESET end point security services Data protection impact assessment on the processing of personal data with on - premises and cloud ESET end point security services Version 1. 1 – public DPIA Date 24 June 202 6 Status Public Page 1 of 132 Colophon DPIA by Ministry of Justice and Security Strategic Vendor Management Microsoft , Google Cloud and Amazon Web Services ( SLM Rijk ) Turfmarkt 147 2511 DP The Hague PO Box 20301 2500 EH The Hague www.rijksoverheid.nl/jenv Contact E SLM - CSPs @minjenv.nl T 070 370 79 11 Project Name DPIA report on the use of ESET end point security services Authors Privacy Company Sjoera Nas and Floor Terra , senior advisors With the kind help of Aleecia M. McDonald https://www.privacycompany.eu/ Change log Version Date Summary of input 0.1 23 April 2025 First draft of part A shared with SLM Rijk 0.2 24 June 2025 Part A with track changes after comments ESET 0.3 26 June 2025 Firsts complete draft with track changes 0.4 29 October 2025 Input ESET on part A and Section 11 0.5 24 November 2025 Draft complete DPIA 0.6 25 November 2025 Input SLM processed 0.7 8 June 2026 Revised DPIA after agreement on FWA and extra explanations ESET, with track changes 0.8 9 June 2026 Clean draft for SLM 0.9 19 June 2026 Track changes after input ESET and SLM 1.0 24 June 2026 Glossary Content Personal data from customers such as s ubject lines or attachments of e - mails , visited URLs , attempts to download executables and documents with their pathnames that may be checked by the tested security services .

Security Event Data All data generated by ESET about suspicious content and actions by admins and/or software to prevent threats. Diagnostic Data Term used in this report to address meta data recorded by ESET as part of the technical functionality of the services, such as license management and update downloads. Includes Telemetry Data , web server access logs , and ESET’s own security and infrastructure logs , but not the security events . DPA Data Protection Authority, officially named National Supervisory Authority (NSA) in the GDPR DPIA Data Protection Impact Assessment EDPB European Data Protection Board , the body that unites the national DPAs in the EU, and the EDPS, the supervisory authority on the European Institutions GDPR General Data Protection Regulation, EU Regulation 2016/679 . On - premises Version of the ESET security software that can be hosted anywhere by a government organisation, in their own datacentre or in a shared (government) cloud.

SCC EU Standard Contractual Clauses Service Generated Server logs Personal d ata generated by ESET on its cloud servers as a result of the detection of suspicious content. In this DPIA these logs are the part of the core functionality of the security service, and are therefore part of Content Data. SLM Microsoft, Google Cloud , Amazon Web Services and EU CSPs Rijk, abbreviated to SLM Rijk Strategisch Leveranciers Management (Strategic Vendor Management) Microsoft, Google Cloud, AWS and EU CSP's , URL: https://www.digitaleoverheid.nl/overzicht - van - alle - onderwerpen/slm - rijk/slm - mga/ Telemetry Data Diagnostic Data sent from the ESET application installed on a Windows end user device . Part of Diagnostic Data. ESET appears to use the term Telemetry Data in a different and much broader way, as the core of ESET’s security services to collect information from the end user device about potentially malicious files.

DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 7 of 132 Summary The Slovak company ESET provides many different security services, both on - premises and in the cloud , including for example a device management platform and full XDR (Extended detection and response) functionality . This Data Processing Impact Assessment (DPIA) was commissioned by SLM Microsoft, Google Cloud , AWS and EU CSPs (the Strategic Vendor Management office housed at the Dutch Ministry of Justice and Security), hereinafter: SLM Rijk. Scope This DPIA focuses on the data processing by ESET Protect (remote management) , ESET Endpoint Security for Windows and ESET Server Security (tested with SharePoint ) , tested as on - premises services, and a s cloud servic e s . Additionally, this DPIA includes the use of ESET Cloud Office Security for e - mail (tested with Gmail). This report also includes the data processing as a result of the use of the Admin Console and visits to ESET’s relevant publicly available website s, to login, for support, help and to access relevant legal and technical documentation .

Product names On - premises Cloud ESET PROTECT On - Prem (remote management) x ESET PROTECT Cloud (remote management) x ESET Endpoint Security for Windows (more extensive version than just antivirus) x x ESET Cloud Office Security with Gmail x ESET Server Security (for SharePoint) x x (SharePoint Online) Outcome : 1 6 low data protection risks Based on the amended Data Processing Agreement, explanations and commitments from ESET, the 14 previously identified high data protection risks no longer exist, are, can or will soon be mitigated, either by ESET, or by actions the government organisations are advised to take. Importantly, ESET has already created a new sovereign EU exclusive private cloud option next to its standard cloud services . This means Dutch g overnment organisations can choose between this new E U private cloud option and the air gapped on - premises solution without having to assess data transfer risks.

Government organisations still have to take a number of specific mitigating measures until ESET has implemented the agreed mitigat ion measures . ESET will take m ost of the agreed mitigation measures by the end of Q3 2026 , 1 by the end of 2026 . The 1 6 residual low risks with mitigating measures are shown in more detail in the table at the end of this summary. Technical effectivity It follows from the technical tests that ESET Protect Elite adequately detects critical threats and security breaches from devices and cloud apps, including malicious e - mail, files and URLs that are exchanged via e - mail (Gmail) and via SharePoint, both within the tenant and when sent by an external individual . Personal data This DPIA is based on a legal analysis of the available public documentation about the tested ESET end point security services , answers from ESET to detailed questions from Privacy Company including ESET’s reply to t wo Data Subject Access Request s , and a technical examination of the data processed by ESET in its log files.

This report distinguishes between 5 categories of personal data: 1. Security Event Data (the data generated by ESET about suspicious content and actions by admins and/or software to prevent threats) 2. Account Data ( of the admin and of the end user ) 3. Diagnostic Data (including the Telemetry Data ) 4. Support Data 5. Website Data ( both the restricted access Admin Console and 4 relevant public ly access ible websit es ) This DPIA does not use the term Content Data, as these data are only processed by customers in their own environment . ESET’s security services scan the Content Data, such as visited URLs, executables and files , but when ESET processes these data, they are called Security Event Data in this DPIA. Th e 5 relevant categories of personal data are now specified in the new Data Processing Agreement with the Dutch government. GDP R r ole of ESET, purposes and compatibility of further processing Initially , based on an analysis of ESET’s standard Data Processing Agreement (DPA) , public Privacy Policy and relevant service terms, this DPIA assessed that ESET qualified as data controller for most categories of personal data, and for many essential and inevitable data processing purposes.

This resulted in a number of high data protection risks related to a loss of control of the nature, purposes and impact of the data processing. ESET and SLM Rijk have since contractually agreed that ESET is a data processor for 4 specific purposes, for the 5 relevant categories of personal data (not the Content Data, since these remain at the customer). The amended DPA explicitly governs use of Police Data under the Dutch Police Data Act , and includes provisions relating to data exportability under the Data Act and transfer of ownership /control . These 4 main purposes are: 1. Provide and maintain well - functioning and up - to - date software and services (with specific sub purposes) . 2. Secure the software and services (including vulnerability assessment and patch management) . 3. Provide technical support, including use of aggregated Support Data to improve the software and support for all customers . 4.

Process minimi s ed Personal Data from ESET LiveGrid Feedback and Reputation for statistical purposes and to technically improve the software and services . DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 9 of 132 Since every supplier needs to use some personal data from its customers for its own legitimate business purposes, for example, to send invoices, SLM Rijk and ESET have also agreed on a limitative list of 8 specific authorised further processing purposes. This means ESET can further process these data (it obtains as processor) as controller, when strictly necessary and proportionate for these purposes, and within the constrictions agreed in the amended Data Processing Agreement. In abbreviated form these 8 p urposes are: 1. Comply with legal obligations (all personal data) . 2. Bi lling, fulfilling of orders and payment purposes (Commercial Contact Data, Account Data and some Diagnostic Data) . 3.

Website analytics . 4. D etection of licensing compliance, fraud detection/prevention, and protection of ESET’s rights (Account and Diagnostic Data) . 5. I mprove and optimize the performance, and efficiency of the software and the IT infrastructure (Aggregated Diagnostic Data). 6. I nternal reporting, financial reporting, revenue planning, capacity planning, forecast modelling and product strategy based on analytics how the procured services are used (Aggregated (higher than a per - tenant level) Account, Diagnostic, Support Data and Website Data). 7. Feedback by admins (only with valid consent ) (Content Data, Account Data and Diagnostic Data). 8. Audit purposes (all personal data). Table with 1 6 mitigated high risks and low risks No. Risks Recommended measures government organisations Recommended measures ESET Measures taken by ESET 1. Loss of control 22 ‘controller’ purposes Become a data processor for the proposed limitative list of 4 main purposes, with sub purposes.

Agreed in DPA with limited list of 4 processor purposes (Account, Security Event, Diagnostic, Support and the restricted access Website Data) Accept the limitative list of 7 proposed authorised further processing purposes. Agreed in DPA with additional 8th purpose : Processing of personal data for the purpose of auditing and verification of compliance (certifications) with the Law or standards (mandatory for Police Data) Agree on GDPR - compliant definitions of terms like ‘ research’ and ‘aggregate’ . Agreed in DPA. Include a procedure in the agreement to allow the Dutch government to object to new purposes of the processing without contract termination. Agreed in DPA , with the exception of emergencies. 2. Loss of control and risk of reidentification : use of unspecified third parties as controller If ESET engages third parties for the authorised further processing purposes, they should be sub processors, bound to the same rules ESET agreed with the Dutch government.

A greed in DPA ( as processor and authorised controller) . Provide a limitative list of processors for all purposes of the processing of the Account, Security Event, Diagnostic, Support and Website Data. The DPA includes a list of (sub - )processors both as processor and authorised controller . 3. Loss of control and loss of confidentiality: compelled disclosure of personal data to government authorities in and outside of the EU New customers: Choose (1) the new EU private cloud offer or (2) use the air gapped on - premises solution. Do not use (3) the standard ESET cloud services (based on Microsoft Azure hosting). Ensure that the new EU private cloud offer ensures EU - exclusive processing of the Account, Security Event, Diagnostic, Support and Website Data. Available since March 2026. Offer an effective right to object to new (EU based) sub - processors without having to terminate the contract.

Agreed in DPA. Explain for each (sub - )processor in what countries outside of the EU the data can be processed, including remote access by engineers. ESET will only engage EU native sub - processors for hosting options 1 and 2, includin g support ticketing provider. Clarified potential transfers in option 3, as well as the data transfers as authorised controller for the authorised further processing purposes. Existing customers of the ESET standard cloud services: switch to option 1 or 2, or monitor the adequacy status of the USA Agree on a procedure to minimise the probability of compelled disclosure to government authorities. Agreed in Enterprise Agreement on procedure with data minimisation steps. DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 11 of 132 and prepare for potential changes. Publish transparency statistics. Agreed in Enterprise Agreement, ESET will publish annual statistics about requests received and requests resulting in disclosure.

Ensure that the 4 sub - processors Microsoft, AWS , Google and Salesforce inform ESET if they receive an order for compelled disclosure of personal data relating to Dutch government customers, and follow the same probability reducing steps. ESET shall use commercially reasonable efforts to ensure that its sub - processors provide notification, where legally permissible, of compelled disclosure requests concerning Personal Data. 4. Loss of control processor purposes Choose or switch to (1) the new EU private cloud offer or (2) use the air gapped on - premises solution. Do not use (3) the standard ESET cloud services (based on Microsoft Azure hosting). Become a data processor for the 5 categories of personal data for the proposed limitative list of 4 main purposes, with sub purposes. Agreed in DPA, data processor for the 5 categories of personal data for the limitative list of 4 main purposes, with sub purposes.

Accept the limitative list of 7 proposed authorised further processing purposes. Agreed in DPA with additional 8th purpose: Processing of personal data for the purpose of auditing and verification of compliance (certifications) with the Law or standards (mandatory for Police Data) Include a procedure in the new agreement to allow the Dutch government to object to proposed new purposes for the processing without contract termination. Agreed in DPA on a new good faith negotiation procedure. (SLM Rijk) after 1 or 2 years: conduct audits on compliance with purpose limitation. Grant a broad right to audit without first referring to existing audits. Agreed on audit details in Terms and Conditions Framework Agreement. Agree to a contractual commitment to prevent abuse of the inherent access capabilities for ESET in the software ( no backdoors ). Agreed 5. Loss of control due to lack of transparency retention periods for Account, Security Event, Diagnostic, Support and Website Data Customise retention periods.

Publish a list of specific retention periods for the Account, Security Event, Diagnostic, Support and Website Data. Agreed to publication separate from privacy policy by the end of Q3 2026. Distinguish between retention of Account Data of admins and end users, and retention of Commercial Contact Data. Agreed: − Account data (admin log - in credentials and logs) deleted upon termination of account + 30 days for logs + 3 years for security logs) − Commercial Contact Data stored for 4 years . Customers can ask for different retention periods. Clarify how long ESET retains the data available for admins as Detection, Management, Audit and Monitoring logs (for which admins can determine retention periods) Agreed, ESET has provided a description of data categories and retention periods in detail. Clarify if ‘aggregate’ data can still contain personal data, or data relating to a specific organisation, and what the retention period is (for authorised further processing purposes).

Definition included in F WA . 6. Loss of control due to lack of transparency Security Event Data Consider disabling the LiveGrid Feedback function. Publish detailed technical documentation about the specific data processing via the two LiveGrid cloud services (Reputation and Feedback) that allows an auditor to assess if the descriptions match with observed data processing. ESET will update relevant documentation by the end of Q3 2026 . ESET will allow customers to disable the LiveGrid feedback function by the end of Q3 2026. Commit to a hard deadline to remove the session ID from the Reputation data flow. Agreed and removed session ID. DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 13 of 132 Opt - out from sharing Content Data in the form of files and crash dumps as part of LiveGrid Feedback. Explain the consequences for ESET’s data collection if an admin opts - out from providing Content Data as part of LiveGrid Feedback to ESET.

ESET will update the button pop - up description for the LiveGrid Feedback function, with detailed explanation of what data are shared with ESET, by the end of Q3 2026. 7. Re - identifiability of personal data through long or unspecified retention periods (SLM Rijk) after 1 or 2 years: conduct audits on compliance with retention periods Do not retain Account Data for 3 years after contract termination " unless ESET requires evidence in case of a dispute with the customer ". Agreed, to be implemented by end of Q3 2026 latest. Allow customers to decide on the maximum retention period for support tickets, for example 13 months (not 4 years). ESET will differentiate between support & complaint cases and will offer DIY delete function in the S ervice H ub for both support tickets and attachments by the end of Q3 2026. Explain different retention periods of operational and security logs. ESET has provided PC access to relevant samples and has provided detailed explanations.

Explain what laws require ESET to retain which personal data, for how long. ESET has explained that it is required under Slovak cybercrime law (implementing NIS2) to retain security logs for 3 years. Document the retention period of Website Data in for example webserver access logs. ESET retains the restricted Website access logs (Admin Console) for 90 days. Public Website data for 6 months. 8. Inability to exercise data subject right to access Website and Diagnostic Data (except for audit logs). Provide access to personal data in webserver access logs in reply to a DSAR. ESET shall implement templates for complete DSAR responses by the end of Q3 2026. Provide access to personal data about updates, do not refuse access without a valid appeal to a legal exception. Agreed. Inform customers that personal data such as IP addresses appear in ESET’s own security logs, and provide access where possible.

ESET will document the existence and retention period of security logs and inform where necessary on it use of the exception to provide access (Art. 15(4) and 23(1) sub i of the GDPR), to protect its own internal security interests. 9. Inability to exercise data subject right to delete, and loss of control, Support Data Allow admins to delete specific tickets and/or attachments. Agreed, ESET will develop DIY delete functionality in the Service Hub by the end of Q3 2026. Show a warning not to upload personal or confidential data or give government organisations a central option to prevent sharing of screenshots and attachments. Agreed, by the end of Q3 2026. Agree to only process aggregated data higher than tenant level from support tickets as authorised further processing purpose. Agreed in the DPA. 10. Loss of control: maze of different Privacy and Cookie Policies Commit to a specific deadline in the near future to publish 1 uniform and consistent Privacy Policy and Cookie Policy.

ESET has unified the Privacy Policy and Cookie Policy for eset . com and eset . com / nl (redirected from eset.nl ) Date policies and terms, and consistently provide access to previous version. ESET will disclose the date of the publication of policies and terms and provide previous versions of services within the scope of the FWA by the end of 2026. Do not limit the documentation about the retention period of cookies to the expiry date, but include retention by ESET in for example its webserver access logs. ESET will complete the cookie documentation with relevant retention periods by the end of 2026. 11. Loss of control: incorrect cookie consent management Fix the bug with the Google advertising cookie. Fixed and confirmed via re - testing. Resolved. Commit to only set functional cookies, stop setting Google analytics cookies, and implement effective controls to prevent mistakes. Fixed and confirmed via re - testing.

12. Loss of control: lack of separation restricted access and publicly accessible websites Commit to implement one single consent flow for all 5 relevant ESET websites, including eset.com for the legal information at the policy hub, or Agreed, ESET will create one single consent flow for all traffic generated from the two language versions for the Netherlands (English and Dutch) by the end of Q3 2026. DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 15 of 132 ensure that all necessary legal and technical information is available via the restricted access Admin Console, and ESET has become a data processor for the restricted access websites. 13. Loss of control through lack of transparency contents of webserver access logs Publish documentation about the technical contents of webserver access logs. Agreed, ESET will publish a link to a general description and documentation of webserver components being used, by the end of 2026. 14.

Loss of confidentiality: Feedback Instruct admins not to provide Feedback. No measures necessary. No measures necessary. 15. Chilling effect use of available logs for employee monitoring Include rules in the internal IT policy how the detections are used, prevent negative assessments. No measures necessary. No measures necessary. 16. Loss of control: falsely flagged e - mails and files in quarantine Regularly check quarantined mails and files No measures necessary. No measures necessary. Conclusion Based on the new framework agreement with the Dutch government and ESET’s commitments Dutch government organisations can start to use the tested ESET security services without any known high data protection risk s, provided they apply the recommended measures . The m ost importan t measure government organisations must take is to only use the ESET services on - premises or the new EU private cloud solution .

In its standard cloud solution, ESET still relies on services from US American suppliers . Introduction This report, commissioned by Strategic Vendor Management Microsoft , Google Cloud and Amazon Web Services Rijk office ( SLM Rijk 1 ) housed at the Ministry of Justice and Security, is a data protection impact assessment (DPIA) about the processing of p ersonal data when using the tested ESET end point security services . The services were tested both as a cloud service, and as on - premises software . This DPIA report is written by the Dutch privacy consultancy firm Privacy Company. 2 Data Protection Impact Assessmen t (DPIA) Under the terms of the General Data Protection Regulation (GDPR), an organisation may be obliged to carry out a data protection impact assessment (DPIA) under certain circumstances . A ccording to Article 35, GDPR, a DPIA is required where the organisation is processing personal data on a large scale when it involves likely high risk to the rights and freedoms of the data subjects .

The GDPR does not specify what constitutes a large scale. The DPIA is intended to shed light on, among other things, the specific processing activities, the inherent risk to data subjects, and to propose safeguards to mitigate these risks. The purpose of a DPIA is to ensure that any risks attached to the process in question are mapped and assessed, and that adequate safeguards have been implemented to mitigate those risks. According to the GDPR a DPIA assesses the risks of data processing for the rights and freedoms of individuals. Data subjects have a fundamental right to protection of their personal data and some other fundamental freedoms that can be affected by the processing of personal data, such as for example freedom of expression. The right to data protection is therefore broader than the right to privacy. Consideration 4 of the GDPR explains: “ This Regulation respects all fundamental rights and observes the freedoms and principles recognised in the Charter as enshrined in the Treaties, in particular the respect for private and family life, home and communications, the protection of personal data, freedom of thought, conscience and religion, freedom of expression and information, freedom to conduct a business, the right to an effective remedy and to a fair trial, and cultural, religious and linguistic diversity ” .

This DPIA follows the structure of the DPIA Model mandatory for all Dutch governm ent organisations. 3 Umbrella DPIA versus individual DPIAs Pursuant to article 35 of the GDPR, a DPIA is mandatory if an intended data processing constitutes a high risk for the data subjects whose personal data are being processed. The Dutch Data Protection Authority (Dutch DPA) has published a list of 17 types o f processing for which a DPIA is always mandatory in the Netherlands. 4 If a processing 1 SLM Rijk is the abbreviation of the Dutch words Strategisch Leveranciersmanagement (for the central government) Microsoft , Google Cloud , AWS and EU CSPs . SLM Rijk also commissions DPIAs for (cloud)services from other suppliers. 2 https://www.privacycompany.eu/ 3 In Dutch only: Rapportagemodel DPIA Rijksdienst, 3.0, 25 July 2023, URL: https://www.kcbr.nl/sites/default/files/2023 - 08/Rapportagemodel%20DPIA%20Rijksdienst%20v3.0.docx 4 Dutch DPA, list of processings for which a DPIA is required, in Dutch only, Besluit inzake lijst van verwerkingen van persoonsgegevens waarvoor een gegevensbeschermingseffectbeoordeling (DPIA) verplicht is, URL: https://autoriteitpersoonsgegevens.nl/sites/default/files/atoms/files/stcrt - 2019 - 64418.pdf .

DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 17 of 132 is not included in this list, an organi s ation must itself assess whether the data processing is likely to present a high risk. The European national supervisory authorities (hereinafter referred to as the Data Protection Authorities or DPAs), united in the European Data Protection Board (EDPB) have also published a list of 9 criteria. 5 As a rule of thumb if a data processing meets two of these criteria a DPIA is required. In GDPR terms SLM Rijk is not the data controller for the processing of personal data via the use of tested ESET security services . The data controller is the individual government organisation that decides to use either the ESET on - premises , or the ESET cloud security services . However, as central negotiator for many cloud services, SLM Rijk commissions the umbrella DPIA to detect common data protection risks and negotiate for a framework contract that complies with the GDPR.

The umbrella DPIA s assist the government organisations to select a privacy - compliant deployment . The government organisations must still conduct their own DPIAs. Only the organisations themselves can assess the specific data protection risks, related to the technical privacy settings, nature and volume of the personal data they process and vulnerability of the data subjects. This umbrella DPIA is meant to help the different government organisations with the DPIA they must conduct when they deploy ESET security services , but this document cannot replace the specific risk assessments the different government organisations must make . Scope of this DPIA This DPIA assesses the data protection risks of the use of ESET Protect (remote management), ESET Endpoint Security for Windows and ESET Server Security (tested with SharePoint) . The services were doubly tested : as on - premises s oftware , and as cloud services.

Additionally, this DPIA includes the use of ESET Cloud Office Security for e - mail (tested with Gmail). This DPIA also analyses the linked data processing as a result of the use of the Admin Console and visits to ESET’s publicly available website s . This DPIA covers: • Description of the tested services (both on - premises and as cloud service) , plus the related service s that are inextricably linked to the use of these services: the ESET c loud management console , the creation of a Google account to become admin and a Google Cloud Identity (admin) account . • Role and purposes of ESET as provider of the tested services . • Possible t ransfer of personal data outside of the European Economic Area through sub - processors . • Exercise of data subject rights . • Retention and backup periods. Out of scope This DPIA is not a pen test or security audit, nor does it test the effectiveness of ESET products as security products.

Though Privacy Company did not observe any missing detection of (intentional) 'suspicious' behaviour, the tests are limited in scope. 5 The EDPB has adopted the WP29 Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is “likely to result in a high risk” for the purposes of Regulation 2016/679, WP248rev.01, 13 October 2017, URL: https://ec.europa.eu/newsroom/article29/item - detail.cfm?item_id=611236 This DPIA deals with the data protection risks of the collection of personal data (especially Diagnostic Data) through the use of these security services. The following ESET services are out of scope of this DPIA: • ESET Endpoint Encryption Client (Managed or Standalone) • The various ESET Mail Security products, including for the Microsoft Exchange server • ESET LifeGuard Advanced • Server security • Remote management: Full Disk Encryption • Cloud Office Security (Office Security, Authentication, Inspect ) • License management • Enhanced Detection & Response • Identity & Data Protection • Plugins & Integrations • Cloud M obile D evice M anagement (by syncing with other providers) • ESET Bridge (http proxy) • ESET Active Directory scanner Methodology This DPIA is based on different sources of information and fact - finding strategies.

Privacy Company has carefully studied the available documentation from ESET about the tested endpoint security services , including information about the different log files , reports and flags. To better understand the data processing in log files by ESET , Privacy Company created two test environments, on - premises and in the cloud . To test the data processing by ESET, Privacy Company used a set with examples of real but old (well - known) and fictive malware, and an example of an app that may collect sensitive personal data. During testing, Mitmproxy was used to capture browser - based network traffic and the Edge browser was used to use the admin consoles. The test admins accessed the relevant availa ble reports and log files in the a dmin c onsole s . In addition, two Data Subject Access Request s were filed with ESET to obtain the Diagnostic data relating to the behaviour of the test admin and end user .

The technical findings are documented in detail in a separate Technical Appendix . Chronology This DPIA was conducted between February 20 2 5 and February 2026 and finalised in June 20 26. Between 15 and 18 February 2025 Privacy Company tested the ESET endpoint security services, both as cloud services, and as on - premises software. Between 15 and 18 March 2025, Privacy Company performed some additional tests on the on - premises security manager. Privacy Company filed two data subject access requests on 19 February 2025, for the test user and for the admin. The outcomes of the DSAR are discussed in Section 3.3 of this DPIA. ESET, SLM Rijk and Privacy Company engaged in a productive dialogue, including a day long meeting with senior management in The Hague to address identified risks. In February 2026 Privacy Company retested ESET’s cookie flow and verified implementation of a mitigating measure.

ESET continued to provide helpful clarifications and explanations until finalisation of this DPIA. DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 19 of 132 In May 2026 SLM Rijk and ESET agreed on a new Framework Agreement with underlying agreements, including an amended Data Processing Agreement. On 24 June 2026 ESET provided a reply to the request to check the DPIA for company confidential information. SLM Rijk removed company confidential elements and replaced these with [ CONFIDENTIAL ] in the public version of the DPIA. Outline of this DPIA F ollow ing the structure of the Dutch central government model DPIA, this DPIA report uses a structure of four main divisions, which are reflected here as “parts”. A. Description of the factual data processing B. Assessment of the lawfulness of the data processing C. Assessment of the risks for data subjects D. Description of mitigation measures Part A explains the data processing by ESET and by governmen t organisations resulting from the use of the ESET Cloud Office Security with Workspace Gmail, and a client on Windows 11 Enterprise as cloud services as cloud service, and the ESET management software and client on Windows 11 Enterprise as on - premises software , both services combined with data processing through the Admin Console .

Part A starts with a description of the main categories of personal data processed by ESET , and a comparison of ESET’s public terms and policies with the standard ARBIT data processing agreement for the Dutch government . S ection 2 describes the tested services, and the contents of the different security reports generated by ESET . This starts with a description of the way ESET collects and processes different categories of personal data , and an overview of potential categories of data subjects that may be affected by the processing, the purposes of the data processing, the different roles of the parties, the different interests related to this processing, the locations where the data are stored (including use of sub - processors ) , compliance with ePrivacy rules, and the retention periods. In this Section , factual contributions and intentions from ESET are included. Part B provides an assessment by Privacy Company , with input from ESET , of the lawfulness of th e tested endpoint security data processing .

This part also assesses conformity with the key principles of data processing, including transparency, data minimisation, purpose limitation, and the legal ground (s) for the processing, as well as the necessity and proportionality of the processing. T his part ends with an analysis if and how ESET respects the rights of the data subjects. Part C assesses the risks to the rights and freedoms of the data subjects created by the processing activities identified in Part A of this DPIA . It identifies specific risks that may result from these processing by determining (1) the likeli hood that such a risk may occur, and (2) the severity of the impact on the rights and freedoms of the data subjects if the risk occur s . Finally, Part D contains concrete measures that can be taken by either ESET or the individual government organisations to mitigate the risks identified in Part C . These measures might either reduce the chance the risks occur , or reduce the impact they might have, or both .

Part D also contains an assessment of any residual risk (s) that cannot or will not be mitigated by applying the suggested measures . Part A. Description of the D ata P rocessing This first part of the DPIA provides a description of the characteristics of the personal data that can be generated and processed if a government organization uses ESET Protect (remote management), ESET Endpoint Security for Windows and ESET Server Security (tested with SharePoint). The services were doubly tested: as on - premises software, and as cloud services. Additionally, this DPIA includes the use of ESET Cloud Office Security for e - mail (tested with Gmail). This DPIA also analyses the linked data processing as a result of the use of the Admin Console and visits to ESET’s publicly available website. Part A continues with a description of the different categories of personal data that may be processed, the categories of data subjects that may be affected by the processing, the purposes of the data processing by ESET , the locations where data may be stored, processed and analysed, and the role s of the government organisations , and of ESET , as processor or as (joint) data controller s .

Finally, this Section provides an overview of the different interests related to the processing, and of the retention peri ods. 1. Description of the tested ESET security s ervices ESET offers many different services . This s ection describes two types of ESET services: cloud and on - premises . This DPIA assesses the data protection risks of the use of ESET Protect (remote management), ESET Endpoint Security for Windows and ESET Server Security (tested with SharePoint). The services were doubly tested: as on - premises software, and as cloud services. Additionally, this DPIA includes the use of ESET Cloud Office Security for e - mail (tested with Gmail). This DPIA also analyses the linked data processing as a result of the use of the Admin Console and visits to ESET’s publicly available website. Figure 1 : ESET overview of Protect Elite services for businesses 6 6 Screenshot from ESET Protect Elite information page, URL: https://www.eset.com/us/business/elite - protection/ DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 21 of 132 Table 1 : Overview of tested ESET services Product names On - premises Cloud ESET PROTECT On - Prem (remote management) x ESET PROTECT Cloud (remote management) x ESET Endpoint Security for Windows x x ESET Cloud Office Security (tested with Gmail) x ESET Server Security (for SharePoint) x x (SharePoint Online) Necessary support tools/services ESET Management Agent x x Mobile Device Connector x x Windows 11 Enterprise VM (SLM tenant x x Edge x x Microsoft SQL server 2022 (for SharePoint) x Windows server 2022 (for SharePoint) x 1.1 About ESET ESET is a European company, founded in 1992 in the Slovak Republic. 7 ESET provides security software and services to customers in 200 countries and territories worldwide.

Its software is locali s ed into more than 30 languages. The name ESET comes from the Czech name of Isis, the Egyptian goddess of health, marriage and love. 8 ESET is a privately held limited liability compan y. The founders that started the company in 1992 are members of the supervisory board . ESET does not offer public shares, but does publish annual financial reports. 9 ESET has offices in 17 countries, including the USA (ESET LLC) , and will soon open offices in 3 other countries. 10 ESET Protect offers more than antivirus and anti - malware software. ESET describes it offers “ multilayered protection and threat intelligence information, which protects against ransomware and botnets, blocks targeted attacks, prevents data breaches, and detects zero - day threats, fileless attacks, advanced persistent threats and more – thus coverin g the prevent, detect and respond phases . ” 11 B ecause ESET is security administration software, it necessarily has extreme visibility into both network traffic and stored files.

7 ESET , About ESET, URL: https://www.eset.com/me/about/ 8 Wikipedia, ESET, last visited 18 March 2025, URL: https://en.wikipedia.org/wiki/ESET 9 ESET, financial reports 2025, 2024, 2023, URL: https://us.backend.eset.com/int/about/ 10 Including the ESET Netherlands office, which ESET has bought from its distribution partner . 11 ESET Protect platform, undated, page last visited 18 March 2025, URL: https://www.eset.com/us/business/protect - platform/#c9219568 . software accesses is therefore broad. However, without this type of functionality organi s ations’ data would be less secure, which poses its own threat to privacy. Generally, ESET software and services operate at a low level with privileged access rights. T he technical assessment shows that ESET favou rs structures that begin in aggregate , and only identif y specific users if there is a problem to resolve.

“ LiveGrid collects information from end user computer s, related to newly detected threats. This information may include a sample or copy of the file in which the threat appeared, the path to that file, the filename, the date and time, the process by which the threat appeared on computer and information about t he computer‘s operating system. ” ESET wrote: “ Essentially, Reputation provides a fast, privacy - respecting way to identify known threats, while Feedback allows us to proactively address new and evolving threats through collaborative analysis. ” 13 1.2 Description of ESET Protect Cloud With ESET Protect Cloud admins can protect end users against security risks when they use online services, such as e - mail or cloud storage. ESET Protect Cloud is a Software as a Service (SaaS) offering with different admin interfaces, combined with locally installed software on the end user devices.

Privacy Company did not test all of ESET’s Protect Cloud services. See the section ‘Out of scope’ in the Introduction of this DPIA. Privacy Company tested with ESET’s standard cloud offering, including the use of US American suppliers. Since March 2026 ESET also has an EU - exclusive private cloud offering, with EU native subprocessors. Except for the removal of non - EU parties from the data processing chain, the processing in this private cloud does not technically differ from the tested data processing in the standard public cloud. 12 ESET, ESET LiveGrid, URL: https://help.eset.com/glossary/en - US/technology_livegrid.html . 13 E - mail ESET to Privacy Company, 20 March 2025. DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 23 of 132 Privacy Company created an installer, used ESET for Cloud on a Windows end user device, and tested downloading, sharing and adding some malware in Gmail in a Google Workspace workplace and on Microsoft SharePoint Online.

An admin can drill down in the different console s from an overview of detected threats down to the individual device and user account . T here is no [secret] algorithm flagging users as risky. The detection rules are transparent and logical. ESET makes a h uge list of all detection rules available to admins . 1.3 Description of ESET Protect on - premises Organisations may want to deploy the security software on - premises , for example, if they work with sensitive or highly confidential/secret data. In that case, they can deploy the admin interface on - premises as well. The available interfaces for admins are very similar to the cloud interfaces shown above . The admins have acces s to ESET Inspect On - Prem, ESET LiveGr i d, ESET full disk encryption and ESET Protect hub on - prem . DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 25 of 132 ESET Protect on - premises has many of the same functionalities and features as the cloud version, and can sync with Active Directory.

ESET provides a table with an overview of the differences between on - premises and the cloud management console. 15 A major difference is that the on - premises software can no longer be used for mobile device management. 16 Figure 6 : Screenshot part of ESET services on - premises v ersu s cloud 17 2. Legal : personal data and framework agreement The Dutch government DPIA model requires that this Section provides a list of the categories of personal data that will be processed, and per category of data subjects, what personal data will be processed by the product or service for which the DPIA is conducted. However, s ince this is an umbrella DPIA, only general descriptions can be provided of the categories of personal data and data subjects , in Sections 2.4 and 2.5 respectively . Section 3 describes t he specific personal data that ESET processes via the tested Protect endpoint security software and services , with a summary of the technical findings. 15 ESET, Differences between on - premises and cloud management console, undated, URL: https://help.eset.com/protect_cloud/en - US/differences_onprem_cloud.html , last visited 23 April 2025. 16 Idem. 17 Ibid. This Section starts with an explanation of the legal definitions, followed by an explanation of the different categories of personal data processed by ESET when a government organisation decides to use the tested endpoint security servi ces.

Section 2.3 describes the framework agreement . The Dutch government has sign ed a master agreement with ESET, with a specific Data Processing Agreement based on the Dutch government model Arbit 2020. 2.1 Definition of personal data According to article 4(1) (a) GDPR, “‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a nam e, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.” The concept of processing is defined in Article 4(2) of the GDPR: “ ’processing' means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval , consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. ” The GDPR explains that pseudonymised data are personal data, to which the GDPR applies.

Recital 26 explains: “ Pseudonymised personal data that can be linked to a natural person through the use of additional data should be regarded as data relating to an identifiable natural person. In order to determine whether a natural person is identifiable, account must be tak en of all means that can reasonably be expected to be used by the controller or by another person to directly or indirectly identify the natural person, for example selection techniques. In determining whether any means can reasonably be expected to be us ed to identify the natural person, account shall be taken of all objective factors, such as the cost and time of identification, taking into account available technology at the time of processing and technological developments. ” In its recent guidance on pseudonymisation the EDPB explains that “ the desired effect of pseudonymisation is to control the attribution of personal data to specific data subjects by denying this ability to some persons or parties. ” 18 The EDPB emphasises th at pseudonymous data are still personal data , and processing needs to comply with the GDPR.

The EDP B takes an absolute stance with regard to identifiability when it states : [Pseudonymous data are personal data , addition Privacy Company ] 18 EDPB, Guidelines 01/2025 on Pseudonymisation, 17 January 2025, consultation version, par. 4 , URL: https://www.edpb.europa.eu/system/files/2025 - 01/edpb_guidelines_202501_pseudonymisation_en.pdf DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 27 of 132 “ This statement also holds true if pseudonymised data and additional information are not in the hands of the same person. If pseudonymised data and additional information could be combined having regard to the means reasonably likely to be used by the contr oller or by another person , then the pseudonymised data is personal. Even if all additional information retained by the pseudonymising controller has been erased, the pseudonymised data becomes anonymous only if the conditions for anonymity are met. ” 19 In its standard Data Processing Agreement ESET refers to the GDPR and mentions the processing of “ information relating to an identified or identifiable natural person listed in ESET’s specific Privacy Policy for Enterprise customers (hereinafter referred to as the "Personal Data") .” 2.2 Five c ategories of personal data In order to provide a precise analysis of the different types of personal data processing and their impact, this DPIA distinguishes between five categories of personal data that ESET can process as a result of the use of the tested set - up.

In previous DPIAs for SLM Rijk Privacy Company explained that three main categories of data flows can be distinguished when analysing the data processing by a cloud provider: Content, Diagnostic and Functional Data. Content Data are the data generally prov ided by the users of a service, Diagnostic Data are the data generated and collected by the provider about the individual use of the service, while Functional Data covers the data that are only temporarily processed by a cloud provider to execute desired f unctionalities, but not stored , and are hence, generally out of scope of the DPIA . In this case, the distinction between Content and Diagnostic Data is not so clear. The key purpose of the endpoint security services is to analyse the potential risk of Content D ata. This type of data processing, the security analysis of the Content Data touched by end users , merits the introduction of a new in - between category of ‘ Security Event Data ’.

Consequently, Content Data (personal data processed by customers in their own environment) is distinguished because ESET does NOT process Content Data. Th ough this DPIA is focussed on the data protection risks of the processing of Security Event Data , it also addresses the data protection risks of the processing of the Diagnostic, Account, Support and Website Data. 1. Security E vent Data ( the data generated by ESET about suspicious content and actions by admins and/or software to prevent threats). 2. Diagnostic Data ( Telemetry Data, web server access logs, and ESET’s own security and infrastructure logs . ) 3. Account Data ( in three types: end users, admins and commercial contact persons . ) 4. Support Data ( data in requests for technical support from ESET. ) 5. Website Data ( in two types: the restricted access webpages , i.e. the Admin Console s , and the relevant publicly available ESET help and legal pages .) 19 Idem , par. 2 2 . 2.2.1 Content Data Content data are the personal and non - personal data from customers such as subject lines or attachments of e - mails, visited URLs, downloaded executables (or attempts to download them, but prevented by ESET), and documents with their pathnames that may be checked by the tested security services , either on - premises or in the ESET cloud.

Content Data do not include the Account Data, and may also include non - personal data. To test the processing of possibly sensitive Content Data , Privacy Company used four different malware files (3 real, one fake) and a Word, PDF and Excel document to test the processing of non - malicious files containing personal data . Besides the files explicitly included in the testing , many executable and non - executable files where also present while testing . Privacy Company did not observe any of these non - malicious files in the traffic shared with ESET. See the Technical Appendix for the details. This DPIA cannot provide a description of all possible kinds of Content Data that government organisations may process that can be checked by ESET, as this depends entirely on the nature and data processing purpose s of the organisations. To help government organisations perform their own DPIA, Section 2.4 below contains a description of categories of personal data whose processing has a different impact on data subjects, and are therefore relevant for the risk assessment.

Section 2.5 below similarly provides a high - over description of the different kind of natural persons involved by the data processing, the data subjects. 2.2.2 Security Event Data This category covers all personal data collected or generated by ESET about suspicious content as well as the actions by admins and/or software to prevent threats. 2.2.3 Account Data ESET processes three types of a ccount data : of (i) end users (ii) of admins and (iii) of commercial contact persons . The personal data ESET requires for the end user and admin accounts are explained below , in Section 3.3 . ESET also processes a third category of Account Data: of commercial sales contacts that procure the licenses for an organisation ( C ommercial C ontact D ata). ESET describes these Commercial Contact Data in its general English language Privacy Policy as follows : “ If you purchase any of our Services on the Site, we collect the following Personal Information to process your payments and fulfil your orders: o Personal Identifiers.

This includes your name, phone number, email address, and mailing address; o Commercial Information. This includes transaction information and your order history; o Financial Information. This includes your payment method and billing address; and DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 29 of 132 o Company Information. If you are a B2B customer, we may collect the name of your company, job title and contact information .” 20 It is possible (as in the test set - up by Privacy Company) that an admin and contract owner are identical, but with larger government organisations, the roles are likely assigned to different employees. Since February 2026, ESET has made a technical distinction between the admin Account Data and the Commercial Contact Data. 2.2.4 Diagnostic Data Diagnostic data are the metadata that ESET records as part of the technical functionality of the services, such as logins, activities by admins and end users, license management, downloads of library updates and shared hashes.

This category of data i ncludes Telemetry Data, web server access logs, and ESET’s own security and infrastructure logs, but not the Security Event Data itself. The technical details are described in Section 3.4 below. 2.2.5 Support Data Admins can send support request s via support.eset.nl. They can add a description of the issue and upload attachments . 2.2.6 Website Data This report identifies two categories of Website Data : 1. Restricted access Website Data ( Admin Console ) 2. Relevant p ublicly accessible ESET W ebsite Data ( login, help , support and legal) Both categories of Website D ata are broad. They can include data collected by cookies , pixels , URL parameters and other similar technologies to read information from the end user browser . Technically, as described above, Website Data are a form of metadata on the behaviour of system administrators, and therefore part of the broad category of Diagnostic Data.

However, for analytical clarity, and because of differences in inspection methods, this report separately analyses the data recorded through the use of the ESET Admin Console s and the relevant public ly accessible webpages . 2.3 F ramework agreement ESET and SLM Rijk agreed to use the standard Dutch government ARBIT 2022 21 as starting point for the framework agreement, with the model ARBIT D at a P rocessing 20 ESET Privacy Policy accessible through the ESET Control Hub, English version used for this DPIA effective date 2 October 2025, URL https://www.eset.com/us/policy - hub/privacy/ (page last visited 19 November 2025). ESET has since updated this policy, effective date 24 April 2026 (page last visited 9 June 2026). ESET also publishes an undated Dutch language privacy policy at the URL: https://www.eset.com/nl/policy - hub/privacybeleid/ . The contents are different. The Dutch policy refers for all details to another undated Dutch Privacy Policy of the Slovak HQ, with information about legal grounds and retention periods, at the URL: https://web - assets.eset.com/fileadmin/ESET/NL/Documenten/privacy - policy - eset.pdf 21 ARBIT 2022 in English, 10 September 2022, URL: https://www.pianoo.nl/sites/default/files/media/documents/2022 - 11/arbit_2022 - english - sep2022.pdf .

A greement . 22 This section analyses relevant deviations from ARBIT 2022 in ESET’s terms and conditions for the cloud and on - premises software . ESET offers many different Privacy Policies on its different websites. 23 For example a general p rivacy policy in Dutch for Dutch customers, and a different policy for processing governed by the Slovak headquarters. 24 Based on ESET’s feedback to this DPIA, the only relevant general Privacy Policy is the one accessible from the Protect Hub, mainly aimed at US customers. 25 ESET writes in its Privacy Policy it can unilaterally change its Privacy Policy ‘from time to time’ , and asks customers to ‘check back periodically’. 26 ESET does not (yet) offer an archive of past versions of the Privacy Policy. ESET applies its general Privacy Policy to the processing of four types of personal data: Commercial Contact data (including billing information) , (public) Website visitor data and Support Data ( Customer Service ). 27 However, based on the ARBIT 2022 Data Processing Agreement (the definition of Personal Data as “ any data concerning an identified or identifiable natural person that is Processed by the Counterparty for the Contracting Authority in the context of the Contract ” ) ESET may not proces s Support Data for its own purposes (as defined in the Privacy Policy).

Figure 7 : Applicable terms for ESET Protect Cloud and on - premises 28 22 ARBIT Data Processing Agreement 2022 in English , September 2022, URL: https://www.pianoo.nl/nl/files/documents/25167/Model - verwerkersovereenkomst - arbit - 2022 - English.docx . 23 Initially Privacy Company used the Dutch language version ESET Privacybeleid, undated, URL: https://www.eset.com/nl/privacy/ , page last visited 9 June 2026 . The Dutch policy includes a reference to the applicability of the ESET privacy policy from the Slovak headquarters at URL: https://www.eset.com/fileadmin/ESET/NL/Documenten/privacy - policy - eset.pdf . Privacy Company initially used the English translation of this Slovak document, from the URL: https://www.eset.com/gr - en/policy - hub/privacy/ . However, in reply to this DPIA, ESET explained that only the general Privacy Policy accessible through the ESET Control Hub applies, effective date 2 October 2025, URL https://www.eset.com/us/policy - hub/privacy/ (page last visited 19 November 2025).

This Privacy Policy seems primarily aimed at US customers , but was still used as the relevant policy throughout this DPIA. ESET has since created one flow to the (undated) Dutch Privacy Policy at eset.com/nl. 24 ESET Privacybeleid, undated, URL: https://www.eset.com/nl/privacy/ (page last visited 24 November 2025). 25 ESET (general) Privacy Policy, 2 October 2025, see footnote 23 . 26 Idem , Section 8, s ee footnote 23 . 27 Idem . 28 ESET legal documents, URL: https://help.eset.com/protect_cloud/en - US/?legal_documents.html . DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 31 of 132 ESET makes admins and end users accept a n EULA, 29 different Privacy Policies for Cloud 30 and for on - premises 31 , and Terms of Use. 32 The Terms of Use refer to yet another version of ESET’s general privacy policy, effective 19 July 2023. 33 ESET reserves the right to unilaterally change its Terms of Use.

ESET writes: “ ESET reserves the right to revise these Terms and documentation or any portion thereof at any time by updating the relevant document to reflect changes to the law or changes to Account. You will be notified about any revision of these Terms by email or via your Account. If You disagree with the changes to these Terms, You may cancel your Account. ” By not dating the privacy policies for the use of Windows endpoint security and ESET Protect Cloud, ESET makes it very difficult for customers to keep track of changes. ESET’s standard Data Processing Agreement 34 describes the purposes of the processing as “ instructions described in these Terms, its Annexes, Privacy Policy, and service documentation .” 35 The DPA also includes ESET’s Security Policy 36 and the SCC. However, Article 4 of ESET’s standard DPA specifies that ESET may only process personal data for explicit written instructions from the Dutch government : “ The Counterparty will Process Personal Data only for, and on the basis of written instructions from, the Contracting Authority, unless the Counterparty is required by a statutory regulation to carry out Processing. ” And: “The Counterparty [i.e.

ESET] has no control over the purpose or means of the Processing within the meaning of the Regulation.” 37 In sum, ESET's public enrolment framework consisted of two pillars, with different applicable guarantees for the personal data processing, depending on ESET's role as a data processor or as a (third party) data controller. 29 ESET EULA, Effective 19 October 2021, URL: https://repository.eset.com/v1/com/eset/eulas/product/lg/v3537/3537.0.0/EULA - PRODUCT - LG.zip/eulaENU.html . ESET mentions this same EULA with another URL (with a checkbox ‘for products with updates’). URL: https://repository.eset.com/v1/com/eset/apps/business/ech/v4/4.0.5.0/ESETBridge_nt64.msi. eula/eulaenu.html . ESET also uses the URLs https://help.eset.com/ees/12/en - US/?eula.html and https://help.eset.com/protect_admin/11.1/en - US/eula.html (for on - premises ), but the contents appear to be the same. 30 ESET Privacy Policy for ESET Protect cloud, effective 19 July 2023, URL: https://help.eset.com/protect_cloud/en - US/privacy_policy.html . 31 ESET Privacy Policy for On - Prem version 12.0 and (identical) for ESET Endpoint Security for Windows, Windows client version 12, both undated, URL: https://help.eset.com/protect_admin/12.0/en - US/privacy_policy.html (page last visited 24 November 2025). 32 ESET Protect Terms of Use, effective 29 September 2023, URL: https://help.eset.com/protect_cloud/en - US/terms_of_use.html 33 ESET Privacy Policy for ESET Protect cloud, effective 19 July 2023, URL: https://help.eset.com/protect_cloud/en - US/privacy_policy.html . 34 ESET Data Processing Agreement for Protect Cloud , effective 29 September 2023, URL: https://help.eset.com/protect_cloud/en - US/annex2.html . 35 Idem, Section 2 (vi). 36 ESET, Security for ESET PROTECT, undated, URL: https://help.eset.com/protect_cloud/en - US/cloud_security.html , page last visited 23 April 2025. 37 ARBIT model DPA 2022, Articles 4.1 and 4.2.

Mitigating measures ESET and SLM • In May 2026 SLM Rijk has signed a (new) F ramework agreement with ESET that governs the contractual relation between ESET and the organisations in the Dutch Central government (as mentioned in the Rijksalmanak) that procure and use the ESET services. The new Framework A greement includes an Enterprise Agreement and an amended DPA that formalises ESET’s role as data processor for 4 main processor purposes, with sub purposes, for all relevant personal data (Account, Security Event, Diagnostic, Support and the restricted access Website Data). See Secti on 5.2 of this DPIA. • The new DPA also includes a limitative list of 8 purposes for which SLM Rijk has authorised ESET to further process some personal data, when strictly necessary for legitimate business purposes, in a role as data controller. These purposes will be elaborated in Section 5.4 . • ESET has ensured 1 data flow for the Privacy Policy for eset.com and eset.com/nl (which is redirected from eset.nl) and will update the contents by the end of 2026. • ESET will disclose the publication dates of relevant policies and terms, and will provide previous versions of the relevant policies and terms covered by the agreement with the Dutch government by the end of 2026. 2.4 Categories of personal data process ed by ESET This section provides a general description of the types of personal data that can be processed by ESET’s security services , distinguished by the impact of potential unlawful processing on data subjects (confidential, sensitive and special categories of data).

As shown in Figure 8 below, there are no hard lines between the categories. Depending on the context, the same data may be regular, sensitive or special categories of data. Figure 8 : Categories of personal data and their impact DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 33 of 132 2.4.1 Classified information The Dutch government defines 4 classes of Classified Information, ranging from confidential within the ministry to extra secret state secret. 38 Dutch government employees will, depending on the capacity in which they work, often process Classified Information. Classified Information is not a separate category of data in the GDPR or other personal data legislation. Nonetheless, information processed by the government that is qualified as classified information, whether it qualifies as personal data or not, must l egally be protected by special safeguards.

The processing of this information can also have a privacy impact when it is related to an individual. If the personal data of an employee, such as unique user (account) ID, or unique device identifier, can be con nected to the information that this person works with Classified Information, the impact on the private life of this employee may be higher than if that person would only process ‘regular’ personal data. Unauthorised use of this information could for examp le lead to a higher risk of being targeted for social engineering, spear phishing and/or blackmailing. 2.4.2 Personal data of sensitive nature Some types of ‘normal’ personal data have to be processed with extra care, due to their sensitive nature. Examples of such sensitive data are the contents of communication, web surfing behaviour, financial data, but also, authentication details of admins that may provide access to large datasets with such sensitive data.

Because ESET software and services have access to and processes potentially all files processed on a computer , file share or inbox even data that doesn’t fit into well documented work processes can be processed , s uch as information about work - place conflicts , occasional medical files , or CV’s that are still stored in a mailbox. The sensitivity of the data is related to the level of risk for the data subjects in case the confidentiality of their data is breached. Risks may vary from work - place monitoring of employees by admins to a full compromise of all personal data if access to the ESET admin accounts is abused. 2.4.3 Special categories of personal data Based on the GDPR, the processing of special categories of personal data is prohibited, unless one of the exceptions applies from the limitative list included in the GDPR. According to Article 9 (1) GDPR, personal information falling into special categories of data are any: “personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concernin g health or data concerning a natural person's sex life or sexual orientation”.

With special categories of data, the principle is one of prohibition: special data may not be processed. There are exceptions to this rule, however, for instance when the data subject has explicitly consented to the processing, or when data have been made manifestly public by the data subject, or when processing is necessary for the data controller to exercise legal claims. 38 Defined in: Besluit Voorschrift Informatiebeveiliging Rijksdienst Bijzondere Informatie 2013 (VIRBI 2013). It is possible to process any special categories of personal data with the tested services on ESET . 2.5 Possible categories of data subjects This umbrella DPIA can only indicate categories of data subjects that may be involved in the processing but cannot assess the specific risks of the actual data processing per organisation that uses or will use the tested ESET services . As described in Sectio n 2.2.1 of this report, e ach government organisation determine s itself what personal Content D ata it wants to process on devices and services protected by ESET software .

S uch devices may process lists of inhabitants , patients, clients, employees, suppliers and/or end - users. Specific types of data subjects are included in the Account and Diagnostic Data : the admins and commercial procurement officers of a government organisation. The government organisation must keep an overview of the different categories of data subjects in its data processing inventory ( Article 30 GDPR) , and must list t hese categories of data subjects in the Standard Contractual Clauses, when such clauses apply to the transfer of personal data to a third country . In the SCC from the European Commission , the Annex contain s a separate list of the category or categories of data subjects. 39 This annex includes the following p ossible types of data subjects : • Employees, contractors and temporary workers (current, former, prospective) of data exporter; • Dependents of the above .

This may be relevant when , for example, a BYOD policy results in children or spouse sharing the ESET - secured device ; • Data exporter's collaborators/contact persons (natural persons) or employees, contractors or temporary workers of legal entity collaborators/contact persons (current, prospective, former); • External persons (e.g., customers, citizens, clients, patients, visitors, etc.) and other data subjects that are users of data exporter's services; • Partners, stakeholders or individuals who actively collaborate, communicate or otherwise interact with employees of the data exporter and/or use communication tools such as apps and websites provided by the data exporter; • Stakeholders or individuals who passively interact with data exporter (e.g., because they are the subject of an investigation, research or mentioned in documents or correspondence from or to the data exporter); • Minors; or • Professionals with professional privilege (e.g., doctors, lawyers, notaries, religious workers, etc.). 3.

Results technical investigation In order to better understand the data processing of log files by ESET , a Privacy Company employee performed test scenarios and subsequently accessed the available log file s in the (web) Admin Console . In addition, a D ata S ubject A ccess R equest (DSAR) was filed with ESET to obtain the Diagnostic data relating to the 39 European Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, URL: https://eur - lex.europa.eu/legal - content/EN/TXT/HTML/?uri=CELEX:32021D0914&from=EN . DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 35 of 132 behaviour of the test admin . The results of the DS A R are discussed in Section 3.7 of this report. T his Section explains in detail what Diagnostic Data were observed in the technical inspection of the data, and why some of these stored Diagnostic Data on the use of the tested ESET services are personal data as defined in article 4(1) of the General Data Protection Regulation (GDPR). 3.1 Content Data Through the ESET client installed on Windows device s , ESET process es the following content for each computer : 1.

All files including the operating system ( OS ) , all executables, and the entire hard drive , plus storage services like SharePoint on - premises . Any resulting flags from scans (e.g. finding suspected malware) are sent to the ESET back - end (on premises or in the cloud depending on the configuration ) where alerts and analysis are made available in the A dmin C onsole. 2. Scanning the memory, running processes, and metadata . Again, any resulting f lags are sent to the A dmin C onsole. 3. The ESET cloud Protect service additionally performs scans and processes content for files in the cloud, email, SharePoint Online, etc. If the organisation has enabled LiveGrid Feedback functionality, ESET sends suspected files to itself in a data flow that looks like telemetry, but isn’t. In these events ESET applies extra obfuscation (on top of the standard TLS encryption) . ESET explained it has the policy to always apply encryption to the Content Data it stores, such as files or documents. 40 Figure 9 : [ CONFIDENTIAL ] Regardless of using ESET as configured for on - premises or cloud, the ESET admin by default only gets to see data about suspected activities and files , not everything (not all files or mails) that are processed by the ESET software such as the full contents of all scanned files .

Privacy Company expects that using an on - premises solution is not an effective miti gation as long as automatic updates are used. Privacy Company did not see any evidence that this risk has occurred in practice for ESET customers . There is no practical mitigating measure for this risk ; customers have to trust the supplier of security software, including the supplier’s legal regime. 40 ESET reply to the second version of the Technical Appendix, 30 May 2025. Mitigating measure ESET • ESET has agreed to include the following no backdoor assurance in the Fwa with the Dutch government : ''ESET has not and shall not intentionally create or implement any hidden access mechanisms, backdoors, or programming functions designed to enable unauthorized access to Personal Data processed under the Agreement. ” 3.1.1 Feedback Data If cloud providers provide a form for users to provide Feedback about the service, it is possible that users share Content Data with the provider in a way not authorised by the organisation .

During the limited testing, Privacy Company did not see an active request from ESET for Feedback, nor a Feedback button in the end user interface. ESET confirmed it does not actively ask for Feedback, and only makes a voluntary Feedback option available to admins in the main interface of Protect Hub (left column of the admin console). 41 The form does not contain an option to add attachments to the Feedback , which decreases the probability that users inappropriately share personal data with ESET . See Figures 6 and 7 in the Technical Appendix . 3.2 Security Event Data ESET registers Security Event Data in log files . These log files necessarily contain C ontent Data for security purposes , including detecting , diagno sing and responding to security events . For example, if an email message matches a detection rule, the ESET log files will contain C ontent Data from the email message in order to determine if further action is necessary or to recover the contents of the e - mail .

ESET explains : “ Log files contain information about all important program events that have occurred and provide an overview of detected threats. Logs are an essential tool in system analysis, threat detection and troubleshooting. Logging is performed actively in the background with no user interaction . ” 42 Mitigating m easures ESET • ESET has provided explanations of the different retention periods of the operational logs and the security logs. Based on Slovak cybercrime laws, ESET must retain security logs for 3 years. ESET retains operational logs from ESET’s own infrastructure between 90 days (for the webserver access log of the Admin Console) up to 4 years. See the explanations in Section 10.2 . • Document the configuration impacts of the two LiveGrid options ( Reputation and LiveGrid) by the end of Q3 2026. • Ensure that optionally disabling LiveGrid feedback can be done without disabling LiveGrid Reputation (creating two different controls) by the end of Q3 2026. 41 ESET reply to the Technical Appendix, 9 April 2025. 42 ESET Endpoint Security, Log files, undated, URL: https://help.eset.com/ees/12/en - US/idh_page_logs.html?idh_page_logs.html , page last visited 24 April 2025.

DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 37 of 132 3.2.1 Five dashboards with Security Event Data Privacy Company tested six software products and services. ESET provides access to logs with Security Event Data via 5 main dashboards, each containing multiple kinds of logs. Table 2 : Contents of 5 dashboards with Security Event Data Name of dashboard Observed contents Windows endpoint client logs (including the endpoint scanning SharePoint server) 15 logs available for end users , but only 3 logs contained events in the test tenant : 1. ‘Sent files’ (did not include content) , 2. ‘Detection logs’ ( detection of 6 test viruses) and the 3. ‘Events’ (describes that a file with anonymous statistical data is sent to ESET, but does not provide access to the sent data, and mentions that a specific virus is sent to ESET’s virus inspection lab for further analysis).

The end user can export the available detection logs as XML. Protect hub audit logs (including on - prem ises ) S eparately discussed below, in Section 3.4.1 ESET Protect dashboards and other logs (including on prem) Detection dashboard, with options to drill down to device level (not the user name) , options for admins to take actions with submitted files and access to quarantined files. ESET Protect & Inspect logs Dashboard with detailed records per device and more investigation options for admins in case of incidents. Cloud Office security Lo gs about events in the Microsoft Office and Google Workspace environment , with less details about flagged suspicious activity. All dashboards contain a tab with detections of suspicious and malicious files. These logs contain the most relevant personal data for th is DPIA. All dashboards also have an overview of the key object of the monitoring: devices or users.

The logs contain several kinds of identifiable A ccount D ata, with names and e - mail addresses, plus information about the protected devices, and the specific files or processes that have been flagged. Examples: file name, command line arguments and the user account executing a file. ESET also registers known mal icious files, applies logic to detect uncommon or suspicious behaviour, and registers a reputation score of executables based on its own Live G rid service. ESET deploys t wo types of detection: through its cloud services LiveGrid Reputation and LiveGrid Feedback , and locally, with a long set of rules. LiveGrid R eputation indicates whether a file is known to be malicious in the outside world. LiveGrid Feedback sends more detailed information about a suspected file to ESET. The local rules are pre - programmed and customisable rules that detect malicious content based on behaviour, among other things.

We are dependent on You sending us o infiltrations such as potential samples of viruses and other malicious programs and suspicious; problematic, potentially unwanted or potentially unsafe objects such as executable files, email messages reported by You as spam or flagged by our product; o information about devices in local network such as type, vendor, model and/or name of device; o information concerning the use of internet such as IP address and geographic information, IP packets, URLs and ethernet frames; o crash dump files and information contained. We do not desire to collect your data outside of this scope but sometimes it is impossible to prevent it. Accidentally collected data may be included in malware itself (collected without your knowledge or approval) or as part of filenames or URLs and w e do not intend it to form part of our systems or process it for the purpose declared in this Privacy Policy. ” 43 Privacy Company observed outgoing data traffic from the Windows end user client software to one specific ESET domain, https://ts.eset.com/query/chsquery.php.

Privacy Company assumed these events were Telemetry Data but ESET explained this data flow is part of the LiveGrid functionality to download up - to - date lists of risky or definitely safe files, and to send hashes of detected files to ESET. 43 ESET replies to questions Priv a cy Com p any , 21 March 2025. DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 39 of 132 Figure 10 : Example of apparent Telemetry Event ESET explained that the observed traffic was caused by LiveGrid, the combined Reputation and Feedback services that were enabled in the test set - up. . Normally requests for hashes of newly detected files are shared immediately with ESET, when an executable file is created or downloaded. But in some cases, ESET explained, the query is postponed and sent after the scan, “ to avoid slowdown of file creation. ” 44 ESET explained that the software also scans e - mail attachments or downloaded documents with macros, or archives containing executable files or documents with macros, which may need some more time.

ESET explained it only retains the IP - address from these events, and does not use these data to identify users. Initially ESET also collected a session id (highlighted in Figure 10 above), which enabled ESET to identify a user. In reply to this finding, ESET explained it had replaced all session IDs by zeros, and later confirmed it had remov ed the field from the schema. 45 ESET does not (yet) publish documentation about this LiveGrid Reputation data flow. ESET provided a table with an overview of the differences between LiveGrid Reputation and LiveGrid Feedback , as shown in Table 3 . 46 Table 3 : Differences between LiveGrid Reputation and LiveGrid Feedback LiveGrid Reputation LiveGrid Feedback Feature This is the primary method for quickly assessing files. When an executable file, document, or archive is encountered – whether ESET wrote: “ This component is optional and requires explicit user consent or configuration by the admin to allow it.

When enabled, it allows endpoint 44 E - mail ESET with answers to second set of questions Privacy Company, 20 March 2025. 45 ESET first reply to part A of this DPIA and the Technical Appendix, 30 May 2025. 46 E - mail ESET to Privacy Company, 20 March 2025. created locally, downloaded from the internet, or received as an email attachment – we generate a unique cryptographic hash of that file. This hash acts like a digital fingerprint. We then query our cloud - based database to see if this hash matches any know n good (whitelisted) or bad (blacklisted) files. devices to share potentially malicious files with ESET for further analysis. ” Privacy Company notes that th is functionality was enabled by default in the test tenant. Data Sends hashes of detected files to ESET Sends f iles + me tadata + Device/Internet Info + Crash Dumps Cloud/On - prem ises p rocessing Primarily local, with hash checks against th e cloud database Cloud - based analysis of shared files Data Processing Information Only the hash is transmitted to ESET for these checks.

No a ctual file content is sent . This minimi s es data sharing and supports privacy principles. Unlike Reputation, Feedback involves sharing data, including the suspicious file itself, associated metadata (file path, timestamp, process information), device details, internet usage data like IP addresses and URLs, and even crash dump files. ES E T explained it does not link any LiveGrid Feedback data back to individual users, but ESET does make this information available for cloud admins , and ESET admins can technically access the cloud da shboards from customers with all the logs. Mitigating measures ESET • Explain the content of the data ESET can process if admins decide to provide LiveGrid Feedback, both in the button pop - up description and in relevant documentation, by the end of Q3 2026. • ESET will allow customers to disable the LiveGrid F eedback function by Q3 2026 without disabling LiveGrid Reputation. • ESET has removed the session ID from the LiveGrid data flow. 3.2.3 Rule based detection Next to LiveGrid, ESET also uses a long list of rules to detect suspicious Content Data within ESET Inspect .

Figure 11 below shows a sample of the list of rules. DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 41 of 132 Figure 11 : Top of long list of available rules Rules look for a collection of behaviours, files, or network traffic that are known to ESET to be suspicious. Because security monitoring potentially processes all data stored or otherwise processed on the monitored devices, the detection rules take on a g reater significance. ‘ False positive s’ can result in processing of more personal data than is strictly necessary and lead to alert fatigue for security admins , resulting in missing actual security incidents. The opposite is also true : ‘ false negatives ’ result in admins missing security incidents and ESET not blocking some security threats. Both have potential negative consequences for data subjects. As shown in Figure 12 , one rule that would trigger a Security Event is an incoming remote connection to a computer via the program AnyDesk, with a subsequent attempt to install new local software using the – silent - setting to su p press output from the installation.

Figure 12 : Per filter, the syntax and the logic drill down Ideally, rules only find actual security problems, but there are ‘ false positives ’ in any system — rules can accidentally collect content and behaviours that were not actually malicious. Privacy Company triggered the detection of unusual behaviour through the use of Mitmproxy during the tests (see Section 7 in the Technical Appendix ). Mitmproxy is, by itself, perfectly legitimate, but not a tool frequently used by many users and it’s behaviour in a normal office environment can be a sign of malicious activity. New malware connecting to a bank would also fit this description of something unpopula r connecting to a popular webservice. When first encountering brand new threats, ESET does not have existing fingerprints to check against. Therefore, the detection of behavioural anomalies is an important element of the key protection purpose, even though this might result in incorrect flags, or the monitoring of web surfing behaviour.

A dmin s have full transparency and can view the pre - configured rules from ESET through the Protect & Inspect interface. For each rule, admins can further drill down into the details including the industry - standardised name of the attack, the Mitre ID number (a standardized numbering system from the Mitre corporation) for the attack, and a description of the attack in English and the technical definition of the specified rule . For example, as shown in Figure 12 above , ESET explains why the svchost rule was invoked when Privacy Company installed the AnyDesk remote desktop software (on the test VM) . admins can also create their own custom rules. For example, an a dmin could craft a new rule to quarantine all messages with a subject line corresponding to an on - going phishing attack. The government organisation that employs ESET software must assess what personal data are processed based on the ESET configuration.

ESET has limited knowledge of DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 43 of 132 how software is used by its customers and how technical monitoring translates into processing of personal data. Government organisations can deploy ESET and use the collected personal data to document how the processing by ESET software translates into processing of personal data in that context . A dmins can show end users the chosen rules and data, except for obfuscated events sent to the LiveGrid Update service . The full list of rules would likely prove overwhelming to non - technical users. Once admins have deployed ESET services, they have a high degree of visibility into any content that is flagged as unsafe from that tim e on . ESET does not publish detailed information , other than the general examples of the contents of its logs with Security Event Data . 3.3 Account Data Privacy Company created multiple accounts during the course of testing: • 1 admin (Sjoera Nas) • 1 user (Floor Terra) • local accounts on the pc , such as the local user accounts and accounts for Microsoft SQL Server and SharePoint Server. • Google account for Gmail • Microsoft account for SharePoint Online.

During the creation of the admin /user account s , ESET collect s first and last name, e - mail address and telephone number , country and preferred language, not any other data such as gender, or date of birth . Initially, ESET did not offer distinct processes for registration of the root admin and collection of Commercial Contact Data, from for example procurement officers. In the test set - up, the root admin was identical to the person paying the bill, but this won’t be the case with government organisations . The required billing information is more extensive, including company name, address , VAT and Chamber of Commerce number. Mitigating measure s ESET • ESET has made a technical distinction between admin Account Data and Commercial Contact Data since 20 February 2026. • ESET has agreed to process the admin Account Data as processor and the Commercial Contact Data as authorised controller, see Section s 6.2 and 6.3 . • ESET will apply different retention periods to the two categories of personal data , see Section 10 . 3.4 Diagnostic Data In this DPIA, the term Diagnostic D ata is used in a narrower sense than as used in other DPIAs for SLM Rijk.

In these other DPIAs the term Di agnost ic Data refers to all metadata about individual use of the softwa re or services, including both Telemetry Data and S ervi ce generated server logs. As explained above , in Section 3.2 , the new category of ‘ Security Event Data ’ is introduced to describe the logs ESET generate s and collects about individual actions that trigger security rules. These logs are a mix of Content Data and Diagnostic Data. In this D PIA the term Diagnostic Data refers to : 1. The log - in a ctivities ESET registers from admins and end users (audit logs) . 2. T he data flow about (the installation of) updates of the client software on the end user device . 3. ESET’s own monitoring of the security of clients and infrastructure, including third party datacentre security (Microsoft Azure). Additionally, ESET collects Diagnostic Data about visits to its public and restricted access webpages .

This data collection is separately addressed as Website Data in Section 3.6 below. 3.4.1 Admin audit logs ESET logs both end user and admin login activities, with ac tions like successful and failed logins , account creation and configuration changes. ESET provides documentation about the audit logs. 47 ESET explains: “ The Audit log contains information about: • Time — when the change was performed • Type — what type of setting or feature was changed • Description — what exactly was changed and which part of setting has been changed together with number of changed settings • Source — where is the source of the change • User — who made the change. ” 48 For each log event the timestamp, action, user, IP address and other metadata are logged. These logs are visible for admins through the Protect hub audit logs ( see Section 7.2 in the Technical Appendix) . 3.4.2 M anagement logs Next to the audit logs, admins can also access Management logs (with Account Data, for license management) . 3.4.3 Installation of updates T he results of the DSAR show that ESET records customer software checking for updates and receiving updates if available .

These logs don’t directly relate to employee behaviour because updat e checks are mostly automatic. The check s do indicate when the employee machine is turned on . 3.4.4 ESET ' s own security logs ESET explained to Privacy Company that a subset of security significant logs from ESET on - prem ises and cloud - based infrastructure is processed in its own on - prem ises SIEM system by 24x7 Internal Security SOC team. ESET has no idea or control about the security perimeter defence logs from Microsoft, when a customer uses ESET ’s 47 ESET Endpoint Security, Audit logs, undated, URL: https://help.eset.com/ees/12/en - US/idh_page_logs.html?idh_audit_logs.html , page last visited 24 April 2025. 48 Idem. DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 45 of 132 standard cloud offer, with host ing in Microsoft Azure datacentres ( located in the EU , but with transfers to the USA ) , different from ESET’s new EU exclusive private cloud offer.

During a day long working session with ESET and SLM Rijk in February 2026 ESET allowed Privacy Company to view a relevant and representative sample of ESET's security logs. These logs mainly contain events relating to non - customer facing events. Privacy Company did observe some log events relating to customer admin flagged security events in the tested public cloud set - up . In its standard public cloud offer ESET uses Microsoft Azure for network monitoring and the Microsoft Azure flow logs contain informatio n from customer devices in ESET's Azure instance. However, these events are not relevant for Dutch government customers that use the on - premises software or ESET’s new EU sovereign private cloud solution . 3.5 Support Data O n 24 November 2025 Privacy Company filed a short ‘test’ request via support.eset.com. The site redirected to klantenservice.eset.nl . Customers have the option to ‘resolve’ tickets, but the user interface does not offer options to delete tickets or attachments.

The logo at the bottom of the screen shows ‘Deskpro’, referring to the US company Deskpro , Inc. 49 In reply to this observation, ESET informed SLM Rijk that it has since switched to the US American company Salesforce Inc., but will use an EU native support ticketing provider for customers of the on - premises software and the new EU private cloud offer. 50 Figure 13 : ESET user interface support tickets 49 Deskpro, About Us, URL: https://www.deskpro.com/about . “ Deskpro's Austin office, situated in the vibrant East Austin neighborhood, serves as the company's global headquarters and is home to its sales, marketing, support, and operations teams .” 50 Mail ESET to SLM Rijk 5 June 2026. Mitigating measure ESET • ESET has agreed to i mplement a warning not to upload personal or confidential data or give government organisations a central option to prevent sharing of screenshots and attachments by the end of Q3 2026. • ESET has contractually agreed to only process aggregated data from support tickets for knowledge base purposes, with the aggregation higher than tenant level (e.g. not on a per - customer level.) • ESET will use an EU - native supplier of a support ticketing system for customers of the on - premises software and the new EU private cloud offer. 3.6 Web s ite Data This Section first describes ESET’s W ebsite D ata collection via both the admin console and in Section 3.6.2 the data processing via the publicly available ESET pages . 3.6.1 Restricted access website (Admin Console) On the Admin Console (protecthub.eset.com/dashboard) , ESET only showed cookie information in a footer once, when the admin first logged in , but did not show a cookie consent banner .

In reply to this observation, ESET made some changes and in a small retest on 21 November 2025 Privacy Company saw the same cookie banner on the Admin Console as on its public webpages . See Figure 18 below. In the second layer of this cookie banner , ESET’s new cookie banner offers 3 choices, instead of the previous 4 choices. See Figure 14 below. ESET now asks for consent for A nalyti cal and for M arketing cookies. The two categories of ‘basic’ and ‘advanced’ analytical cookies have been combined in one optional category of cookies. ESET has added a new hyperlink to its Cookie Policy in this pop - up (orange circle added by Privacy Company), to enable users to look up the exact cookie they would consent to. Figure 14 : New second layer cookie choice Privacy Company only observed first party cookies, set from ESET’s own domains. H o wever, P rivacy Company observed 3 Google Analytics cookies (_ga *) and 1 Google advertising cookie (_gcl_au) .

See Figure 15 below. There was no traffic to Google analytics domains. These cookies were set by eset.com, and are inevitable for admins , since they have to log - in via protecthub.eset.com/dashboard. DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 47 of 132 Figure 15 : Observed cookies on the ESET Admin Console ESET explained it used Google Analytics Tag Management server side analytics , and explained it proactively removes the last octet of the IP address when sending the request to the Google Analytics service. “ In all cases where we use server side tracking, GA does not see IP address of the user. GA only sees anonymized IP address. We use our server placed between our website and GA servers. ” 51 This removal of the last octet creates a group of potentially 254 other users whom the IP address can belong to. Though ESET calls this octet removal ‘anonymisation’, identification of a specific user in that group is not technically impossible, if for example a government authority needs to identify a user for law enforcement purposes.

Therefore this process qualifies as pseudonymisation, not as anonymi - sation. ESET also proactively removes user identifiers from the dataflow to Google . ESET provided the following example of such a removal: Original parameter: ?eav=123456 Anonymized: ?eav=[redacted] As documented in the Technical Appendix, during the initial testing ESET refer red to (at least) four versi ons (with different dates and contents) of its Cookie Policy. ESET commented it was working on a dedicated Cookie Policy that should be made available before completion of this DPIA. 52 When Privacy Company retested on 2 1 November 2025, the link in the second layer of the cookie banner to the Cookie Policy lead to a new Cookie Policy, dated 7 August 2025. 53 The documentation about the ‘Essential’ cookies cover ed all observed cookies 54 , but also revealed that ESET qualifie s the observed (first party) Google Analytics cookies as ‘Analytical c ookies’ which should only have be en set if a visitor ha d consented to the a nalytical cookies. 51 ESET reply to the Technical Appendix, 9 April 2025. 52 ESET reply to the second version of the Technical Appendix, 30 May 2025. 53 Eset , Cookie Policy for ESET cloud services, 7 August 2025, https://legal.eset.com/cookie - policy/cloud - consoles/?/lang=en - US . 54 Except for two observed cookies with a 1 hour retention period called ‘BasketID’.

Figure 16 : ESET information about the Google Analytics cookies 55 ESET also explains in its Cookie Policy that the Google _gcl_au cookie is a Marketing cookie. Figure 17 : ESET information about the Google marketing cookie 56 Mitigating measures ESET • ESET has fixed a bug with the Google advertising cookie. • ESET commits to set only functional cookies by default and has stopped setting Google analytics cookies on the admin console. • ESET will implement effective controls to prevent mistakes on an ongoing basis . • ESET has already updated the relevant Cookie Policy, and will fully document cookie retention periods (e.g. webserver access logs, optional marking cookies, etc.) by the end of 2026. 3.6.2 Public webpages During testing, Privacy Company visited the following publicly accessible ESET webpages : • help.eset.com • eu02.protect.eset.com (redirects to log in portal identity.eset.com) • support.eset.com • www.eset.com (to visit policy - hub/privacy/) The data processing by these four sites is relevant for this DPIA because admins and other government employees have to necessarily visit these sites to perform their work duties.

Admins must visit identity.eset.com to login to the Admin Console, look up technical information on the help pages and file a support ticket, while privacy and procurement officers have to look up the relevant legal documentation at https://www.eset.com/us/policy - hub/privacy/. On these public pages, ESET inconsistent ly used two different cookie choice banners when Privacy Company first tested . However, upon receipt of these findings, ESET changed the banner ( as shown in Figure 18 ) to include a button to refuse all but essential cookies in the first layer. 55 Idem, page last visited 24 November 2025. The observed retention period was 13 months and 5 days, not 2 years. 56 Ibid. DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 49 of 132 Figure 18 : ESET uniform cookie banner (since 9 April 2025) During the brief cookie retest on 21 November 2025, Privacy Company observed the uniform cookie banner, and the new second layer with 3 choices under ‘Manage Cookies’ shown in Figure 14 on all 4 websites.

The banner was shown in English, except on the Identity.eset.com page, where the banner was shown in Dutch. Privacy Company selected ‘Accept essential cookies only’ during the tests, and only observed first party cookies, set from ESET’s own domains. All four websites set the same Google Analytics cookies without consent for analytical cookies, and the undocumented ‘BasketID’ cookie, but not the Google marketing cookie observed on the Admin Console. ESET incorrectly assumed these analytical cookies could not be used to identify users, since ESET functions as a proxy for Google when it uses server side analytics, and ESET removes the unique user identifier. However, the observed requests to Google Analytics from eset.com still enable Google to collect the pseudonymised IP address and device information from visitors, with a timestamp and information about the path chosen to and through the ESET pages.

Hence, these cookies did lead to processing of personal data. In reply to this finding, ESET stated it had removed the Google Analytics cookies from the public websites www.eset.com/nl/, help.eset.com and support.eset.com. The brief cookie retest on 21 November 2 025 shows this was not (yet) true. Thanks to ESET’s redesign of the cookie consent manager, users now have two opportunities to access the Cookie Policy with detailed information about the cookies: in the first and in the second layer of the cookie consent pop - up. However, ESET still links to 4 different versions of its Cookie Policy from these 4 relevant websites. Table 4 : ESET relevant public websites and different cookie policies Website Cookie Policy + Date URL Help.eset.com Cookie Policy for ESET Online Help and ESET Knowledgebase , 11 August 2025 https://legal.eset.com/cookie - policy/online - help - knowledgebase/?lang=en - US Help.eset.com/ter ms of use Cookie Policy in Dutch , f ound on ESET help page Terms of Use, 6 September 2022 https://help.eset.com/home_eset/nl - NL/terms_of_use.html?cookie_policy.ht ml Identity.eset.com Cookie Policy for ESET cloud services, 7 August 2025 https://legal.eset.com/cookie - policy/cloud - consoles/?/lang=en - US S upport.eset.com Cookie Policy for ESET Online Help and ESET Knowledgebase, 11 August 2025 https://legal.eset.com/cookie - policy/online - help - knowledgebase/?lang=en - US www.eset.com / nl When the customer indicates the Netherlands on the eset.com homepage : (in Dutch) Cookie beleid , 15 July 2022. https://www.eset.com/nl/policy - hub/cookiebeleid/ In the different cookie policies ESET includes the names of cookies, their expiry period, the domain from which the cookies is set (ESET or third party domain), the name of the provider of the cookie, and a short description of the purpose.

The only information element missing in the Cookie Policies is the retention period of the cookies in ESET’s own systems, such as webserver access logs. The expiry date of a cookie is relative : if a user revisits the website within the expiry period, the expiry date is r eset to the fixed number of days/weeks/months from that visit on. The absence of adequate information will be described in Section 9 of this DPIA, about the applicable rules from the ePrivacy Directive. DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 51 of 132 Mitigating measures ESET • ESET has create d one single consent flow for all traffic generated from the Netherlands in two language versions (English & Dutch) but has not yet removed the different older versions . • ESET will update the single cookie policy and add information about the retention periods by the end of Q3 2026 and will fully document cookie retention periods (e.g. webserver access logs, optional marking cookies, etc.) by the end of 2026 • ESET has committed to keep the cookie information up to date. 3.7 Results Data Subject Access Request Privacy Company filed two data subject access requests on 19 February 2025, for the test user and for the admin .

ESET acknowledged receipt of the Data Subject Access Requests the next day, 20 February 2025 , and referred to existing logs available for admins . Additionally, end users can access Windows endpoint client logs on their own (Windows) device, as described in Section 7.1 of the Technical Appendix . Privacy Company and ESET had subsequent meeting s to clarify the requested access details. Even though ESET makes many personal data relating to the use of the tested services accessible for admins , Privacy Company identified three categories of personal data that were missing from the reply to the Data Subject Access requests. 1. Information recorded in ESET’s webserver access logs about admin activities in the console, and visits to ESET’s public website, with for example IP address, end user, device, activities and the Cookie Data. 2. Personal data collected by ESET in its own SIEM, and data collected by Microsoft Azure in its security logs ( only relevant for ESET’s standard public cloud offering) . 3.

All other p ersonal data ESET collects as ( self - qualified ) data controller. 1. On 9 March 2025, ESET provided access to more personal data in a n Excel sheet with personal data about the combined two accounts 2. An explanatory mail that ESET provided Privacy Company with more personal data than it usually would. 3. The ESET User Guide for Data Access, version 1.0. The Excel sheet contained an extract from ESET’s webserver logs, recording if an update for the Windows client was available, and if that update was installed by the end user. These logs include a username (reference to the SEAT license), username hash, a hardware fingerprint or UID, IP address, and various information about the end user device, such as OS version, hardware version and ESET client version. ESET explained that it did not make these data accessible for the admins because it qualifie d itself as data controller.

Additionally, it would be to hard for ESET to reidentify individual end users in these logs for all customer licenses. 57 Privacy Company disagreed. Even if it would be hard for ESET to identify a specific user in a customer with thousands of seats, these logs are (pseudonymous) personal data because the admin can identify the user. 57 ESET reply to the Technical Appendix, 9 April 2025. In sum , S ections 3 . 2 to 3 . 5 show that all Security Event Data , Account, Diagnostic , Support and Website Data should be treated as personal data. Mitigating measures ESE T • ESET will implement a template for DSAR responses ensuring completeness of response with explanation for information which cannot be shared or can be shared only in limited form by the end of Q3 2026 . • The new agreement between ESET and SLM Rijk includes Security Event, Account, Diagnostic, Support and Website Data as personal data.

ESET is a processor for the Diagnostic Data including the software update logs. 4. Data processing controls ESET does not offer many options for admins to take decisions about the nature of the data processing. 4.1 Access to quarantined data Admins can decide on the retention periods of the (audit) logs and quarantined data . The available information about ESET’s retention periods is described in Section 10 of this DPIA. However, the access to quarantined files merits extra attention as a separate data processing control. Admins should determine an effective retention period for the quarantined mails/files . The retention period should be as short as possible, but long enough to enable two important security purposes: 1. be able to inspect the quarantined files for false positives , and 2. inspect the quarantined files for legitimate treats that the organisation needs to respond to. It may be tempting for organisations to ignore the quarantined files.

However, organisations must also conduct proactive inspections to prevent data loss by wrongly quarantined files, and to quickly respond to any security incidents. 4.2 Pseudonymisation Government organisations can pseudonymise the account data of admins and end users by using federated login. Admins can alternatively use e - mail addresses that do not contain th eir real name , such as admin1@example.com with a similar pseudonymous name to prevent ESET or its sub - processors from being able to identify the admin. 4.3 Use of LiveGrid Feedback ESET by default collects hashes of suspicious files from the end - user client software , but admins can choose not to enable sharing of Content Data in the form of files and crash dumps through LiveGrid Feedback. ESET has explained that it has developed this opt - out choice a few years ago because some admins did not want to share full Content Data.

DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 53 of 132 ESET explains: “ By default, ESET Endpoint Security is configured to submit suspicious files for detailed analysis to the ESET Virus Lab. Files with certain extensions such as .doc or .xls are always excluded. You can also add other extensions if there are particular files that you or your organization want to avoid sending. ” 58 ESET also write s admins can disable submitting crash reports. 59 Figure 19 : ESET opt - out for crash reports and diagnostics data Mitigating measure ESET • ESET will update the button pop - up description for the LiveGrid Feedback function, with detailed explanation of what data are shared with ESET, and update relevant documentation by the end of Q3 2026. 4.4 Disable LiveGrid Reputation LiveGrid R eputation provides cloud - based blacklisting and whitelisting of executables based on their reputation.

A dmins and end - users can disable these cloud - based checks . 60 Disabling these checks can however have a negative security impact. 5. Purposes of the P rocessing Under the GDPR, the principle of ‘purpose limitation’ dictates that personal data may only be collected for specified, explicit and legitimate purposes, and may not be further processed in a manner that is incompatible with the initial purpose. The purpose s are qualified and assessed in part B of this DPIA. This S ection provides a description of both the purposes of the processing of Customer Data and Diagnostic Data by government organisations and by ESET . As described in Section 2.3 about the framework agreement , the Dutch government and ESET have already agreed to use the ARBIT framework, with a separate data processing agreement. This Section further distinguishes between purposes for ESET as a data processor, and ESET as an authorised data controller. 5.1 Purposes government organisations The general interests government organisations may have to use ESET are described in Section 7.2 below. 58 ESET, Endpoint Security, Cloud - based protection, undated, URL: https://help.eset.com/ees/9/en - US/idh_config_charon.html (page last visited 24 November 2025). 59 Idem. 60 ESET [KB7111] Enable or Disable ESET LiveGrid® in ESET Business Products , URL: https://support.eset.com/en/kb7111 - enable - or - disable - eset - livegrid - in - eset - business - products .

Since this report is an umbrella DPIA, it cannot identify all the specific purposes a government organisation may want to serve through the use of the tested ESET services. Each deploying government organisation will have to complete this DPIA with the spe cific purposes for which it will use the services, related to the Content Data organisations wish to process. As an overarching purpose, government organisations have a legal obligation under the GDPR to secure the personal data they process . They may have other specific legal information security obligations , depending on the nature and context of the ir specific data processing. Such specific purposes for government organisations to use the tested ESET services are out of scope of this umbrella DPIA. Government organisations have access to the logs collected by ESET about the interaction of users (employees and admins ) with (potentially) malicious Content Data.

Government organisations also have access to logs about the administration activities of system admins through audit logs . Government organisations may need to use these logs to investigate and mitigate possible misclassifications of innocent mail , to investigate use of (shadow) software as well as visits to sites with malware . Access to these logs is also necessary to comply with data subject right s requests (from employees) , and may be necessary as part of a s upport request to ESET. As data controllers, government organisations must determine when they need to access the Diagnostic Data and determine what retention periods are necessary to comply with security requirements while still complying with the data minimisation principle from t he GDPR , and for what specific purposes specific personal data in the log files may be (further) processed and analysed. Such specific purposes are not in scope of this umbrella DPI A , with the exception of the potential risk that the detailed logs from ESET about user interactions are used as personnel monitoring system. 5.2 Purposes ESET as processor ESET’s standard Data Processing Agreement 61 describes 1 data processing purpose.

As a result of the negotiations, ESET and SLM Rijk have agreed to 4 specific processor purposes , with sub purposes. These are: 1. Provide and maintain well - functioning and up - to - date Deliverables. This consists of: o Provide updates and upgrades; o Transmit notifications on the end user device; o Use Account Data for authorisation of admins; o Facilitate managing and supervising by customers of features and services; o Provide analysis of S ecurity E vent D ata for the customer; o Perform research on Security Event Data with multiple analytical methods to technically improve detection of malicious content. 2. Secure the software and Deliverables (including vulnerability assessment and patch management); 61 ESET Data Processing Agreement, effective 29 September 2023, URL: https://help.eset.com/protect_cloud/en - US/annex2.html . DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 55 of 132 3.

Provide technical support, including use of aggregated Support Data to improve the software and support Deliverables for all customers; 4. Process minimi s ed Personal Data from ESET LiveGrid Feedback and Reputation for statistical purposes and to technically improve the Deliverables. Mitigating measures ESET • ESET agreed in the amended DPA to a limitative list of 4 processor purposes (and 8 authorised further processing purposes, see Section 5.4 below). 5.3 Purposes ESET as independent data controller In its updated (revised in October 2025) general Privacy Policy 62 ESET mentions two lists of purposes for ‘ collecting/ using’ and ‘sharing’ personal information when ESET qualifies itself as independent data controller . 5.3.1 Collect/u s e personal data to: 1. Offer a (public) website 2. Analytics 3. Improve the website 4. Deliver advertisements that are meaningful to you. For more information, see the Cookie Policy 63 5.

Provide Customer Service, including: 6. Respond to request s 7. Learning fr om information to improve quality assurance 8. [Employee] Training purposes 9. Enab le purchases and fulfil orders [also mentioned as part of the sharing purposes] 10. Enable s ign ing up for an ESET Partner Account 11. Enable Partners to subscr ibe to mailing list 12. Interact with people on social media if they follow or friend ESET , and if the y share content on ESET pages/threads. “We use the information we receive through social media to enhance our social media presence, improve our products, and deliver relevant information about promotional opportunities, marketing materials, or other incentives.” 13. Regi ster for live e vent and webinar registration data . 5.3.2 Shar e personal data to: 14. P rovide and operate the Services 15. Provide support, including 64 : o C ommunicate with customers about their use of the Services o P rovide troubleshooting and technical support 62 ESET Privacy Policy, effective date 2 October 2025, URL: https://www.eset.com/us/policy - hub/privacy/ . 63 ESET Cookie Policy, effective date 6 December 2022, URL: https://www.eset.com/us/policy - hub/cookie - policy/ page last visited 19 November 2025 .

Linked from the main ESET Policy Hub, URL: https://www.eset.com/us/policy - hub/ 64 In its Privacy Policy ESET combines the purposes of providing the services and providing support but to enable analysis of the different purposes, Privacy Company has given these two purposes separate numbers. o R espond to customer inquiries o Fulfil orders and requests / same as purpose no. 3 above o P rocess payments / same as purpose no. 3 above 16. Analytics and improvement o U nderstand how customers access and use the Services, and ESET’s other products and offering s o [Process personal data] For research and analytical purposes, such as to evaluate and improve the services and business operation s o Deidentify your personal information and use it for a business purpose. 17. [ Process personal data for r esearch and analytics] To develop services and features 65 18. [ Process personal data for r esearch and analytics] For internal quality control and training purposes 66 19.

Marketing, Advertising, and Campaign Management o Sharing personal data with third party advertising o Sharing personal data with traffic measurement services 20. Transfer of data to another company – “If we or our affiliates are or may be acquired by, merged with, or invested in by another company, (…) we may transfer the information we have collected from you to the other company.” 21. Compliance, Governance, and Legal Requirements , including: o Disclose personal data in response to subpoenas, court order, and other lawful requests by regulators and law enforcement, including responding to national security or law enforcement disclosure requirements. o Disclose the names of sweepstakes and contests winners, in accordance with applicable law 22. Legal self - defence: Disclose information, including personal information, related to litigation and other legal claims or proceedings in which ESET is involved 67 23. [Retain personal data for] I nternal accounting, auditing, compliance, recordkeeping, and legal functions. 68 24.

Security and protection of rights o P rotect the Services and business operations o Prevent and detect fraud , unauthorised activities and access, and other misuse o Protect ESET’s rights, of stakeholders and any third party o Investigate, prevent or take action against i llegal activities and threats to the safety or legal rights of persons or third parties , or violations of the Terms of Use or EULA or this policy . ESET lists this second list of purposes under the word ‘share’, and explains it can share personal data for these purposes with an undisclosed list of processors and third parties: “We may disclose and make available personal information, for the purposes described above, to the following parties: Vendors, Service Providers, and Authorized Reseller Partners. We may disclose personal information we collect to our service providers, processors, agents, and 65 For ESET this purpose is part of the ‘Analytics and improvement’ purpose . 66 Idem. 67 Idem, for ESET this is part of the grouped purpose ‘Compliance, Governance, and Legal Requirements’. 68 Idem.

DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 57 of 132 others who perform functions on our behalf. These vendors or partners may include, for example, analytics providers, marketing firms, consultants, reseller partners, payment processors, auditors, and legal counsel. ” 69 Some of these purposes relate to data that ESET independently obtains from users (employees) for example, when they consent to tracking cookies, sign up for webinars, follow ESET on social media or become a partner and sign up for the newsletter. Some other purposes are not really separate purposes, such as ‘transfer of data to another company in case of a takeover’. The processing for most of the purposes however , is only possible with personal data ESET obtains as a consequence of the use of the contracted services (as processor). This for example applies to all personal data collected and generated while provision ing and opera ting the Services, and during the provision of support.

Since th ese purposes are an essential part of the contracted services, the Dutch government could not accept a role of ESET as independent data controller. This will be elaborated in Sectio n 6.2 . For 7 of the se 24 purposes (plus an additional purposes not mentioned in the Privacy Policy) the Dutch government can authorise ESET to ‘further’ process some personal data obtained as controller , when strictly necessary and proportionate , as outlined in Section 5.4 below . Mitigating measures ESET • ESET agreed to a limitative list of 8 authorised further processing purposes in the amended DPA, acting as authorised controller. See Section 5.4 below. 5.4 Authorised further processing purposes As part of the new F ramework A greement , the Dutch government has authorise d ESET in its role as data processor to further process some personal data as data controller for agreed compatible legitimate business purposes, but only if the processing is strictly necessary and proportionate (including applying pseudonymisation techniques where appropriate).

The French Data Protection Authority CNIL explains that a processor may further process data under its own responsibility, provided that the processing is compatible and the data controller explicitly instructs it to do so. In the informal translation of P rivacy Company: “ A processor may only reuse personal data on its own behalf if this reuse is compatible with the initial processing and if the data controller has given it written consent. ” 70 And further on: 69 Ibid. 70 CNIL explanation about further processing by processors, 11 January 2022, URL: https://www.cnil.fr/fr/sous - traitants - la - reutilisation - de - donnees - confiees - par - un - responsable - de - traitement “ However, the data controller may, under the conditions described below, authorise its processor to reuse the personal data on its own behalf. The processor then becomes responsible for this new processing. ” 71 The compatibility is assessed in detail in Section 11 of this DPIA.

The 8 agreed purposes are: 1. Process Personal Data to comply with legal obligations; 2. Process Commercial Contact Data, Account Data and some Diagnostic Data for billing, fulfilling of orders and payment purposes. 3. Create Website analytics from the (parts of the) public websites with necessary legal and technical information for admins and privacy officers. 4. Process Account and Diagnostic Data for the detection of licensing compliance, fraud detection/prevention, and protection of the ESET’s rights. 5. Use aggregated Diagnostic Data to improve and optimize the performance, and efficiency of the software and the IT infrastructure. 6. Use aggregated (higher than a per - tenant level) Account Data, Diagnostic Data, Support Data and Website Data for internal reporting, financial reporting, revenue planning, capacity planning, forecast modelling and product strategy based on analytics how th e procured services are used. 7.

Process Content Data, Account Data and Diagnostic Data as part of (voluntary) Feedback by admins (only with valid consent). 8. Process Personal Data during for the purpose of company audits and certification of compliance with laws and standards. Two of the identified purpose s may not appear self - evident, and are explained in more detail below , (i) compliance with legal obligations and (ii) further processing of public website data . 5.4.1 Comply with legal obligations ESET may be legally compelled to disclose personal data pursuant to orders from courts, government authorities/agencies and security services. ESET has agreed to include rules i n the Enterprise Agreement to ensure ESET only discloses personal data from Dutch government customers to government authorities if strictly necessary to comply with legitimate and valid orders from courts or government authorities. Mitigating measures ESET • ESET has agreed to a specific process in the amended Enterprise Agreement when ordered to disclose personal data.

In case of an order from an EU authority it cannot forward to customer, ESET will use all available lawful efforts to challenge the order, and promptly notify the customer. If compelled nonetheless, ESET will only provide the minimum necessary data. • ESET will reject demands for disclosure of Customer Personal Data to the extent made under non - EU or non - EU Member State law. • ESET commits to publish statistics about orders/requests it received and if it disclosed any personal data, at least annually. 71 Idem. DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 59 of 132 • ESET shall use commercially reasonable efforts to ensure that its sub - processors provide notification, where legally permissible, of compelled disclosure requests concerning Personal Data. 5.4.2 Create Website Analytics ESET describes in its general Privacy Policy that it uses analytical cookies but also deploys server - side analytics: “ we use a cookie - less web analytics tool to better understand how users interact with our Site and to improve overall performance.

This tool creates a passive, server - side fingerprint using limited technical attributes to approximate user sessions. These identifiers do not directly identify you, and we do not associate them with any personal information you may provide. All data is anonymized, stored internally, and not shared with any third parties. We use this data solely for internal analytics purposes such as: o Measure website traffic and performance; o Understand how users arrive at and navigate through the Site; o Track aggregated events such as pageviews, sessions, form submissions, downloads, and transactions. ” 72 The findings from the brief cookie retest 21 November 2025 confirm ESET’s use of server side analytics (both on the Admin Console and on the relevant publicly accessible websites) , but ESET still sets Google Analytic cookies via this tag management. As analysed in Section 3.6 these cookies enable Google to collect pseudonymous personal data , and according to ESET’s own cookie documentation, these cookies should only be set after a visitor has given consent.

A dmins must sometimes visit ESET’s publicly accessible pages to perform their work tasks, when they for example have to look up technical information, or read terms and conditions . T he Dutch government must ensure that ESET does not process excessive information about their surfing activities. The Dutch government explicitly rejects data processing for profiling and direct marketing purposes . ESET has improved its cookie banner and documentation, but the Dutch government wanted to ensure that ESET continues to apply privacy by default, and will only set third party marketing cookies with valid consent , and apply the same rules to potential processors as agreed with SLM on the sub - processors. Mitigating measures ESET • Fixed the bug with the Google advertising cookie. • ESET agreed to create the public Website analytics as authorised controller, and will apply the same provisions to its processor Google as agreed for sub - processors in the Framework Agreement with the Dutch government. • ESET will publish a n updated public privacy policy by the end of 2026.

ESET’s compliance with ePrivacy rules is discussed in Section 9 of this DPIA. 72 ESET privacy policy, Section Use of Cookie - less Tracking, 2 October 2025, URL: https://www.eset.com/us/policy - hub/privacy/#chapter - 6 . 6. P rocessor or controller This section assesses the data protection roles of ESET and government organisations in the context of the tested ESET Services. 6.1 Definitions The GDPR contains definitions of the different roles of parties involved in the processing of data: (joint) controller, processor and sub - processor. Article 4(7) of the GDPR defines the (joint) controller as: "the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Membe r State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.”

Article 26 of the GDPR stipulates that where two or more data controllers jointly determine the purposes and means of a processing, they are joint controllers. Joint controllers must determine their respective responsibilities for compliance with obligatio ns under the GDPR in a transparent manner, especially towards data subjects, in an arrangement between them. Article 4(8) of the GDPR defines a processor as: “a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.” A sub - processor is a processor engaged by a nother processor that assists in the processing of personal data on behalf of a data controller. Article 28 GDPR sets out various obligations of processors towards the controllers for whom they process data. Article 28(3) GDPR contains specific obligations for the processor. Such obligations include only processing personal data in accordance with doc umented instructions from the data controller and cooperating with audits by a data controller.

Article 28(4) GDPR stipulates that a data processor may use sub - processors to perform specific tasks for the data controller, but only with the prior authorisat ion of the data controller. When data protection roles are assessed, the formal contractual division of roles is not leading nor decisive. The actual role of a party must primarily be determined on the basis of factual circumstances. Below, two of such circumstances are identified: the control the Dutch government can exercise over the use of sub - processors , and the right to verify compliance with the agreed terms via an audit. 6.2 Data processor and sub - processors 6.2.1 Legal role a s data processor ESET and the Dutch government agree d on a new framework agreement based on ARBIT 2022 . ESET is a data processor for all personal data in and about the use of the tested on - premises and cloud security services , as well as for the Website Data relating to the use of restricted access Admin Console .

DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 61 of 132 As described in Section 5.4 above, ESET has agreed to a limitative list of 8 agreed compatible purposes for which ESET may 'further' process some personal data as controller , when necessary for ESET’s legitimate business purposes. Th is will be discussed in Section 6.3 below. Mitigating measures ESET and SLM • As explained in Section 2.3 ESET has agreed in the amended DPA to become a data processor for the use of the personal data it processes relating to both the on - premises and the cloud services, for all 5 identified categories of personal data. This includes ESET Protect, ESET Endpoint Security for Windows, ESET Server Security, ESET Cloud Office Security for e - mail the Admin Console and visits to ESET’s publicly available website. 6.2.2 Sub - processors Determining the recipients (including processors) is considered an “ essential means ” of the processing, on which the controller decides. 73 To allow the Dutch government to take this decision, it must be able to instruct ESET to use specific sub - processors .

In its public terms, ESET only describes 1 general ( sub - ) processor , Microsoft Azure. In its public Data Processing Agreement ESET writes: “ Currently, Microsoft provides cloud storage and infrastructure as part of Azure Cloud Service. ” 74 In its Privacy Policy ESET writes: “ We rely on third - party services related to cloud computing provided by Microsoft as a cloud service provider .” 75 Privacy Company has analysed the intercepted data traffic to determine what traffic was sent to Microsoft Azure. It follows from this analysis that ESET uses Microsoft Azure to host identity.eset.com and protecthub.eset.com. ESET has explained that for its standard public cloud services it relies on Microsoft Azure for many core services, including the use of a CDN . ESET does not use Microsoft Azure in the new EU exclusive private cloud offer. As described in Section 3.6 , ESET also processes personal data with Google Tag Management (hosted on Microsoft Azure) for server side analytics , both on the Admin Console and on the public website .

Additionally, ESET uses AWS to host static content for its public website , cdn1.esetstatic.com. Figure 13 in Section 3.5 about the Support Data shows that ESET used Deskpro as a support ticketing system . ESET explained that it has since switched to use Salesforce for its support tickets in the standard public cloud offer. The role of these four parties (Microsoft Azure, Google Tag Management , AWS and Salesforce ) , with the purposes for which they process specific personal data, as well as the geolocations from which these data can be accessed, are now listed in a separate annex to the new DPA with the Dutch government . 73 EDPB Guidelines 07/2020 on the concepts of controller and processor in the GDPR, Version 1.0, 2 September 2020, par. 40 , URL: https://www.edpb.europa.eu/sites/default/files/consultation/edpb_guidelines_202007_controll erprocessor_en.pdf . Quoted in the EDPB Opinion 22/2024 on certain obligations following from the reliance on processor(s) and sub - processor(s), 7 October 2024, par. 23, URL: https://www.edpb.europa.eu/system/files/2024 - 10/edpb_opinion_202422_relianceonprocessors - sub - processors_en.pdf 74 ESET Terms of Use, Annex 2 Data Processing Agreement, effective 29 September 2023, URL: https://help.eset.com/home_eset/en - US/annex2.html . 75 ESET Privacy Policy, English version for Greek customers, URL: https://www.eset.com/gr - en/policy - hub/privacy/ .

These four parties are all headquartered in the USA , have data centres in third countries , and enable access to some personal data by staff in third countries . To be in control of data transfer risks, the Dutch government must be aware of such transfers, and be able to mitigate possible transfer risks. Sec tion 8 below describes the potential future transfer risks of the use of US American companies for the data processing. To ensure the Dutch government has meaningful control over the processing including possible transfers by these sub - processors, the amended DPA includes an effective objection procedure. If the Dutch government objects to the engagement of a new sub - processor, ESET must commit to engage in a good faith dialogue, attempt to not engage the disputed sub - processor for the Dutch government, and on ly when the sub - processor is really deemed necessary, and to give customers a reasonable time period to terminate the agreement.

Mitigating measures ESET and SLM • The amended DPA contains an overview of all relevant sub - processors . • The amended DPA allows for an effective right to object against new sub - processors. 6.2.3 Right to audit SLM Rijk needs to be able to verify compliance with the agreed data processing terms for the personal data processed in and by the tested ESET services. ESET writes in its general Data Processing Agreement for Enterprise customers that it is ISO 27001:2013 certified, but the verified presence of information security management systems does not allow the Dutch government to verify specific compliance. 76 The amended DPA includes clauses giving SLM Rijk the right to conduct an audit on ESET’s compliance for the tested cloud and on - premises services and software . SLM Rijk can exercise that right once a year on behalf of all Dutch government organisations. This right to audit is an important guarantee for the Dutch governme n t organisations that they can verify the effective data processing, and hence, can factually exercise their role as data controllers.

Absent such a right to audit, ESET and the Dutch government organisations would potentially have to be qualified as joint controllers for unauthorised processing. Mitigating measures ESET and SLM • ESET has agreed to a broad right to audit . • SLM Rijk shall commission audits on compliance with the negotiated terms, for example relating to data retention and purpose limitation. 76 ESET Protect Cloud Data Processing Agreement, Annex 2, URL: https://help.eset.com/protect_cloud/en - US/annex2.html DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 63 of 132 6.3 Further processing by ESET as authorised data controller As described in Section 5.4 , ESET has agreed to include a limitative list of 8 authorised 'further' process ing purposes. It follows from th e CNIL - guidance about further processing (as quoted in Section 5.4 ) that t he data controller (the Dutch government organisations) must determine whether th e further processing is compatible with the purpose for which the data were originally collected, since the processing is not based on the consent of the data subject or on a specific legal obligation.

By including the agreed limitative list of compatible ‘further processing’ purposes by ESET as data controller, the Dutch government ensures its has control over the processing purposes. Absent such a list of compatible further processing purposes, ESET as processor would act as a data controller in violation of the GDPR (per Article 28(10) of the GDPR ) . Because ESET can only collect and process the five identified categories of personal data for its own purposes as a result of a decision by a data controller (Dutch government organisation) to use ESET’s services, and hence, provide personal data to ESET , ESET and the Dutch government organisation would have to be qualified as joint control lers for these processing purposes. Subsidiarily, even if ESET and the Dutch government organisation could not be qualified as joint controllers for all relevant different processing stages, ESET would qualify as a third party, and the government organisations would have to assess their lega l ground for disclosing these 5 categories of personal data to ESET in a role as third party recipient.

The EDPB explains in its guidance about joint controllership: “ 55. The situation of joint participation through converging decisions results more particularly from the case law of the CJEU (...) As such, an important criterion to identify converging decisions in this context is whether the processing would not be possible without both parties’ participation in the sense that the processing by each party is inseparable, i.e. inextricably linked. (...) 64. It may also be the case that one of the entities involved provides the means of the processing and makes it available for personal data processing activities by other entities. The entity who decides to make use of those means so that personal data can be processed for a particular purpose also participates in the determination of the means of the processing. 65. This scenario can notably arise in case of platforms, standardised tools, or other infrastructure allowing the parties to process the same personal data and which have been set up in a certain way by one of the parties to be used by others that can als o decide how to set it up.

The use of an already existing technical system does not exclude joint controllership when users of the system can decide on the processing of personal data to be performed in this context. 67. Furthermore, the choice made by an entity to use for its own purposes a tool or other system developed by another entity, allowing the processing of personal data, will likely amount to a joint decision on the means of that processing by those entities . ” 77 77 EDPB guidelines 07/202 0. Mitigating measures ESET • As mentioned at the bottom of Section 5.2 and at the bottom of Section 6.2.1 , based on the amended DPA with limitative lists of processing purposes for ESET as processor, and as authorised controller, there is no longer a risk of unintentional joint controllership nor does ESET ha ve to be qualified as third party for the relevant data processing. • The list of agreed further processing purposes is included in Section 5.4 .

The new DPA also contains a specific procedure for potential compelled disclosure of personal data to government authorities. 7. Interests in the D ata P rocessing This paragraph outlines the d i fferent interests of ESET and of the Dutch government organisations in general . The interests of the Dutch government organisations may align with the interests of their employees , but this is not always the case. This section does not include an analysis of the fundamental data protection rights and interests of the employee s (user and admins ) as data subjects. How their rights relate to the interests of ESET and the Dutch government organisations is analysed in part B of this DPIA. 7.1 Interest s of ESET ESET competes with many other providers of security services. According to a market insight from Gartner, for the tested Protect services, ESET competes with 8 other vendors, 7 of which are based in the USA .

Sophos is headquartered in the UK. See Figure 20 below. Figure 20 : Gartner insight competition for ESET Protect 78 78 Gartner, Peer Insights, undated, not reviewed in the last 12 months, URL: https://www.gartner.com/reviews/market/endpoint - protection - platforms/vendor/eset/product/eset - protect/alternatives . DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 65 of 132 ESET’s global market share is unknown. ESET publishes the results of an ICD report which describes ESET as “ among just five vendors who shaped the endpoint security market in 2022. ” 79 In a highly competitive market, ESET has a clear financial interest in increasing its market share. Like its competitors, ESET has strong business ethical interests to compl y with international privacy and security standards . Different from its competitors, ESET is a European and independent company.

In view of the shift in perception by European governments of the relationship with the USA and the call for data sovereignty, ESET has a strong commercial interest in staying independent and European. The use of AWS and Microsoft Azure does not seem to align with this interest, even if ESET can choose to store personal data in datacentres in the EU from these US based providers. In reply to this observation, ESET committed to SLM to develop an EU private cloud solution for new customers by the end of Q1 2026 , available both as on - premises and as private cloud solution . ESET wrote: [This will be a] “ solution to support EU - based customers who require end - to - end technology stack based on EU components / suppliers. It includes several key enhancements eliminating the non - EU based technology components. ” 80 The key difference is that the LiveGuard results server will be hosted in ESET’s own data centre in the EU, not on Microsoft Azure anymore. 7.2 Interests of government organisations Dutch government organisations have clear privacy and security compliance inter ests in the use of an endpoint security product or service.

ESET provides both on - premises software and cloud services. Dutch government organisations potentially have economic and financial interests in switching from on premises maintenance of (security) software in local government datacentres to procuring cloud serv ices . Dutch government organisations also have strategic data sovereignty interests in the procurement of services from Dutch or EU native organisations. The option of using on - premises software is highly relevant for organisations that have made the assessment that any use of non - EU cloud services poses too high a risk . However, even the use of ESET’s standard offer for the on - premises software includes communication with Azure Cloud by ESET Protect/Inspect on - prem and ESET Endpoint Security software. As a result of the negotiations with the Dutch government, ESET now offers its software for completely air - gapped use on - premises , a nd as EU - exclusive private cloud offer, in ESET’s own EU data centres.

The Dutch parliament has taken an initiative about digital sovereignty 81 and the Rekenkamer has published a report about public cloud usage. 82 The Dutch government replied to the parliamentary initiative with the commitment to tighten 79 ESET market share report, URL: https://www.eset.com/us/business/idc - marketshare - report/ 80 E - mail ESET to SLM, 1 August 2025. 81 Six Dijkstra and Kathmann, Wolken aan de horizon, URL: https://www.rijksoverheid.nl/documenten/publicaties/2024/06/18/initiatiefnota - wolken - aan - de - horizon 82 Algemene Rekenkamer, Het Rijk in de Cloud, Donkere wolken pakken samen, 15 January 2025, URL: https://www.tweedekamer.nl/downloads/document?id=2025D01084 requirements for the use of public cloud services, with frameworks for digital autonomy. In the translation of Privacy Company: “ This has the consequence that fewer central government digital services may be developed in the public cloud, depending on the interests to be protected.

For such services it should be investigated whether a sovereign government cloud can be set up .” 83 Most recently, Dutch politic ians and media were involve d in a heated public debate about digital sovereignty as a result of the planned takeover of a Dutch company that provides a national digital identification service by a US American company. 84 Government organisations have a strong interest in transparency , to be able to compare different services, forecast costs, to easily create an overview of different technical capacities and to assess the different privacy and security risks, including the risks of unlawful further processing by sub - processors and data transfers to third countries. ESET is very transparent about its data processing for existing customers . admins can for example look up a long list of applied rules . However, ESET is not so transparent for future customers.

ESET has committed to provide more public documentation. As interim solution, this umbrella DPIA can help organisations to obtain the necessary information. Additionally, government organisations need to prevent the possibility of ‘legacy’ and ‘vendor lock - in’. Government organisations need to have the organisational and technical ability to easily transfer their data to other suppliers over time. Many Dutch government organisations use services from Microsoft , including Microsoft Defender . It may make se nse to choose a different provider for endpoint security services , also in view of the risk that Microsoft is likely to attract more threats due to its near mo nopoly for the Microsoft 365 services suite . The Dutch government Audit Office has explicitly warned the Dutch government about this risk. 85 Not only nearly the entire central government uses M365 cloud services, but also many foreign governments and companies worldwide.

This results in a very large collection of confidential data that gives state actors an important motive for developing atta ck capabilities on M365. 86 Finally, it is in the government organisations’ interest that the platform is easy to use, so that employees who have little knowledge of IT can work with it. From a cost saving interest, it is important that ESET Protect offers many good default settings and options, so that government organisation s do not need to develop much of their own functionality. 83 Kamerbrief staatsecretaris en minister van Economische Zaken over de Initiatiefnota ‘Wolken aan de horizon’, 17 January 2025, p. 1 - 2, URL: https://open.overheid.nl/documenten/71103a99 - b696 - 42fd - b34a - c83f979b3201/file . 84 Plenary debate s in the Dutch Lower House 21 January, meeting Digital Affairs commission 27 January 2026, and many parliamentary questions. Stenogram 21 January, dated 11 February , at URL: https://www.tweedekamer.nl/downloads/document?id=2026D17134 .

At the last minute, the relevant State Secretary ( junior minister ) prohibited the takeover. See: (in Dutch) NOS, Staatssecretaris verbiedt Amerikaanse overname Solvinity, bedrijf achter DigiD, 26 May 2026, URL: https://nos.nl/artikel/2615885 - staatssecretaris - verbiedt - amerikaanse - overname - solvinity - bedrijf - achter - digid . 85 Auditdienst Rijk, Onderzoeksrapport Bevindingen onderzoeksopdracht 'Evaluatie public cloudbeleid Rijksoverheid' , 3 juli 2024, URL: https://www.tweedekamer.nl/downloads/document?id=2024D38837 86 Idem, p. 5. DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 67 of 132 7.3 Joint interests The interests of ESET and the Dutch government align when it comes to the security protection of endpoints , either as a cloud service, or as on premises software. According to the Cyber Security Assessment Netherlands 2024 “ state actors are intensifying their cyber activities and broadening their - capabilities.

The pace and complexity of state cyber campaigns is being stepped up. They are also deploying hacker groups to carry out digital attacks. ” 87 As part of the shared security interest, ESET’s double defence approach, with LiveGrid and rule based detection of security risks clearly aligns with the interests of the Dutch government organisations to protect personal data and other Content Data against data breaches . The interests of ESET and the Dutch government also align for the strategical issues of sovereignty and autonomy , especially since ESET has created its new EU - exclusive data processing offer, in the ESET private cloud. Government organisations can accept the low risks of very limited data processing by the two US American hosting providers AWS (for static website content hosted in the EU ) and Google (for server side tag management hosted in the EU ) . With regard to ESET’s standard clou d offer, t he interests of ESET and Dutch government organisations do not align , due to the use Microsoft Azure (for the hosting of essential websites and infrastructure , including communication to Azure for the on - prem services ) .

Even though ESET chooses Microsoft’s EU data centres, this hosting choice can lead to international data transfers when engineers from these compan ies based in third countries have access to these personal data . 8. Transfer of personal data outside of the EU This section first describes the limited data transfers relevant for ESET’s new EU private cloud offer, and the use of the on - premises software in combination with the (cloud) LiveGrid service. Secondly, this section describes the 5 types of data transfer resulting from the use of ESET’s standard public cloud offer. 8.1 Factual transfers EU private cloud offer and on - premises with LiveGrid As analysed in Section 3.6 and summarised above in Section 7.3 , ESET always uses two US American providers for limited data processing (AWS for the hosting of static website content, and Google for server side tag management ) , also in ESET’s new EU private cloud offer.

The contents of the data transfer are limited. As described in Section 3.6 ESET deletes the last octet of the IPv4 addresses and the user ID in the Google T ag M anager, and only collects IP addresses when users visit the static image storage on AWS for its public website. ESET has confirmed that employees of ESET outside of the EU do not have access to any data relating to Dutch government customers (including employees of ESET’s USA office) when they use the on - premises solution or the new EU private cloud solution. 88 87 NCTV, News item, Cybersecurity Assessment Netherlands 2024, URL: https://english.nctv.nl/documents/publications/2024/10/28/cybersecurity - assessment - netherlands - 2024 . 88 Mail ESET to SLM Rijk, 5 June 2026. ESET enables customers to deploy the on - premises services in an air - gapped way, without any links to Microsoft Azure, but this comes at the cost of a loss of functionality.

ESET warned: “The dependency on Azure cloud services in the case of on - prem is only a support function, and the data processed by our on - prem solutions does not leave the on - prem environment of the customer, except for exceptions that the user must approve (e.g. sendin g telemetry, LiveGrid). At the same time, it is possible to operate in a completely offline environment (air gapped), but in this case the customer must endure less comfort, the need to deploy several services (e.g. offline repository, update mirror, activ ate using the so - called offline license files and deploy using their own resources). ” 89 As a result of the negotiations with SLM Rijk, ESET has agreed to provide the highly valuable LiveGrid service from its own EU private cloud servers to Dutch government customers that wish to use the on - premises software. 8.2 Factual data transfers in ESET’s standard public cloud Based on the technical findings, five types of potential data transfers have been identified: 1.

Transfer of enrolment and login information to versions of the mdm.eset.com domain and ESET Protect Web Console hosted in the USA, Japan and Canada. 2. Transfer of identity information to Microsoft engineers that can access data processed on Microsoft Azure hosted in the EU. 3. Transfer of pseudonymised IP - addresses, context and device identifier to Google via server - side Google Tag Management, relating to the Admin Console s and the relevant public websites. 4. Transfer of IP addresses to AWS - engineers in case of visits to the public ESET.com website s . 5. Transfer of support tickets and metadata to Salesforce Inc. with access by global engineers. 8.2.1 Transfer of enrolment , check - in and login information ESET tells new customers that they must enable traffic to different ESET destinations in their firewall ‘ for ESET PROTECT to work correctly’ . This traffic to Canada and Japan is not documented anywhere else. 89 Idem.

DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 69 of 132 Figure 21 : Data transfers to the USA, Japan and Canada for ESET PROTECT These data transfers are now included in the amended DPA for government organisations that decide to use the Public Cloud offer . Figure 22 : [ CONFIDENTIAL ] 8.2.2 Transfers to Microsoft engineers in third countries In its standard public cloud offer ESET heavily relies on Microsoft Azure hosting services to provide its services , not only for the cloud services, but also for the on - premises services. ESET explain ed: “ Even in the case of ESET Protect/Inspect on - prem and ESET Endpoint Security software, there is communication with Azure Cloud. As for updates, they have historically been primarily on our own servers, but in case of heavy load, there is a public CDN for pa ckage hosting, which is also in Azure Cloud. As for the cloud - based infrastructure, we process all data in Azure cloud services, and all data that is stored in databases provided by Azure cloud service. ” 90 In its standard cloud offer ESET does apply encryption ( managed by Microsoft ) to the systems, but it cannot take technical measures that prevent access by Microsoft engineers: “ we need to process the data as part of the service and Microsoft is involved in this processing throughout the services included in the Azure cloud service.

Preventing Microsoft from processing would mean that these functions would cease to function. ” It follows from Microsoft ’s public documentation that the data processing by Azure is part of its EU Data Boundary commitment. Microsoft explains that the scope of the EU Data Boundary includes both Customer Content Data and personal data: “ The EU Data Boundary is a geographically defined boundary within which Microsoft has committed to store and process Customer Data and personal data for our Microsoft enterprise online services, including Azure , Dynamics 365, Power Platform, and Microsoft 365. Professional Services Data will be stored at rest for these services. These commitments are subject to limited circumstances where Customer Data, personal data, and Professional Services Data will continue to be transferred outside the EU Data Boundar y. ” 91 All customer data at rest are stored in the Geo selected by the custome r, in this case ESET .

However, Microsoft’s EU Data Boundary is not absolute, but contains a list of exceptions. Microsoft explains: “ There are scenarios where Microsoft will continue to transfer data out of the EU Data Boundary to meet cloud service operational requirements, where data stored in the EU Data Boundary will be accessed remotely by personnel located outside the EU Data Boun dary, (...). ” 92 Microsoft describes continuing data transfers for all services, and provides a service - specific list of continuing, temporary, incidental and structural exceptions. Two exceptions are relevant: in case of the use of the Azure Content Delivery Network to provide updates to the on - premises services, and access by personnel located outside the EU Data Boundary to data processed by the tested ESET Cloud services . Microsoft explains when personal data “ stored in the EU Data Boundary will be accessed remotely by personnel located outside the EU Data Boundary ”.

This is both the case if ESET files a support request and the Microsoft engineer accesses data relating to a Dutch government organisation, bu t can also happen without a support request, as part of proactive troubleshooting . Microsoft assures that the personal data stay in the EU (including the support tickets). 90 ESET reply to part A of the DPIA, 30 May 2025. 91 Microsoft, What is the EU Data Boundary?, last updated 26 February 2025, URL: https://learn.microsoft.com/en - us/privacy/eudb/eu - data - boundary - learn . 92 Microsoft, Continuing data transfers that apply to all EU Data Boundary Services, 5 November 2025, URL: https://learn.microsoft.com/en - us/privacy/eudb/eu - data - boundary - transfers - for - all - services . DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 71 of 132 “ When Microsoft personnel need to access Customer Data or pseudonymized personal data stored on Microsoft systems inside the EU Data Boundary from outside the boundary (considered a transfer of data under European privacy law although the data remains withi n Microsoft datacenter infrastructure in the EU Data Boundary) we rely on technology that ensures this type of transfer is secure, with controlled access and no persistent storage at the remote access point.

When such a data transfer is required, Microsof t uses state - of - the - art encryption to protect Customer Data and pseudonymized personal data at rest and in transit. ” 93 Microsoft does not offer Azure customers (such as ESET) an option to choose an EU - based helpdesk. Even with a Professional Services Contract, customers cannot ask Microsoft to have the tickets exclusively answered by personnel physically located within the EU. 94 Since July 2024, Microsoft publishes an overview of locations from where Microsoft personnel may remotely access personal data from customers. Microsoft publishes two tables: relating to its own staff ( technically no t a data transfer), and relating to contractors. The list of countries with contract staff includes 30 so called ‘third countries’ without adequacy decision from the European Commission. 95 Microsoft transfers to the USA and to the following 30 third countries: Armenia, Australia, Bolivia, Brazil, China, Costa Rica, Dominican Republic, Ecuador, Egypt, El Salvador, Georgia, Ghana, Guatemala, Honduras, Hong Kong, India, Jamaica, Malaysia, Mexico, Panama, Paraguay, Peru, Philippines, Qatar, Serbia, Singapore, South Africa, Taiwan, Trinidad and Tobago, and Turkey. 96 Microsoft uses two different types of infrastructure for access to personal data from and about customers: 1.

Secure admin Workstations (SAWs) for access to Content Data (which Microsoft calls Customer Data), and 2. Virtual Desktop Infrastruc ture (VDI) for access to pseudonymised Diagnostic Data (about the use of the Azure services). Microsoft writes that personnel can only access Content Data via secure admin workstations (SAWs) that are protected against export of the data. " For example, Microsoft personnel working on SAWs have restricted access to the internet on such devices and are unable to access external or removable media because those capabilities are blocked in the SAW implementation .” 97 Microsoft also explains that all access to Content Data from customers is logged and monitored, and compliance checked in audits. 93 Idem. 94 Microsoft reply to part A of the SLM DPIA on Microsoft 365 Copilot, 17 December 2024 . 95 Microsoft, Locations of Microsoft Online Services Personnel with Remote Access to Data, 11 November 2024, URL: https://learn.microsoft.com/en - gb/microsoft - 365/enterprise/personnel - loc/m365 - personnel - location?view=o365 - worldwide . 96 Idem. 97 Ibid. “ Access to Customer Data is also logged and monitored by Microsoft.

Microsoft performs regular audits to review and confirm that access management measures are working in accordance with policy requirements, including Microsoft's contractual commitments. ” 98 Microsoft finally states that the probability is very low that Microsoft personnel outside of the EU can access Content Data: " In rare cases when a service is within the EU Data Boundary, including Customer Data. There's no default access to Customer Data; access is provided to Microsoft personnel only when a task requires it. ” 99 To better understand the probability of remote access from third countries Microsoft explained that there are three relevant fractions. First of all, problems are generally resolved by service automation. Secondly, if an engineer has to manually intervene, the odds are very small that specific Content Data (in this case including the ESET security event data relating to a specific Dutch government organisation) are part of the data accessed by that engineer.

Given the total number of service users of Microsoft 365 services, this probability is low for eve n the largest and most active customer tenancies .” 100 The second type of data transfer via Microsoft relates to the use by Microsoft, and separately by ESET as well, of the global Content Delivery Network for all content hosted on Azure. Microsoft writes: " Azure Front Door and Content Delivery Network are non - regional services that can be used to bring customers' static and dynamic content closer to their end users all over the world. To help accelerate global requests, Azure Front Door and Azure CDN cache data at global edge locations on behalf of the customer. Both services u se a networking technique called anycast to direct traffic between customer end users and point of presence (PoP) locations using the fastest possible route. Due to the nature of this routing mechanism and in order to serve our customers' requirements to p ush data around the world, not all traffic will 98 Microsoft, How Microsoft protects Customer Data, 5 November 2025, URL: https://learn.microsoft.com/en - us/privacy/eudb/eu - data - boundary - transfers - for - all - services#how - microsoft - protects - customer - data . 99 Idem. 100 Microsoft reply quoted in the SLM DPIA on Microsoft 365 Copilot.

DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 73 of 132 stay within the EU Data Boundary . Cached content duration can be changed based on a customer's configuration within the AFD or CDN profile settings." 101 8.2.3 Transfer of personal data to Google ESET hosts the Google Tag Manager on a Microsoft Azure cloud server in a data centre in the North Europe region. 102 ESET still sets (first party) Google Analytics cookies on both the Admin Console and the 4 relevant public websites . ESET no longer set s a Google marketing cookie on the Admin Console. Though ESET strips the last octet from the IP address, and removes the unique User ID, these cookies lead to the transfer to Google of pseudonymised IP - addresses , device identifiers and the visited URLs with context. 8.2.4 Transfers to AWS engineers in third countries Thirdly, IP addresses from Dutch government employees (likely admins ) are transferred to AWS if they visit the general (public) ESET.com website, and static content is collected from cdn1.esetstatic.com, hosted by AWS .

This means AWS collects the IP address of the visitor, in a non - sensitive context. AWS offers regional zoning in its CloudFront CDN service . 103 ESET has not explained if it uses this option. 8.2.5 Transfer of Support Data to Salesforce As quoted in Section 3.5 , ESET has replaced the use of the US company Deskpro for support tickets by the US company Salesforce. However, this transfer is only relevant for ESET’s standard public cloud offer, not if Dutch government organisations use the on - premises software or the EU public cloud offer. ESET has committed to only use an EU - native provider for the support ticketing system. Mitigating measures ESET: • If a Dutch government customer chooses the on - premises software, and enables LiveGrid, ESET will provide that cloud service from its own EU private cloud solution (not Azure). • ESET has confirmed that ESET USA does not have any access to data processed by Dutch customers in the new EU private cloud offer or on - premises with the use of LiveGrid. • ESET will use an EU - native sub - processor for the support tickets in the new EU private cloud offer. 8.3 GDPR rules for transfers of personal data The GDPR contains specific rules for the transfer of personal data to countries outside the European Economic Area (EEA).

In principle, personal data may only be systematically transferred to countries outside the EEA if the European Commission has taken a so - called adequacy decision or if the exporting organisation can provide approp riate safeguards . Art. 46 of the GDPR offers multiple ways to provide such safegua r ds. 101 Microsoft, Services excluded from the EU Data Boundary, 14 April 2025, URL: https://learn.microsoft.com/en - us/privacy/eudb/eu - data - boundary - excluded - services 102 ESET reply to the second version of the Technical Appendix, 30 May 2025. 103 https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/origin - shield.html#choose - origin - shield - region Based on the (third) adequacy decision from the European Commission for the USA, the USA do not have to be treated as a third country, for participants to the EU US Data Privacy Framework. Microsoft, Google and AWS ha ve self - certified as participant to the EU US Data Privacy Framework (DPF). 104 ESET has an office in the USA, ESET LLC, bu t this company is not an active participant to the EU US DPF.

Figure 23 : ESET LLC inactive participant EU US DPF However, i n view of measures taken and announced by the president of the United States , the Dutch government has to seriously consider the probability that the EU US Data Privacy Framework will be annulled. The consequences and political follow - up of (a possible annulment of) the adequacy decision for the USA are discussed in Section 8.3.2 below. Alternatively, ESET can use EU Standard Contractual Clauses (SCC s ) for data transfers . Section 8.3.3 below addresses ESET’s use of the SCC s for its standard public cloud offer (not relevant for the new EU - exclusive private cloud offer) . 8.3.1 Adequacy decisions An adequacy decision means that the country or category of organisations has a level of protection comparable to that applied within the EEA. On 10 July 2023, the European Commission issued an adequacy decision for participants in the USA to the EU US Data Privacy Framework.

Currently, there are adequacy decisions with respect to Andorra, Argentina, Canada (commercial organisations), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, Switzerland, the United Kingdom under the GDPR and t he LED, the United States (commercial organisations participating in the EU - US Data Privacy Framework) and Uruguay. With the exception of the United Kingdom, these adequacy decisions do not cover data exchanges in the law enforcement sector . These are gove rned by the Law Enforcement Directive (Article 36 of Directive (EU) 2016/680). 105 If countries (or sectors) are deemed to have an adequate level of data protection, European organisations are allowed to transfer personal data to organisations in these countries without having to take any additional protective measures. 8.3.2 Possible end of Adequacy D ecision for the USA The adequacy decision for the USA is based on an Executive Order from the previous president of the United States (EOP) .

On 7 October 2022, Biden signed EOP 14086 with new binding safeguards for the data collection by US intelligence agencies, and 104 Data Privacy Framework list of active participants, search ‘ Microsoft Corp ’ , Amazon, and ‘ Google LLC’ . URL: https://www.dataprivacyframework.gov/list . 105 European Commission, Adequacy decisions, URL: https://commission.europa.eu/law/law - topic/data - protection/international - dimension - data - protection/adequacy - decisions_en (p age last visited 2 7 January 2025) . DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 75 of 132 introducing a new redress procedure. 106 Following this EOP, the European Commission prepared a new adequacy decision for the USA 107 that entered into force 10 July 2023. Two key issues that were solved by the commitments in this EOP were (i) the lack of privacy restrictions to mass surveillance, and (ii) lack of independent redress in case of complaints of EU citizens about the data processing.

If those two commitments are undermined, the conclusions from the European Court of Justice in Schrems - II revive, that the restrictions on privacy arising from the U.S. regulations are insufficiently defined and disproportionate and therefore constitute too great an invasion of privacy. On 3 September 2025 the European Court of Justice (part of the Court of Justice of the European Union) confirmed the validity of this decision based on the circumstances in the USA when the framework agreement was signed. The French member of parliament Ph ilippe Latombe had asked the court (in 2023 already) to annul the decision. 108 Latombe has announced an appeal. 109 8.3.3 Standard Contractual Clauses Personal data may be transferred from the EEA to third countries outside of the EEA using Standard Contractual Clauses (SCC s , also known as EU model clauses) . These clauses (hereinafter: SCC s ) contractually ensure a high level of protection.

Privacy Company does not know if ESET uses SCC for data transfers relating to Dutch government customers for the tested services , and if so, what the scope is of the covered data processing. ESET’s model Data Processing Agreement for Protect Cloud does include SCC, but does not specify in Annex III of the SCC to which sub - processors these SCC apply. 110 Although the European Court of Justice in Schrems - II recognizes the validity of the decision of the European Commission with which it adopted the SCC, and data transfers on the basis of the SCC are therefore still permitted in principle, this validity cannot be assumed for systematic transfers of personal data to the United States if they are no longer deemed to offer adequate data protection for personal data from EU customers . The ECJ explains that transfers via the SCC require an assessment by the exporter if the recipient country provides an adequate level of data protection as defined in EU law.

Article 46(1) of the General Data Protection Regulation (GDPR) explains that this means that data subjects must have adequate safeguards, enforceable rights and 106 US Department of State, Executive Order 14086 – Policy and Procedures, 3 July 2023, URL: https://www.state.gov/executive - order - 14086 - policy - and - procedures/ 107 Press release European Commission, Commercial sector: launch of the adoption procedure for a draft adequacy decision on the EU - U.S. Data Privacy Framework, 12 December 2022, https://commission.europa.eu/law/law - topic/data - protection/international - dimension - data - protection/eu - us - data - transfers_en . 108 ECJ Case T - 553/23, Latombe v Commission, URL: https://curia.europa.eu/juris/document/document.jsf?docid=279601&doclang=EN 109 Euractiv, EXCLUSIVE: Latombe to appeal EU - US data transfer court challenge, 29 October 2025, URL: https://www.euractiv.com/news/exclusive - latombe - to - appeal - eu - us - data - transfer - court - challenge/ (paywall).

There is a good analysis from Iain Nash at Lawfaremedia, 3 November 2025, URL: https://www.lawfaremedia.org/article/the - european - commission - s - rejection - of - latombe . 110 ESET Data Processing Agreement for Protect Cloud, effective 29 September 2023, URL: https://help.eset.com/protect_cloud/en - US/annex2.html . ESET refers back its DPA in Annex III of the SCC: “ The controller has authorised the use of the following sub - processors: As defined in Data Processing Agreement. ” effective legal remedies at their disposal. Whether this is the case, according to the Court, must be determined by the data controllers and cloud providers themselves. The Court writes: “The assessment required for that purpose in the context of such a transfer must, in particular, take into consideration both the contractual clauses agreed between the controller or processor established in the European Union and the recipient of the tran sfer established in the third country concerned and, as regards any access by the public authorities of that third country to the personal data transferred, the relevant aspects of the legal system of that third country.

As regards the latter, the factors to be taken into consideration in the context of Article 46 of that regulation correspond to those set out, in a non - exhaustive manner, in Article 45(2) of that regulation.” 111 Such an assessment is currently not necessary for ESET’s data transfers mentioned in Section 8.2.1 to the USA, Japan and Canada, but may become necessary for the other transfers via Microsoft, Google, AWS and Salesforce to the USA and the onward transfers to third countries based on the EU US DPF. The USA grants broad surveillance powers in FISA 702 to security services. W ith National Security Letters , the USA legal regime enables law enforcement authorities and secret services to compel electronic communications services providers or remote computing service providers (such as cloud providers) that operate in the US to disclose personal data stored outside of the US. This includes disclosure of data from European customers stored in EU data centres.

The US CLOUD Act ( Clarifying Lawful Overseas Use of Data ) was specifically designed to obtain access to data stored in data centres in the EU. This act extends the jurisdiction of North American courts to all data under the control of companies operating in the USA, even if those data are stored in data centres outside the territory of the United States. However , requests under the US CLOUD Act are part of the framework for reg ular enforcement, and can be contested in court , different from orders from secur ity services. As explained by the EDPB and the European Data Protection Supervisor (EDPS) in their opinion on the CLOUD Act to the LIBE Committee of the European Parliament, transfers of personal data from the EU must comply with the Articles 6 (lawfulness of processing ) and 49 (derogations for specific situations) of the GDPR. In case of an order based on the US CLOUD Act, the disclosure and transfer can only be valid if recognised by an international agreement between the EU and the USA.

The EDPB and EDPS write: " Unless a US CLOUD Act warrant is recognised or made enforceable on the basis of an international agreement, and therefore can be recognised as a legal obligation, as per Article 6(1)(c) GDPR, the lawfulness of such processing cannot be ascertained, without prejudice to exceptional circumstances where processing 111 ECJ, Schrems - II, par. 104. DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 77 of 132 is necessary in order to protect the vital interests of the data subject on the basis of Article 6(1)(d) read in conjunction with Article 49(1)(f). " 112 In their cover letter, the data protection authorities emphasise “ the urgent need for a new generation of MLATs to be implemented, allowing for a much faster and secure processing of requests in practice. In order to provide a much better level of data protection, such updated MLATs should contain relevant and strong dat a protection safeguards such as, for example, guarantees based on the principles of proportionality and data minimisation. ” 113 Additionally, the data protection authorities refer to the ongoing negotiations since 2019 about an international agreement between the EU and the US on cross - border access to electronic evidence for judicial cooperation in criminal matters and negotiating directives. 114 Negotiations with the USA are still ongoing. 115 Only the UK has so far signed a specific agreement with the USA for the CLOUD Act.

Negotiations between the EU and the US about updated MLATs did not produce any results yet. 8.3.4 Data Transfer Impact Assessment As long as the adequacy decision for the USA has not become invalid , Dutch government organisations can rely on transfers by ESET to the four identified sub - processors with headquarters in the USA (AWS CloudFront CDN, Google server side Tag Management , Microsoft Azur e and CDN , Salesforce for the support tickets ) , and onward transfers by these sub - processors without having to take extra data protection measures . Based on the explanations provided by ESET in reply to this DPIA about its standard public cloud offer , and the third party suppliers included in the list of sub - processors in the amended DPA, Dutch government organisations may have to perform a Data Transfer Impact Assessment (DTIA) if they consider using ESET’s standard public cloud services.

To perform a DTIA they need to know in what circumstances ESET and its (sub - )processors can transfer personal data to third countries (including access by engineers from sub - processors in third countries). If all personal data were exclusively processed and stored in the EU, performance of a DTIA would not be necessary to assess the probability of a disclosure order from a foreign government authority that exercised cross - boundary jurisdiction. The EDPS has explained in its decision about Cisco Webex that the mere risk of an order for compelled disclosure for data stored in the EU cannot be qualified as a data transfer: 112 Annex EDPB and EDPS joint response to US CLOUD Act, 10 July 2019, p. 8. URL: https://edpb.europa.eu/sites/default/files/files/file2/edpb_edps_joint_response_us_cloudact_a nnex.pdf . 113 EDPB - EDPS Joint Response to the LIBE Committee on the impact of the US Cloud Act on the European legal framework for personal data protection, URL: https://edpb.europa.eu/sites/default/files/files/file1/edpb_edps_joint_response_us_cloudact_c overletter.pdf . 114 Council Decision authorising the opening of negotiations, 6 June 2019, URL: https://data.consilium.europa.eu/doc/document/ST - 10128 - 2019 - INIT/en/pdf and https://data.consilium.europa.eu/doc/document/ST - 10128 - 2019 - ADD - 1/en/pdf . 115 European Commission , E - evidence - cross - border access to electronic evidence, URL: https://commission.europa.eu/law/cross - border - cases/judicial - cooperation/types - judicial - cooperation/e - evidence - cross - border - access - electronic - evidence_en “ However, in the EDPS opinion, the mere risk that remote access by third country entities to data processed in the EEA may take place, does not constitute a transfer subjected to Chapter V of the Regulation .

The EDPS considers that transfers resulting from unauthorised access by third country entities, which are merely potential and in no way foreseeable in light of the content or purpose of a contract or another stable relationship between the parties, do not fall under the scope of Chapter V of the Regulation. The unlikely and unplanned character of such risks of such unauthorised access renders them unsuitable to be ex ante subjected to regime of Chapter V of the Regulation. It follows that for such potentia l and unplanned transfers a transfer tool under that Chapter is not required. [ underlining added by Privacy Company] ” 116 To perform a specific DTIA, the EDPB recommends taking six steps. 117 These steps are not repeated here, but some highlights are mentioned that are relevant to assess the risks for organisations that want to use the tested ESET endpoint security services. The risk assessment must include: • The relevant laws • The purposes for which the data are processed • The categories of transferred data and their sensitiveness • Whether the data will be stored in the third country or whether there is remote access to data stored within the EU/EEA • Role of the parties (public/private, processor/controller) • All actors, including sub - processors • The format of the data • Possibility of onward transfers 118 Though contested by the Dutch DPA in a decision about the use of Google Analytics , 119 the EDPB Recommendations on measures to supplement transfer tools do allow for a risk - based approach in a DTIA.

The EDPB writes: "You may decide to proceed with the transfer without being required to implement supplementary measures, if you consider that you have no reason to believe that relevant and problematic legislation will be applied, in practice, to your transferred data and/or importer". 120 This means data controller s can take into account the amount of received and/or honoured requests and orders. The EDPB recommends reading the transparency 116 EDPS Decision on the Court of Justice of the EU’s request to authorise the contractual clauses between the Court of Justice of the EU and Cisco Systems Inc. for transfers of personal data in the Court’s use of Cisco Webex and related services 13 July 2023 (Case 2023 - 0367), par 34 and 35, URL: https://www.edps.europa.eu/system/files/2023 - 07/2023 - 07 - 13 - edps - cjeu - cisco - decision_en.pdf . 117 EDPB, Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data, Version 2.0, Adopted on 18 June 2021, URL: https://edpb.europa.eu/system/files/2021 - 06/edpb_recommendations_202001vo.2.0_supplementarymeasurestransferstools_en.pdf 118 Idem, p. 15. 119 Decision Autoriteit Persoonsgegevens published by GDPRhub.eu to ‘reprimand’ Takeaway Group B.V, 20 August 2024, URL: https://gdprhub.eu/images/e/eb/2024.08.20_ - _Courtesy_translation_ - _redacted.pdf , 120 EDPB, Recommendations 01/2020, Version 2.0, par. 43.3.

DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 79 of 132 reports from the importing organisation. However, " Documented practical experience of the importer with relevant prior instances of requests " alone cannot be relied on. 121 More importantly, as analysed in Section 8.2.5 , government organisations have no idea or control about the scope and geolocation of data transfers if ESET qualifies itself as independent data controller. As described in Section 5.4.1 ESET has committed to start publishing annual transparency statistics. Mitigating m easures ESET • ESET has provided , and has agreed to continuously maintain, a list of each processor outside the EU, what data can be processed or remotely accessed by their engineers. • ESET will publish annual transparency statistics about the numbers of received orders and disclosures of data . • ESET and SLM have agreed on a procedure to minimise the likelihood of unlawful disclosure of p ersonal d ata to public authorities. • ESET ’s new EU private cloud offer ensures EU - exclusive process ing of Account, Security Event, Diagnostic, Support and Website Data . 9.

Additional legal obligations: e - Privacy Directive This S ection only describes the additional obligations arising from the current ePrivacy Directive. This Section does not discuss the ePrivacy Regulation, proposed by the European Commission in 2017 122 and formally withdrawn in 2025. This means ESET will have to comply with the current ePrivacy rules. In view of the limited scope of this DPIA, other legal obligations or frameworks (for example in the area of information security, such as BIO) are not included in this report. The act of reading or placing information (through cookies or similar technology), or enabling third parties to read information from the devices of end users triggers the applicability of Article 5(3) of the ePrivacy Directive, regardless of who places or reads the information, and regardless of whether the content is personal data or not. Consent is required prior to the retrieval or storage of information on the devices or browsers of end users, unless one of the exceptions applies, such as the necessity to deliver a requested service, or necessity for the technical transmission of information.

Based on article 3(1) of the GDPR, because the data processing takes place in the context of the activities of data controllers (Dutch government organisations), the GDPR applies to all phases of the processing of these data. Article 5(3) of the ePrivacy Directive was transposed in article 11.7a of the Dutch Telecommunications Act. Certain rules from the ePrivacy Directive apply to the storage of information on, and retrieval of that stored information from, browsers with pixels and cookies and similar technologies such as tracking pixels and unique identifiers sent through URL 121 Idem, para 47. 122 European Commission, Proposal for a Regulation on Privacy and Electronic Communications, 10.1.2017 COM( 2017) 10 final, URL: https://ec.europa.eu/digital - single - market/en/proposal - eprivacy - regulation parameters. These rules also apply to software installed on devices that sends information via the Internet through an inbuilt telemetry client.

Article 5(3) of the ePrivacy Directive was transposed in Article 11.7a of the Dutch Telecommunications Act. Con sent is required prior to the retrieval or storage of information on the devices or browsers of end users, unless one of the exceptions applies, such as the necessity to deliver a requested service, or necessity for the technical transmission of informatio n. The consequences of the cookie provision are far - reaching, since it requires companies to provide clear and complete information *prior* to the data processing, and it requires companies to obtain valid consent from the user, unless one of the legal exceptions applies. The consent is identical to the consent defined in the GDPR. The legal consent requirement is not limited to the tracking cookies. ESET must also ask for consent for the collection of Telemetry Data , for example from the tested Windows client , if the data are not strictly necessary for the technical functioning of the service.

As described in Section 3.1 ESET does not collect Telemetry Data from the Windows client . The observed data flow (that looks like telemetry events) is part of the core LiveGrid functionality of the service. As described in Section 3.6.1 and in more detail in the Technical Appendix ESET uses server side Google Tag Management to collect analytical data . ESET clips the last octet from the IP addresses of admins , and removes the User ID . ESET has improved its cookie consent management by applying the same banner to all relevant sites, by removing the distinction between basic and advanced analytical cookies, and by adding a link to its Cookie Policy in the second layer of the banner. However, ESET still sets Google Analytics cookies when admins visit protecthub.eset.com, and the public websites www.eset.com/nl/, help.eset.com and support.eset.com. ESET still provides links to 4 different Cookie Policies.

In the Netherlands, website owners do not have to ask for consent from visitors when they process information for ‘innocent’ analytical purposes, literally: “to obtain information on the quality or effectiveness of a delivered information society service, provided that it has no or little impact on the privacy of the subscriber or user concerned.” Th ough ESET does not have to ask for consent for such ‘innocent’ analytical cookies, ESET must inform users adequately about this data processing. ESET puts users on the wrong foot by telling them analytical cookies are only set with consent, not part of the ‘Essential cookies’. When they think they can safely ‘accept’ the Essential Cookies, they unknowingly also accept these analytical cookies . Additionally, ESET (still) provides different versions of its Cookie Policy on the different visited websites . Though ESET does provide long lists and descriptions of the cookies its sets in the two policies from 2025, ESET omits to describe the retention period of the cookies in ESET’s own systems, such as webserver access logs.

The expiry date of a cookie is relative: if a user revisits the website within the expiry period, the expiry date is reset to the fixed number of days/weeks/months from that visit on. Mitigating M easures ESET DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 81 of 132 • ESET will publish an up to date cookie policy, including the relevant retention period in the webserver access logs by the end of 2026 , and will keep the documentation up to date . • ESET will only use Google’s EU data centres for the processing of the server side analytics. 10. Retention Period s 10.1 Retention periods determined by government organisations Even though ESET can process Content Data (such as subject lines or attachments of e - mails, visited URLs, attempts to download executables and documents with their pathnames) , the admins of government organisations determine the retention periods for all files they process, including the operating system (OS), all executables, and the entire hard drive, plus cloud storage services like SharePoint or Google Drive .

For the Security Event Data (data generated by ESET about suspicious content and actions by admins and/or software to prevent threats), both ESET and the admins determine the retention periods. As shown in Table 5 below , ESET makes 4 types of logs available to admins for a default period . As shown in Figure 24 below admins can decide to retain these logs for shorter or longer periods . However, it is unclear if this only restricts the dataset available for admins, or if this also limits the retention period of logs used by ESET for its own processing purposes. Table 5 : Default retention periods Diagnostic Data logs for admins Type of log Retention Detection logs (Security Event Data) 3 months Management logs (Account Data/license management) 1 month Audit logs (Diagnostic Data) 6 months Monitoring logs (Security Event Data) 1 month Figure 24 : ESET default retention periods ESET Protect hub (Cloud Admin Console ) 10.2 Retention periods ESET as processor and as authorised controller In its public Privacy Policy, as independent data controller, ESET provides 4 generic criteria how it determines the retention periods of personal data , as informally translated by Privacy Company: “a) For as long as necessary to maintain our ongoing business relationship, or as necessary to provide you with the products, services or information to which you are entitled or which you will otherwise receive from us; b) For as long as necessary for the purpose for which we collected it or for which you provided it to us in accordance with a relevant activity or processing of a product or service; c) Any retention period necessary to comply with our legal obligations, to resolve disputes, to enforce our agreements; or d) The end of the period during which legal proceedings or investigations may take place in relation to our business relationships or other interactions with you.” 123 These descriptions of criteria (for example: unspecified laws that require mandatory retention for an unspecified period) do not allow Dutch government organisations to determine the specific retention periods for the personal data they enable ESET to proc ess, also as potentially compatible ‘further’ processing.

During the writing of this DPIA, ESET has provided detailed information about the retention periods and their necessity, both in a role as processor and in a role as authorised controller. ESET has also expanded the publicly available information about the retention periods. 124 123 Dutch version of ESET Privacy Policy, undated, URL: https://www.eset.com/nl/privacy/ , page last visited 8 June 2026 . 124 Idem. DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 83 of 132 Below Table 6 three detailed explanations are provided, of the distinction in retention periods for operational logs and security logs, the o bligation to retain ESET’s own internal security logs for 3 years based on Slovak cybersecurity law and the retention period of 6 months for the public website webserver access logs. Table 6 : ESET retention periods 125 Category of data Retention Role of ESET Admin and end user Account Data Account data (log - in credentials and logs) are managed in ESET Protect and deleted after the duration of the subscription , or if a customer deletes an end user account, after a brief technical period, e.g. 30 days for logs.

Processor Billing information (Commercial Contact Data) Commercial Contact Data are stored in business support systems (CRM, licencing, billing and ERP) with a retention period of 4 years as per applicable Slovak commercial law, with automatic deletion after expiry of the retention period. Customers can ask for earlier deletion/a custom retention period. Authorised controller Subscription - related data together with legal correspondence (Commercial Contact Data + unknown contents of correspondence and possibly usage data). 3 years after the termination of the subscription, for the establishment, exercise, or defence of legal claims. Authorised controller Technical Support Data (possibly including support metadata) 4 years after case resolution to ensure service continuity and accountability, but customers will be able to delete the support tickets and attachments earlier, for example after 13 - 15 months, via a new DIY functionality in the Service Hub, at the end of Q3 2026.

Processor LiveGrid Reputation and (optional) Feedback Data As long as ESET exists Processor ESET Inspect raw events 7 days (for low level events, see Technical Appendix). Older records are removed permanently. Processor 125 ESET, Privacy Policy for Business, 26 November 2025, URL: https://legal.eset.com/privacy - policy/business/ . Telemetry and Statistical Data 126 Up to 4 years in aggregated form for the improvement and maintenance of Products and Services. Authorised controller Marketing Communication Data Until the data subject unsubscribes or until subscription - related data are anonymised (12 months after termination). Authorised controller Update server logs Up to 4 years , anonymised after 3 years , for long - term statistical analysis of update delivery and product usage trends. Authorised controller Download and repository server logs Up to 2 years , to support billing verification, refund handling, and customer claim resolution.

Authorised controller Other operational logs [ CONFIDENTIAL ] Processor ESET’s internal security logs that can contain IP addresses from admins if their behaviour was flagged as risky . [ CONFIDENTIAL ] Processor ESET retains these internal security logs in an encrypted archive for 3 years to comply with Slovak cybersecurity laws . NB These logs do not include data collected from customers ’ ESET Protect instances) . Authorised controller Website Data (webserver access logs) Admin Console access logs: 90 days . Processor Public website: 6 months . Authorised controller 10.2.1 Operational versus security logs ESET distinguishes between two different purposes for the logging : for operational purposes , [ CONFIDENTIAL ] , and for security purposes (which ESET also calls audit logs) . The logs available for ESET’s own internal security purposes are [ CONFIDENTIAL ] plus stored for 3 years in an encrypted archive to comply with Slovak cybercrime and cybersecurity legislation.

ESET explained that all components generate both security logs and operational logs. For example, ESET Protect Hub generates (application) audit logs that contain information about logins, license operation and requests to use ESET cloud services. Th ese application audit log s are considered to be security log s . But the ESET Protect Hu b application also runs on a web server and the webserver access logs are considered as operational logs only. 127 ESET wrote: “Logs for services such as ESET Protect Hub, Identity service, ESET Protect web console which contain public IP addresses and/or user/customer identification 126 Privacy Company did not observe any Telemetry Data defined as data collected from the end user device in a separate data stream from the cloud generated server logs. ESET appears to use the term Telemetry Data in a very broad way, as the core of ESET’s se curity services to collect information from the end user device about potentially malicious files. 127 ESET reply to questions Privacy Company, 29 April 2026.

DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 85 of 132 are treated as security logs for the purpose of identifying and eradicating security incidents and fraudulent activities and they are stored by the SOC team with a retention period of up to 3 years in accordance with Slovak law (…). ” 128 [ CONFIDENTIAL ] . 129 ESET added that it carefully limits access to the logs. “ [ CONFIDENTIAL ] ” 130 Table 7 : ESET information about operational and security logs Specific log Explanation ESET Windows endpoint client logs (including the endpoint scanning SharePoint server) Operational log Protect hub audit logs (including on - premises ) Security log – [ CONFIDENTIAL ] and stored in archive for 3 years. ESET Protect dashboards and other logs available for admins If ESET collects these data (not from on - premises ): O perational log. The ESET PROTECT management console logs stay in the customer cloud console unless customer s configure export of th e logs to their Syslog server .

The underlying infrastructure is monitored by ESET’s operational and security teams, but these logs do not contain personal data other than the IP address of communicating devices. ESET Protect & Inspect logs available for admins Operational log. The Protect / Inspect customer logs stay in the customer cloud console. 131 Cloud Office security ESET’s COS application logs stay in the customer cloud console. The underlying infrastructure is monitored by ESET’s operational and security teams, but these logs do not contain personal data other than the IP address of communicating devices. 10.2.2 Applicable Slovak cybercrime and cybersecurity law Per request of SLM Rijk, ESET provided a detailed explanation of the applicable Slovak law that requires ESET to retain its own internal security logs for 3 years. ESET is qualified as essential entity under the EU NIS2 directive , for multiple activities: NIS2 Annex I: Digital infrastructure: • Cloud computing services 128 ESET input on action list with open issues, 20 February 2026. 129 Mail ESET to SL M Rijk , 30 April 2026. 130 Idem. 131 If a government organisation also procures the separate ESET MDR services, EST can process a subset of these logs for the MDR service.

This data processing is out of scope of this DPIA. NIS2 Annex I: ICT service management (business - to - business): • Managed service providers • Managed security service providers NIS2 Annex II: Digital providers: • Providers of online marketplaces N or the NIS2 directive 132 nor the implementation regulation contain specific retention periods. The NIS2 Directive explicitly states (in Article 5) that the directive constitutes minimum harmonisation: Member States may adopt stricter measures to ensure a higher level of cybersecurity. The European legislator intentionally leaves it to member states to determine retention periods. The Slovak legislator has implemented NIS2 in the 69/2018 cybersecurity law 133 and sub regulation 227/2025. 134 Though the cybersecurity law itself does not define a 3 years retention period, i t mandates the Slovak National Security Authority to issue a binding regulation about “ the content of security measures, the content and structure of security documentation, and the scope of general security measures (Section 20).

“ Based on this mandate, the Slovak National Security Authority has issued sub regulation 227/2025. This includes an obligation for ESET to apply a retention period that is proportionate to the risk s defined in Annex 1 of the national Slovak implementation regulation and the risks identified in the sectoral regulation of the EU NIS2 implementation regulation. Annex 1 of the national implementation prescribes a retention period of minimum 12 months : “relevant operational and security logs are created and stored for at least 12 months, recording activities, exceptions, failures, and other relevant operational and security events, while preventing changes to their integrity and unauthorized access to th em .” 135 Additionally, the Slovak penal code requires organisations to secure evidence for cybersecurity incidents ‘to be used in criminal proceedings’. The penal code also defines limitations to the period in which ‘hacking’ as criminal offense can be prosecuted: 3 years for ‘other’ misdemeanours . 136 Therefore ESET is required to retain evidence of hacking incidents for potential prosecution for a period of 3 years.

This implementation does not differ a lot from the draft Dutch implementation of NIS2 in BIO - 2 . BIO - 2 defines the mandatory retention period for logs that all public sector organisations must adhere to. BIO - 2 requires all public sector organisations to retain all logs for 6 months, and to retain logs for 3 years in the case of (suspected) information security incidents. BIO2 prescribes in Article 5.28.01 : 132 EU, NIS2 Directive 2022/20555, URL: https://eur - lex.europa.eu/legal - content/EN/TXT/?uri=CELEX%3A02022L2555 - 20221227 and NIS2 Implementing Regulation 2024/2690, URL: https://eur - lex.europa.eu/eli/reg_impl/2024/2690/oj/eng . 133 Zákon 69/2018 o kybernetickej bezpečnosti, effective 1 January 2025, URL: https://www.zakonypreludi.sk/zz/2018 - 69 . 134 Vyhláška 227/2025 o bezpečnostných opatreniach, URL: https://www.zakonypreludi.sk/zz/2025 - 227 . 135 Slovak subregulation 227/2025, Section 116. 136 Penal code, §87, 1 sub e. DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 87 of 132 “ The retention period for a (suspected) information security incident and all information required to analyse and resolve the incident is at least three years.

This includes, among other things, the information required for the analysis, including logging, the resolution and the advice. ” 137 10.2.3 Retention period webserver access logs Commonly, digital service providers only retain their webserver access logs for a period of 7 to 90 days. ESET retains the restricted access Admin Console access logs for 90 days, but the public website logs for 6 months. ESET explained this retention period is [necessary for security purposes, summary by Privacy Company] “ [ CONFIDENTIAL ] . ” This explanation for the longer retention period is plausible in view of ESET’s special role in cybersecuring access to websites and hence the need to validate the effectiveness of its detection and mitigation measures. Mitigating measures ESET • ESET will publish a list of specific retention periods for the Account, Security, Event, Diagnostic, Support and Website Data in a publication that is separate from the main privacy policy by the end of 2026 . • Since 20 February 2026 ESET technically distinguish es between the retention of Account Data of admins and end users, and the retention of Commercial Contact Data. • ESET shall publish descriptions of data categories and retention periods in detail, and clarify how long ESET retains the data available for admins as Detection, Management, Audit and Monitoring logs (for which admins can determine retention policies.) • ESET and SLM have agreed on the following defin ition of the term ‘ Aggregate ’ : personal data that are combined and/or summarised to an aggregation level higher than per tenant, unless aggregation at tenant level is strictly necessary and proportionate for an agreed authorised further processing purpose .

Aggregated Data shall not be used in a manner that permits the identification of a natural person . 137 Draft text of BIO - 2, URL: https://minbzk.github.io/Baseline - Informatiebeveiliging - Overheid/maatregelen/?h=log Part B. Lawfulness of the data processing The second part of the DPIA assesses the lawfulness of the data processing. This part contains a discussion of the legal grounds, an assessment of the necessity and proportionality of the processing, and of the compatibility of the processing in relation to the purposes. 11. Legal Grounds To be permissible under the GDPR, processing of personal data must be based on one of the grounds mentioned in Article (6) (1) GDPR. Essentially, for processing to be lawful, this article demands that the data controller bases the processing on the consent of the user, or on a legally defined necessity to process the personal data. The assessment of available legal grounds (sometimes called ‘lawful bases’) is tied closely to the principle of purpose limitation.

The EDPB notes that “ The identification of the appropriate lawful basis is tied to principles of fairness and purpose limitation . [.] When controllers set out to identify the appropriate legal basis in line with the fairness principle, this will be difficult to achieve if they have not first clearly identified the purposes of processing, or if processing personal data goes beyond what is necessary for the specified purposes. ” 138 Thus, in order to determine whether a legal ground is available for a specific processing operation, it is necessary to determine for what purpose(s), the data was or is collected and will be (further) processed. There must be a legal ground for each of these purposes. As described in Section 2.2 , ESET processes 5 relevant categories of personal data: 1. Security Event Data (the data generated by ESET about suspicious content and actions by admins and/or software to prevent threats). 2.

Diagnostic Data ( audit logs , web server access logs, and ESET’s own security and infrastructure logs) 3. Account Data (in three types: end users, admins and commercial contact persons) 4. Support Data 5. Website Data (in two types: the restricted access webpages, i.e. the Admin Console s, and the publicly available ESET help and legal pages.) Based on the new Framework Agreement (including the amended DPA) with the Dutch government, ESET will process these 5 categories of personal data as a processor, and is authorised to further process some of these data, generally aggregated, as controller. The new agreement also includes 2 limitative lists of specific processor purposes and specific authorised further processing purposes. 138 EDPB, Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects - version adopted after public consultation, 16 October 2019, URL: https://edpb.europa.eu/our - work - tools/our - documents/guidelines/guidelines - 22019 - processing - personal - data - under - article - 61b_en .

DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 89 of 132 Sections 11.1 and 11.2 below discuss the appropriate legal ground for Dutch government organisations, with a role of ESET as processor and a role as authorised controller respectively. The four relevant legal grounds with ESET in a role as processor are, in short: consent, contract with the data subject, legal obligation, public interest and legitimate interest. The legal grounds of vital interest and legal obligation are not discussed, since nor ESET nor the Dutch government organisations have a vit al (lifesaving) interest in the processing of personal data via ESET's cloud services. Additionally, there is no (specific) legal obligation for the Dutch government to specifically use ESET to secure the data processing . The relevant legal ground with ESET as authorised controller is a compatibility assessment under Article 6(4) of the GDPR. 11.1 Legal grounds for government organisations – ESET processor 11.1.1 Consent Article 6 (1) (a) GDPR reads: “ the data subject has given consent to the processing of his or her personal data for one or more specific purposes ” Government organisations generally should not ask for consent from inhabitants if personal data are processed for public tasks, or as part of a task primarily exercised under private law.

The fact that government organisations are public sector organisatio ns makes it difficult to rely on consent for processing. In the context of Recital 43 of the GDPR, the EDPB explains: “ whenever the controller is a public authority, there is often a clear imbalance of power in the relationship between the controller and the data subject. It is also clear in most cases that the data subject will have no realistic alternatives to accepting the processing (terms) of this controller. The EDPB considers that there are other lawful bases that are, in principle, more appropriate to the activity of public authorities. ” 139 Consent generally is not available as legal ground for government organisations in relation to data processing of their employees, in view of the power imbalance. The only exception is the use of cookies. For the consent to be valid, the default settings m ust be privacy protective, and the website must effectively enable visitors to give free, specific and informed consent.

ESET applies privacy by default on the restricted access Website for which it acts as processor in the amended DPA with the Dutch government and does not apply any misleading (dark pattern) design in the cookie consent manager. ESET has also improved the public cookie information. In view of that context, ESET can obtain valid consent from admins that wish to accept analytics or marketing cookies. ESET is a n authorised controller for (the analytics of) its publicly accessible Website Data and for the Feedback Data . Government organisations have to assess the compatibility of the further processing of these data with the original processor purposes for which they enable ESET to collect/generate personal data. This assessment can be found in Section 11.2 below. 139 EDPB, Guidelines on consent , paragraph 3.1.1. 11.1.2 Necessary for the performance of a contract Article 6 (1) (b) GDPR reads: “ processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. ” As described in Section 7.2 , Dutch government organisations have various potential interests in using the ESET - services, such as privacy and security compliance interests, and data sovereignty interests.

If government organisations want to successfully invoke the legal ground of ‘performance of a contract’ with respect to the employees and admins , the processing of the personal data via the tested ESET - services has to be strictly necessary for the performance of the contract with each individual data subject (employees, including employees with admin roles). As described in Section 5.2 , it follows from the new Framework Agreement with the Dutch government that ESET will process the five categories of personal data as processor (except for the publicly accessible Website Data), for 4 specific and legitimate purposes. The following five agreed sub - purposes from the first agreed purpose ( provide and maintain well - functioning and up - to - date Deliverables ) are clearly necessary for the performance of the (labour) contract with each admin and each end user: o Provide updates and upgrades o Transmit notifications on the end user device o Use Account Data for authorisation of admins o Facilitate managing and supervising by customers of features and services o Provide analysis of security event data for the customer Admins and end users cannot refuse processing of their personal ( Account , Security Event and restricted access Website) data for these purposes, as the processing is strictly necessary for ESET to provide the services contracted by the organisation as employer.

In sum , based on the framework agreement with ESET, Dutch government organisations can legitimately rely on the necessity of the processing of the Account Data for these four sub - purposes. 11.1.3 Necessary for a task in the public or a legitimate interest Article 6 (1) (e) GDPR reads: “ processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller ”. Article 6 (1) (f) GDPR reads: “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child . Public sector organisations are excluded from relying on legitimate interest when processing personal data for public services.

The last sentence of Article 6 (1) of the DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 91 of 132 GDPR explains: “Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.” This excludes the application of the legitimate interest ground for processing carried out by public sector organisations in the performance of their tasks. However, the choice to use ESET - services to secure the Content Data will usually be secondary to the performance of public tasks by government organisations and can therefore be considered as a task primarily exercised under private law, for which the legitimate interest of the organisation can be a valid legal ground for processing. The legal ground of necessity for a legitimate interest as defined in Article 6(1) f of the GDPR can for example be used in relation to the processing of personal data via necessary functional and analytical cookies.

This follows from the specific Dutch legislative history. As described in Section 9 there is a specific exception in the Dutch Telecommunications Act on the consent - requirement for ‘innocent’ analytical cookies, that is for cookies with no, or relatively small impact on the private life of website visitors. 140 To determine this impact, the Dutch legislator has explicitly referred to the elements of the legitimate interest test in Article 6(1) f of the GDPR (at the time, the similar test in Article 8(f) of the Data Protection Directive). Both legal grounds (public interest and legitimate interest) require an assessment of the necessity of the personal data processing, of the proportionality and availability of alternative, less infringing means to achieve the same legitimate purposes (subsidiarity). Processing for t hree of the four agreed processor purposes and for the last sub - purpose of the first agreed processor purpose is clearly necessary for ESET to provide an up - to - date, well - functioning and effective security service to its Dutch government customers.

To achieve the main purpose of the data processing , to effectively protect the data of customers against security incidents, ESET must necessarily analyse incidents and its own success rate in detecting and mitigating incidents across all of its c ustomers. This cross - domain analysis is an essential element of the processor task , and therefore included in the agreed processor purposes: 2. Secure the software and Deliverables (including vulnerability assessment and patch management); 3. Provide technical support, including use of aggregated Support Data to improve the software and support Deliverables for all customers; 4. Process minim is ed Personal Data from ESET LiveGrid Reputation (and optionally, from LiveGrid Feedback) for statistical purposes and to technically improve the Deliverables. + sub - purpose o Perform research on Security Event Data with multiple analytical methods to technically improve detection of malicious content.

In sum , government organisations can rely on the necessity for the public interest or legitimate interest for three of the four agreed processor purposes . 140 Kamerstukken II 2013/14, 33902 (Wijziging van de Telecommunicatiewet (wijziging artikel 11.7a)), nr. 3 (Memorie van Toelichting). 11.2 Compatibility of further processing as authori s ed controller Article 6(4) reads: “ Where the processing for a purpose other than that for which the personal data have been collected is not based on the data subject's consent or on a Union or Member State law which constitutes a necessary and proportionate measure in a democratic society to safeguard the objectives referred to in Article 23(1), the controller shall, in order to ascertain whether processing for another purpose is compatible with the purpose for which the personal data are initially collected, take into account, inter alia: (a) any link between the purposes for which the personal data have been collected and the purposes of the intended further processing; (b) the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller; (c) the nature of the personal data, in particular whether special categories of personal data are processed, pursuant to Article 9, or whether personal data related to criminal convictions and offences are processed, pursuant to Article 10; (d) the possible consequences of the intended further processing for data subjects; (e) the existence of appropriate safeguards, which may include encryption or pseudonymisation. ” Article 28 (10) GDPR reads: “ Without prejudice to Articles 82, 83 and 84, if a processor infringes this Regulation by determining the purposes and means of processing, the processor shall be considered to be a controller in respect of that processing. ” To prevent an infringement by ESET transgressing its role as processor by taking decisions about the purposes and means of the processing , ESET and SLM have agreed on a limitative list of 8 further processing purposes, with ESET as authorised controller.

SLM Rijk has assessed the compatibility of the further processing for these 8 purposes by taking the 5 criteria into account mentioned in Article 6(4) of the GDPR. Table 8 : 8 a uthorised further processing purpose s and category of personal data No. Agreed Purpose Category of personal data 1 C omply with legal obligations All p ersonal data 2 B illing, fulfilling of orders and payment purposes. Commercial Contact Data, Account Data and some Diagnostic Data 3 Create Website analytics from the (parts of the) public websites with necessary legal and technical information for admins and privacy officers. Website Data DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 93 of 132 4 D etection of licensing compliance, fraud detection/prevention, and protection of the ESET’s rights. Account and Diagnostic Data 5 I mprove and optimize the performance, and efficiency of the software and the IT infrastructure.

6 I nternal reporting, financial reporting, revenue planning, capacity planning, forecast modelling and product strategy based on analytics how the procured services are used. Aggregated (higher than a per - tenant level) Account, Diagnostic, Support and Website Data 7 Feedback by admins . Content, Account and Diagnostic Data (only with valid consent.) 8 Company audits and certification of compliance with laws and standards. All personal data Below, the compatibility of the 8 applicable ‘further processing’ purposes is discussed in three groups: 1. compliance with legal obligations and company audits 2. internal business operations 3. optional LiveGrid Feedback Data 11.2.1 Compliance with legal obligations and company audits This first grouped purpose includes two sub purposes: No. Authorised further processing purpose 1 Comply with legal obligations 8 Company audits and certification of compliance with laws and standards Under a ( link ), the Dutch government has a clear interest in audits that prove ESET’s compliance with applicable laws and standards, and has also negotiated an extensive audit right itself.

On the other hand , ESET’s legal obligations (under Slovak law) are unrelated to the purposes for which government organisations instruct ESET to process the 5 categories of personal data . However, ESET’s legal obligations would not be very different if ESET were a Dutch company. A s quoted in Table 6 with the retention periods, ESET needs to retain Commercial Contact Data and billing information for 4 years, based on Slovak commercial law . ESET als o needs to retain its own internal security logs for 3 years under Slovak cybersecurity l aw. T his mandatory data retention originates from an EU legal requirement (NIS2) . The Dutch government proposes a similar mandatory retention period of 3 years for logs that likely contain security incidents in the draft BIO - 2 text. Finally, ESET has agreed in the Framework Agreement with the Dutch government to reject requests for disclosures from non - EU authorities, and to carefully resist and minimise possible disclosures to EU authorities.

Under b ( relationship ), employees of Dutch government organisation s do not have a choice if their employer decides to use ESET’s cloud endpoint security services . Under c ( nature ), ESET may be compelled to provide available personal data about an individual admin or government organisation to an EU government authority . Requested data may include sensitive and special categories of personal data if these are part of Security Event Data , though ESET aggregates and minimises the data it stores . Under d ( consequences ), compelled disclosure of personal data by ESET to a public authority in the EU could have a high impact on employees of government organisation s . Under e ( safeguards ), the Dutch government has agreed with ESET on risk minimisation steps when responding to a valid order from an EU authority to ensure ESET only discloses personal data when it is legally inevitable .

As an EU - native company, ESET is not subjected to non - EU laws, and has committed to reject all requests from non - EU authorities. Additionally, ESET has agreed to publish annual transparency statistics about the number of requests it has received, and the number of times it has disclosed any personal data. In sum , the further processing of personal data by ESET for the purpose of compliance with legal obligations incumbent upon it as a Slovak company, is inevitable and in view of the safeguards, compatible with the purposes for which ESET receives and generates personal data as a processor. 11.2.2 Internal business operations This second group purpose includes five purpose s related to ESET’s internal business operations. No. Authorised further processing purpose 2 Billing, fulfilling of orders and payment purposes. 3 Create Website analytics from the (parts of the) public websites with necessary legal and technical information for admins and privacy officers. 4 Detection of licensing compliance, fraud detection/prevention, and protection of the ESET’s rights. 5 Improve and optimize the performance, and efficiency of the software and the IT infrastructure. 6 Internal reporting, financial reporting, revenue planning, capacity planning, forecast modelling and product strategy based on analytics how the procured services are used.

Under a ( link ), it is inevitable that every cloud service provider has to process some personal data for its own legitimate business purposes. Even though ESET has agreed to become a processor for all categories of personal data, the company still needs to further process some personal data for its own legitimate business purposes, to send DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 95 of 132 invoices based on the use of the contracted services , to verify customers pay for the right amount of licenses, and to use some aggregated personal data for technical software improvements, and for internal bookkeeping and forecasting. The use of aggregated and minimise data and website analytics for ESET’s legitimate business purposes to technically improve its services is directly related to the government's interests in maintaining a future - proof financially healthy supplier.

T he Dutch government understands, and has explicitly authorise d ESET’s use of specific personal data (obtained by ESET in a role as data processor) for these ‘further processing’ purposes . Under b ( relationship ), ESET has a direct contractual relationship with the contact persons of customers that are responsible for procurement and vendor relationship management. These employees have a reasonable expectation that the vendor will keep them informed about commercial offe rs and store the contents of communication for many years, to comply with commercial law . ESET does not have a direct contractual relationship with the admins or end users , only the government organisation has . Admins and emplo yees with legal tasks such as privacy officers may have to visit four publicly accessible web pages that contain information (legal and technical) to perform their work duties. These web pages are : • help.eset.com • eu02.protect.eset.com • support.eset.com • www.eset.com Under c ( nature ), ESET collects contact and invoicing address data from its Commercial Contacts (procurement officers) , plus the contents of communication, certainly in case of a conflict or billing dispute .

ESET collects limited Account Data from admins and end users , only the ir e - mail address es . However, the Account Data of system administrators are sensitive, as described in Section 2.4.2 . If their identity leaks to malicious actors, they may be selected for spear phishing, as their credentials give access to potentially large datasets with government data. For the two purposes of technical improvement and internal bookkeeping ESET may only process aggregated and minimised data , and aggregated to a higher level than per - tenant for the internal bookkeeping purposes. Under d ( consequences ), the further processing of the Account, Diagnostic, Support and Website Data can include the engagement of third parties (or ESET processors) . This is the case with the use of Google tag management for website analytics and hosting of static website content on AWS. If government organisations use ESET’s standard public cloud offer, ESET can also engage US American providers for payment purpos es and to process support tickets.

This sub processing may result in data transfers out of the EU, and hence, the potential for these non - EU government authorities to access some personal data relating to Dutch government customers. Additionally, further processing of Diagnostic Data could result in loss of control and loss of confidentiality of potentially sensitive personal data of government organisation employees if ESET were to create reports about security incidents, or login - habits of admins and publish such statistics relating to a specific ministry. Under e ( safeguards ), ESET and SLM have agreed on a number of safeguards . • ESET may only process personal data for these purposes when strictly necessary and proportionate. • The Framework contract includes a definition of aggregation that explains that ESET aggregate s for a category of activities or events, never for a (group of) identifiable users. The rule that ESET can only process aggregated minimised data prevents unnecessary internal access, and the rule about aggregation to a higher than per - tenant level pre - emptively prevents ESET from creating analytics about admin work hours in a specific tenant, or publish per - customer incident statistics (not suggesting that ESET ever had this intention) . • ESET will maintain privacy by default settings for cookies on its public website, and has unified the dataflow for Dutch customers to redirect visitors to eset.com/nl. • ESET will publish up to date Cookie documentation by the end of 2026. • If Dutch government customers choose the on - premises software or the new EU private cloud offer, ESET will only engage AWS and Google for limited processing of IP addresses when admins visit ESET’s public web pages. • ESET has already configured Google to remove the last octet of the IP address, and remove the unique user ID.

These measures ensure that the impact of the processing is very limited. • Since February 2026 ESET clearly distinguishes between Commercial Contact Data on the one hand, and admin and end user accounts on the other hand . • ESET has shortened the retention period for the admin and end user Account Data from 12 months after termination of the subscription to immediate deletion after termination of the subscription or deletion of the en d user account. • Similarly, ESET will provide a DIY option for admins to remove support tickets and attachments instead of retaining all tickets for 4 years. In sum , in view of the agreed safeguards ESET’s further processing of Account, Diagnostic , Support and Website Data for these 5 purposes is compatible with the original purposes for which government organisations enable ESET to collect or generate these data. 11.2.3 Optional Feedback Data As mentioned in Section 11.1.1 admins can voluntarily submit Feedback suggestions to ESET (purpose no. 7) .

This means the processing is based on their consent. ESET does not allow sharing of attachments. Under a ( link ), the processing of Content, Account and Diagnostic Data that may be part of Feedback is not in the direct interest of Dutch government organisation s, but all customers can indirectly benefit from improvements by ESET based on F eedback. Under b ( relationship ), admins do not have a contractual relationship with ESET for the processing of these Feedback Data. Under c ( nature ) government organisations cannot technically exclude that admins provide sensitive or confidential data to ESET as part of Feedback data. Under d ( consequences ), as authorised controller, ESET only further process es these Feedback Data for technical improvement purposes. DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 97 of 132 Under e ( safeguards ), the four most important safeguards are: • Providing of Feedback is optional.

ESET does not actively request Feedback, only passively, hence, no nudging to provide Feedback. • ESET does not allow sharing of attachments. This limits the amount of personal data admins can share, and prevents against unintentional over sharing of data relating to other data subjects. • ESET ensures EU exclusive data processing when a customer chooses the new EU private cloud offer . • As authorised controller ESET complies with the data processing conditions and limitations in the Framework Agreement. In sum , in view of the safeguards ESET’ s further processing of Feedback Data is compatible with the purposes for which ESET receives data as a processor. 12. Special categories of personal data As explained in S ection 3.1 of this DPIA ( Content Data ), ESET processes all files on every computer, including the operating system (OS), all executables, and the entire hard drive, plus storage services like SharePoint on - premises .

With the tested services, ESET also scans all e - mail s, including subject lines or names or contents of attachments to e - mails , visited URLs . Special categories of data are: “ data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, data concerning a natural person's sex life or sexual orientation or data relating to criminal convictions and offences. ” (Art. 9(1) GDPR). Additionally, based on Article 10 GDPR, the processing of personal data relating to criminal convictions and offences or related security measures is similarly restricted. Potential disclosure or unauthorised access to special categories of data can have a very high negative impact on data subjects. Government organisations must take all the circumstances of the use of a cloud service for special categories of data into acco unt to assess the probability of this risk.

Mails, files and documents processed by Dutch government organisations can contain al l kinds of Article 9 and 10 GDPR personal data. The subject lines of e - mails can equally contain special categories of data, for example if an employee sends an out of office e - mail with the subject line: ‘ absent due to flu ’. Additionally, b ased on jurisprudence of the ECJ about the processing of web surfing behaviour by Meta , it is possible to infer special categories of data from URLs. 141 The 141 ECJ, C - 252/21, Meta Platforms Inc. and Ors v Bundeskartellamt, 4 July 2023 , ECLI:EU:C:2023:537, par. 72 and 73: “(…) the processing of data relating to visits to the websites or apps in question may, in certain cases, reveal such information without it being necessary for those users to enter information into them when they register or place online orders. ” ECJ emphasises that this web surfing behaviour qualifies as processing of special categories of data “ independent of whether or not the information revealed by the processing operation in question is correct and of whether the controller is acting with the aim of obtaining information that falls within one of the special categories referred to in that provision. [underlining added by Privacy Company]. ” 142 Based on the amended DPA ESET may only process these data for the authorised necessary processing purposes , and will only retain these data for a short period of time.

The retention periods for detections and raw Security Event data (which may con tain Content Data) are short (7 to 3 1 days) . However, ESET also processes personal data in its internal security logs. These logs contain high level detected security events related to use of ESET ’s infrastructure ,, such as visited URLs and downloaded executables . These logs can include admin IP addresses if the actions from the admin on ESET’s infrastructure are flagged as risky. [ CONFIDENTIAL ]. ESET retains these security logs in an encrypted archive for 3 years to comply with Slovak cybersecurity laws. Additionally ESET retains these security logs in an encrypted archive for 3 years to comply with Slovak cybersecurity laws. Additionally, s upport tickets can also include special categories of data, and ESET retains those data for a default period of 4 years after solution of the reported issue , if the customer does not ask for earlier deletion (or uses the future DIY tool to delete tickets and attachments , starting in Q4 2026).

If customers use ESET standard public cloud offer, ESET’s use of Microsoft Azure for many core functionalities currently does not qualify as a data transfer to a third country as the USA are deemed to have an adequate level of data protection. Additionally, ESET has chosen to store and process the Content D ata in Microsoft’s data centres in the EU. This reduces the probability of the risk of ESET being compelled to provide access to these data to US , and other non - EU government authorities. Similarly, ESET’ s use of the US American company Salesforce as support ticketing system in its standard public cloud offer does not qualify as a data transfer to a third country. However, the personal data are not processed under exclusive EU jurisdiction, and can be accessed by Microsoft engineers in 30 third countries and possibly by Salesforce engineers in third countries. Since ESET applies encryption with key management by Microsoft and by Salesforce , it cannot be excluded that those engineers can access human readable information abou t flagged mails, documents and files.

The data protection risks for data subjects are not limited to the processing of special categories of data. Similar risks may apply to other categories of personal data of a sensitive nature, confidential, classified or secret data. The EDPS explains in its guidelines on the use of cloud computing services by European institutions that special categories of data should be interpreted broadly when interpreting the risks for data subjects. 142 Idem, par. 69. DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 99 of 132 The EDPS writes: “ Nevertheless, this is not the only factor determining the level of risk. Personal data that do not fall under the mentioned categories might lead to high levels of risk for the rights and freedoms of natural persons under certain circumstances, in particular when the processing operation includes the scoring or evaluation of individuals with an impact on their life such as in a work or financial context, automated decision making with legal effect, or systematic monitoring, e.g. through CCTV.

“ 143 The EDPS also refers to the criteria provided by the Article 29 Working Party when a Data Protection Impact Assessment (DPIA) is required. 144 Government organisations must therefore also consider the risk that sensitive, confidential or secret data could end up in Support Data . Similarly, some a dmin Account Data and Diagnostic Data may be confidential, if it is strictly confidential what employees work for a specific government organisation. Based on the new Framework Agreement with the Dutch government, ESET is a processor for all personal data, including the Support D ata, and may only further process specific personal data for the authorised 8 legitimate business purposes when strictly necessary and proportionate. A mitigating measure government organisations can take themselves to lower the probability of unauthorised access to sensitive admin data is to pseudonymise the admin A ccount D ata with federated login .

They can also opt out from sharing content data and crash dumps with ESET when they share LiveGrid Feedback D ata ( Section 4.3 ) or decide to opt - out from sharing data with ESET for LiveGrid Reputation. 13. Purpose limitation The GDPR obliges data controllers to comply with the principle of purpose limitation. The principle of purpose limitation is that data may only be “ collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statis tical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes ” (Article 5 (1) (b) GDPR). Essentially, the above means that the controller must have a specified purpose for which he collects personal data and can only process these data for purposes compatible with that original purpose, unless the controller can meet additional requirements be fore any further processing can take place. 143 EDPS, Guidelines on the use of cloud computing services by the European institutions and bodies, 10 March 2018, URL: https://edps.europa.eu/sites/edp/files/publication/18 - 03 - 16_cloud_computing_guidelines_en.pdf . 144 The EDPB has adopted the Article 29 Working Party guidelines WP 248 rev.01, Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is “likely to result in a high risk” for the purposes of Regulation 2016/679 .

Data controllers must be able to prove based on Article 5(2) of the GDPR that they comply with this purpose limitation principle (accountability). Data controllers cannot comply if they engage a cloud provider as data processor, but ignore that provider al so reserves the contractual right to process personal data for its own purposes, in its own commercial business interest. As described in Section 5.3 ESET’s public privacy policy contains 24 data processing purposes (not all of which are actually data processing purposes). The processing for 22 purposes is only possible with personal data ESET obtains as a consequence of the decision of a government organisation to use the contracted services (and engage ESET as a processor). This applies to all personal data collected and g enerated while provisioning and operating the Services, and during the provision of support. ESET reserves the right to change its Privacy Policy unilaterally, meaning it can add or change purposes.

ESET writes (in the translation of Privacy Company from t he Dutch privacy policy): “We may amend this Policy at any time without notice. Any such amended terms and conditions shall take effect from the moment they are published on the Website. We therefore advise you to review this Policy regularly for any changes. ” 145 If government organisations had accepted these dynamic purposes, they effectively couldn’t inform their admins and other employees, nor control if processing for these purposes was legitimate. However, as described in Sections 5.2 and 5.4 , based on the new Framework Agreement with the Dutch government ESET’s Privacy Policy no longer applies to the processing of these ‘processor’ data. The Dutch government has agreed with ESET on an improved framework with a limitative list of 4 processor and 8 authorised further processing purposes. As assessed in Section 6.3 ESET can legitimately qualify as authorised (instead of joint) controller for these 8 specific purposes.

As analysed in Section 11.1 the processing for the agreed specific processor purposes is necessary for the execution of the (job) contract with admins and end users , respectively fulfilment of a legitimate interest or public task. As analysed in Section 11.2 the further processing of the listed categories of personal data, generally aggregated, for the agreed specific purposes is compatible with the agreed data collection purposes. The principle of purpose limitation is closely linked to transparency and ‘fairness’ of the processing. Together, implementation of these principles should lead to surprise minimisation for the government organisations. As the Article 29 Working Party wrot e in its guidelines on transparency (adopted by the EDPB): “A central consideration of the principle of transparency outlined in these provisions is that the data subject should be able to determine in advance what the scope and consequences of the processing entails and that they should not be taken by surprise a t a later point about the ways in which their personal data has been used.

This is also an important aspect of the principle of fairness under Article 5.1 of the GDPR and indeed is linked to Recital 39 which states that 145 ESET Privacybeleid, undated, URL: https://www.eset.com/nl/policy - hub/privacybeleid/ (last visited 9 June 2026). DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 101 of 132 “[n]atural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data(...).” It follows that government organisations must be able to inform their admin s and other end user employees for what specific purposes their personal data will be processed, and be able to inform external data subjects whose personal data may be processed as part of the Content Data and as a result of capturing their IP addresses in the security logs about the agreed purposes, both when ESET qualifies as processor, and as authorised data controller.

Dutch government organisations that want to use the tested ESET services can use this DPIA and the amended DPA to update their register of processing activities and inform the admins and end users about the purposes of the processing accordingly . The Dutch government is able to verify ESET's compliance with the agreed purposes based on the extensive audit right in the amended DPA. Based on the Framework A greement with the Dutch government, and the right to audit, government organisations are able to comply with Article 5(2) of the GDPR, and prove they comply with the principle of purpose limitation (accountability). In sum , based on the amended DPA with agreed limitative lists of specific and legitimate processing purposes, and agreement on key terms such as aggregation, ESET's data processing for the tested services is in line with the requirement of purpose limitation, both as processor and as authorised data controller. 14.

Necessity and proportionality Article 5(1)c GDPR requires that every processing has to be limited to what is necessary to achieve the set purpose(s). It is therefore important to examine whether every processing is in fact necessary for the purposes for which the data controllers process personal data. The concept of necessity is made up of two related concepts, namely proportionality and subsidiarity . The personal data which are processed must be necessary for the purpose pursued by the processing activity. First, it has to be assessed whether the same purpose can reasonably be achieved with other, less invasive means. If so, these alternatives have t o be used. Second, proportionality demands a balancing act between the interests of the data subject and the data controller. Proportionate data processing means that the amount of data processed is not excessive in relation to the purpose of the processing.

If the p urpose can be achieved by processing fewer personal data, then the amount of personal data processed should be decreased to what is necessary. Therefore, essentially, the data controller may process personal data insofar as is necessary to achieve the purp ose but may not process personal data he or she may do without. The application of the principle of proportionality is thus closely related to the principles of data protection from Article 5 GDPR. 14.1 Assessment of the proportionality The key questions are: are the interests properly balanced? And, does the processing not go further than what is necessary? To assess whether the processing is proportionate to the interest pursued by the data controller(s), the processing must first meet the 6 principles of Article 5 of the GDPR. As legal conditions they have to be complied with in order to make the data protection legitimate. 146 Two of the principles are out of scope of this DPIA, while the principle of purpose limitation is already discussed above, in Section 13 .

Compliance with the security principle has to be analysed in a separate security assessment, while the principle relating to accuracy of personal data is under control of the government organisation, as part of the Content Data. Below, the conditions for lawful processing are elaborated in three subsections: 1. Lawfulness, Fairness and Transparency 2. Data minimisation and privacy by design 3. Storage limitation 14.1.1 Lawfulness, Fairness and Transparency As described throughout part A of this DPIA in boxes with mitigating measures ESET has agreed to only process personal data when necessary and proportionate for the instructions given by the customer. This includes limited further processing for 8 specific legitimate business purposes as authorised controller. As assessed in Section 11.2 this further processing is compatible with the purpose for which the Dutch government instruct s ESET to process data as processor.

This ensures that government organisations can comply with their obligation to ensure the lawfulness of the data processing by ESET. As described in Section 3.2.3 ESET provides admirable transparency to admins about the local rules that govern the assessment of potentially malicious files . Admins can view the pre - configured rules from ESET through the Protect & Inspect interface , and for each rule, drill down into the details . As described in Section 3.4.1 ESET also provides a good view of its logs about admin activities, the audit logs , the key component of the Diagnostic Data . The availability of these historical logs is indispensable for privacy and data protection compliance. Additionally, as mentioned in Section 3.4.4 , ESET has allowed Privacy Company to view relevant samples of the data security logs and webserver access logs to understand the contents and legitimacy of the processing .

As described in Section 3.2.2 ESET will better document the Security Event D ata it collects through its two types of cloud LiveGrid services: Reputation and Feedback . The documentation must enable an auditor to assess if these descriptions match the observed data processing , and will become available by the end of Q3 2026 . ESET will implement changes to allow customers to disable the LiveGrid feedback function by 146 See for example CJEU, C - 131/12, Google Spain SL, Google Inc. v Agencia Española de Protección de Datos (AEPD), Mario Costeja González, ECLI:EU:C:2014:317. Paragraph 71 : In this connection, it should be noted that, subject to the exceptions permitted under Article 13 of Directive 95/46, all processing of personal data must comply, first, with the principles relating to data quality set out in Article 6 of the directive and , secondly, with one of the criteria for making data processing legitimate listed in Article 7 of the directive (see Österreichischer Rundfunk and Others EU:C:2003:294, paragraph 65; Joined Cases C ‑ 468/10 and C ‑ 469/10 ASNEF and FECEMD EU:C:2011:777, paragraph 26; and Case C ‑ 342/12 Worten EU:C:2013:355, paragraph 33).

DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 103 of 132 the end of Q3 2026 . ESET has already implemented a change to remove the session ID from the Reputation data flow that made the users more easily identifiable for ESET. The meaning of b road terms such as ‘ aggregate’ , ‘Diagnostic Data’ and ‘Security Event Data’ is defined the Framework A greement with the Dutch government . As described in Section 2.3 and assessed in Section 13 above, ESET originally could unilaterally change its Privacy Policy . ESET will now offer an archive of past versions of the Privacy Policy , and offer dated privacy policies for the use of Windows endpoint security and ESET Protect Cloud , starting with revised privacy policy publication by the end of 2026 . This practice allows government organisations to correctly inform employees what personal data ESET processes for what purposes if employees voluntarily consent to processing for other purposes, such as subscribing to a commercial newsletter.

ESET has agreed to update its Cookie Policy, and redirect visitors from e set.com to eset.com/nl by the end of Q3 2026 . ESET has already fixed a bug that led to the use of a Google marketing cookie. While waiting for the new documentation, customers can mitigate the risks of ESET's lack of publicly accessible documentation by relying on the information in this umbrella DPIA. 14.1.2 Data minimisation and privacy by design and by default The principles of data minimisation and privacy by default demand that the processing of personal data is limited to what is necessary: Data must be “ adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ” (article 5 (1) (c) GDPR). This means that government organisations may not collect and store data (or allow ESET to collect and store data) which are not directly related to a legitimate purpose. According to this principle, the default settings for the data collection should be set in such a way as to minimi se data collection by using the most privacy friendly settings.

ESET Protect offers many privacy friendly default settings and options. For example, d uring the creation of the admin/user accounts, ESET did not collect data about admins such as gender or date of birth. ESET did not send unsolicited mails . ESET does offer an option for passive Feedback to admins, and offers an option for new users to agree to commercial communications, but requires active consent. Regardless how ESET is configured ( on - premises or as cloud service) , admins by default only see warnings of suspected malware, security relevant context and quarantined files , not everything (not all files or mails) that are processed by the ESET software such as the full contents of all scanned files. Though this design may primarily originate from efficiency reasons, it has a very positive data minimisation effect for the employees whose files are scanned by the ESET software and services.

Additionally ESET offers relevant central opt - outs for admins. As described in Section s 4.3 and 4.3 a dmins can opt - out from LiveGrid Feedback and LiveGrid Reputation . H o wever, to keep the benefits of this thorough (cloud) analysi s , they can also choose not to enable sharing of Content Data in the form of files and crash dumps when they enable LiveGrid Feedback. P rivacy by design includes security by design. For government organisations it is key that ESET is able to detect brand new threats , and not only flag known malware . When first encountering such new threats, ESET does not have existing fingerprints to check against. As described in Section 3.2.3 ESET was triggered by the use of Mitmproxy . Even though use of that tool is perfectly legitimate, it is uncommon. New malware connecting to a bank would also fit this description of uncommon software connecting to a popular webservice .

Therefore, the detection of behavioural anomalies is an important element of the key security purpose, even though this might result in incorrect flags, or the monitoring of web surfing behaviour. Data processing for this security purpose is therefore strictly necessary, and does not contradict privacy by design . 14.1.3 Storage limitation The principle of storage limitation demands that personal data are only retained as long as necessary for the purpose in question. Data must be “ kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed ” (article 5 (1) (e), first sentence GDPR). This principle therefore demands that personal data are deleted as soon as they are no longer necessary to achieve the purpose pursued by the controller. The text of this provision goes on to clarify that “ personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject ” (article 5 (1) (e), second sentence, GDPR).

ESET has chosen relatively short default ret ention periods for the logs that are accessible for admins: between 1 and 6 months for the Detection, Management, Audit and Monitoring logs. If government organisations need to retain these data for shorter or longer periods of time, they can change these periods, or export to other tools or storage spaces. This does not affect the storage periods for ESET’s internal security teams nor the storage for compliance with the Slovak legal data retention requirement . As described in Section 10.2 ESET initially published limited information about the retention periods of the data it processes as (authorised) controller . In reply to this DPIA, ESET has provided more detailed information to SLM, included in Table 6 and Table 7 . Some of ESET’s standard retention periods were assessed to be excessive, such as a retention period of 4 years for support tickets after closure .

However, ESET has since agreed to develop a DIY option for admins in the Protect Hub to determine the necessary retention period. A default retention period of the full tickets (not pseudonymised) for 13 months is more appropriate than 4 years, with an option for admins to delete specific tickets and attachments if they accidentally disclosed confidential or sensi tive information. Similarly, retention of al l admin and end user Account Data for 3 years after subscription termination, not limited to the Commercial Contact Data of a specific customer who filed a legal claim, was disproportionate . ESET has since distinguished between the A ccount D ata and the Commercial Contact Data and their retention DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 105 of 132 periods , and will delete the Account Data after contract or license termination, plus a period of 30 days in which the account name may still appear in operational logs.

ESET has clarified the retention period of 90 days for the webserver access logs relating to visits to the Admin Console, and explained the necessity of a period of 6 months for the webserver access logs containing information about visits to its public we bsite. Though the retention period of 6 months is longer than average suppliers, ESET has sufficiently motivated the necessity as a security provider to collect more ‘study’ material than average website owners. ESET has also provided a convincing explanation of the legal obligation under Slovak cybersecurity law to retain its own internal security logs for a period of 3 years. The impact on data subjects becomes higher if the retention period is longer. ESET has taken the mitigating measure to limit the access to the encrypted archive with the 3 years retention to a limited set of people with a sufficiently high authorisation. Furthermore, ESET has granted SLM Rijk a broad right to audit.

This means the Dutch government can assess if ESET complies with the agreed retention periods, and the processing does not go further than what is necessary. In sum , ESET is commendable for the transparency about the logic of its locally applied rule s, for providing good access to the audit logs , and for applying privacy and security by design measures, or at least offering admins an opt - out for potentially invasive types of data processing. Because of the agreed further specification and agreement in the amended DPA that ESET only processes these personal data as a processor and as authorised data controller, the retention periods are proportionate. 14.2 Assessment of the subsidiarity The key question is whether the same goals can be reached with less intrusive means. As illustrated in Section 7.1 ESET competes with 8 global players with similar security offerings , 7 of which are based in the USA.

There is no publicly available information that compares the compliance of all of these competing suppliers of security services with privacy laws and regulations. SLM has published a technical verification report about Microsoft Defender 147 , but does not have centrally negotiated framework agreement s with the other 7 providers , and has no technical insights in the data processing by these 7 parties. As a Slovak provider, ESET has a unique advantage compared to its competitors from the USA. If ESET did not use any services from US American providers, it c ould not be subjected to US American law, including executive orders of the president. However, as described in Section 8.2 , in its standard public cloud offer ESET host s many core services on Microsoft Azure and uses Salesforce as a support ticket system . These parties are headquartered in the USA and may transfer personal data to third countrie s, for example if they have contractors working from such countries .

Additionally, ESET uses an AWS CDN for some static content and uses Google Tag Management for analytics on its public websites. 147 SLM Rijk, verification report Microsoft Defender, URL: https://open.overheid.nl/details/5e01a488 - 3814 - 4de9 - b03e - 5793cb22928a . As described in Section 7.2 the Dutch government has an essential interest in data sovereignty, to better prevent loss of confidentiality and sudden unavailability. T he amended DPA includes limitative lists of purposes for the five relevant categories of personal data (processor and authorised further processing and other measures to limit the probability of unauthorised compelled disclosure of these data to government authorities . The amended DPA also prevents the engagement of sub - processors outside of the EU . Furthermore, ESET agrees to a contractual commitment to prevent abuse of the inherent access capabilities for ESET in the software (no backdoor s ) and offers an effective right to object to new (EU based) sub - processors without having to terminate the contract.

ESET’ s standard contractual offering leverages the inherent benefits of being Slovak and privately held . In sum , compared to competing providers, ESET can offer similar services with a higher level of privacy protection. 15. Rights of data subjects The GDPR grants data subjects the right to information, access, rectification and erasure, object to profiling, data portability and file a complaint. It is the data controller’s obligation to provide information and to duly and timely address these reques ts. If the data controller has engaged a data processor, the GDPR requires the data processing agreement to include that the data processor will assist the data controller in complying with data subject rights requests. As assessed in Section 6.2 based on the amended DPA with the Dutch government, ESET qualifies as data processor for the processing of the Security Event , Account, Diagnostic, Support and restricted access Website Data .

And as assessed in Section 6.3 ESET is authorised to further process some of these personal data for the agreed legitimate business purposes as controller. Both in a role as processor and as authorised controller ESET commits to assist the controller with any data subject access requests. 15.1 Right to information Data subjects have a right to information. This means that data controllers must provide people with easily accessible, comprehensible and concise information in clear language about, inter alia, their identity as data controller, the purposes of the data processing, the intended duration of the storage and the rights of data subjects. As quoted above in Sectio n 14.1.1 , the EDPB explains in its Guidelines on transparency that controllers should clearly explain the most important consequences of the processing. “[n]atural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data. ” 148 One of the purposes of this umbrella DPIA is to help government organisations that wish to use the tested s ervices to better inform their employees about the scope and purposes of the data processing. 148 The EDPB has adopted the Article 29 Working Party guidelines WP 260 rev 1, Guidelines on transparency under Regulation 2016/679, adopted on 29 November 2017, as last Revised and Adopted on 11 April 2018.

DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 107 of 132 As assessed in Section 14.1 ESET has provided important clarifications to SLM Rijk, has improved the cookie documentation for the Admin Console, and will improve the documentation for its public website . The identified information omissions were : 1. Hyperlinks to different privacy policies and cookie policies , sometimes undated, mostly no archived versions. 2. Absence of l imitative lists of specific purposes as processor and as authorised data controller , including purposes identified as incorrectly missing. 3. Unclear, c ontradictive retention periods for Account Data and Commercial Contact Data, undocumented retention periods of security logs, unspecific r etention periods personal data processed by ESET as data controller. 4. Definition of terms like ‘optimisation’ and ‘aggregate’ . 5. Technical documentation about the contents of the data processing via LiveGrid Reputation and Feedback. 6.

W h at personal data ESET collects in its webserver access logs for both types of visited Websites, and how long it retains the cookie data. ESET has committed to enhance most documentation by the end of Q3 2026 , and to publish an updated privacy policy with versioning and an archive of prior privacy policies by the end of 2026 . In sum , Dutch government organisations can comply with their obligations to provide their employees with adequate information about the scope and purposes of the data processing , if they use this DPIA and the amended DPA. 15.2 Right to access Data subjects have a (fundamental) right to access personal data concerning them. Upon request, data controllers must inform data subjects whether they are processing personal data about them (directly, or through a data processor). If this is the case, th ey must provide data subjects with a copy of the personal data processed, together with information about the purposes of processing, recipients to whom the data have been transmitted, the retention period(s), and information on their further rights as dat a subjects, such as filing a complaint with the Data Protection Authority.

As described in Section 3.7 Privacy Company filed data subject access requests for the test user and for the admin. At the time, ESET still qualifie d itself as data controller for th e Security Event and Diagnostic Data. As described in Section 3.4 the processing involved 4 subcategories of data: 1. Admin audit logs 2. Management logs (with Account Data) 3. Installation of updates 4. ESET’s own security logs The audit logs were and are already available for customer, but ESET did not provide access to the other 3 categories of personal data . ESET instead referred to information already available for admins and end - users. Privacy Company specifically asked for access to : 1. Information recorded in ESET’s webserver access logs about admin activities in the console, and visits to ESET’s public website, with for example IP address, end user, device, activities and the Cookie Data. 2. Personal data collected by ESET in its own SIEM, and data collected by Microsoft Azure in its security logs (only relevant for ESET’s standard public cloud offering). 3.

All other personal data ESET collect ed as (self - qualified) data controller , but will process as authorised controller under the new Framework Agreement with the Dutch government . ESET later did provide access to more personal data, including an extract from ESET’s webserver update logs. ESET initially claimed it would be too difficult t o reidentify individual end users in these logs for all customer licenses , but later agreed to provide access. 149 ESET also allowed Privacy Company to view a sample of relevant security logs and explained the contents of its webserver access logs. ESET has agreed to implement a template for DSAR responses ensuring completeness of responses, with an explanation what information ESET cannot share or can only share in limited form, by the end of Q3 2026. In sum , ESET commits to fully comply with its obligations to provide access , and provide an explanation if it relies on a legal exception on the right to access .

Privacy Company has not filed a new DSAR to verify compliance, as this would have required retesting. 15.3 Right of rectification and erasure Thirdly, data subjects have the right to have inaccurate or outdated information corrected, incomplete information completed and - under certain circumstances - personal information deleted or the processing of personal data restricted. Based on the new Framework Agreement with ESET Dutch government organisations can delete admin and end user Account Data, they can separately influence the retention period of the Commercial Contact Data, and are in exclusive control of the Content Data . They will be able to delete support tickets and attachments after a self - determined retention period starting in Q4 2026, via the new DIY option ESET will offer in the Protect Hub. Customers can’t delete Security Event Data or Website Data, and they cannot delete the Diagnostic Data , or the aggregated version of the 5 categories of personal data that ESET processes as authorised controller .

However, based on the assessment that the retention periods are necessary and proportionate, Dutch government organisations can comply with the requirements of Article 17(1)(a) and (d) of the GDPR. These provisions require data controller s to delete personal data without undue delay upon request of a data subject if they are no longer needed for the purposes for which they were collected or otherwise processed, or when the personal data have been unlawfully processed (in case an admin accidentally attaches confidential data to a support ticket). In sum , based on the amended DPA ESET allows government organisations to comply with their obligation to erase outdated or unlawfully processed data. 15.4 Right to object to profiling Fourthly, data subjects have the right to object to an exclusively automated decision if it has legal effects. Automated decision making is the core of ESET’s services: to apply rules to detect malicious files .

However, ESET does not use the data to create 149 ESET reply to the Technical Appendix, 9 April 2025. DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 109 of 132 profiles of admins or end users , such as flag ging ‘risky user s ’. Admins can drill down to the applied rules to the level of the end user, but ESET does not provide exports on a per user level . In sum, ESET takes decisions about files, not about users. If ESET for example falsely flags an e - mail as ‘suspicious’, it is not deleted but put in quarantine. It is up to admins, as described in Section 4.1 to check the logs for false flags and encourage end users to report such false flags. Theoretically, if a person sends e - mail to the Dutch government from a dynamic IP - address that has been used for abusive purposes in the past, th at person could incorrectly be ‘profiled’ as a spammer or attacker .

T heir mails would automatically end up in quarantine. It is up to admins to prevent such profiling. 15.5 Right to data portability Employees have a right to data portability if the processing of their personal data is carried out by automated means and is based on their consent or on the necessity of a contract. As a processor, some of the data processing by ESET on behalf of government organisations could be based on the necessity of performing a (employment) contract with the admin and end users . ESET commits to comply with the right to data portability in the amended DPA with the Dutch government. However, the exercise of the right to data portability is not realistically possible for admins and end users : as they would copy personal data from the government organisation. Hence, admins and end users cannot use this right to demand export of confidential data and personal data from the government organisation (Article 20(4) of the GDPR). 15.6 Right to file a complaint Finally, government organisations as controllers must inform their employees about their right to complain, internally to their Data Protection Officer (DPO), and externally, to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

This is out of scope of this umbrella DPIA. Part C. Discussion and Assessment of the Risks This part concerns the description and assessment of the risks for data subjects. This part starts with an overall identification of the risks to the rights and freedoms of data subjects as a result of the processing of the Security Event, Account, Diagnostic, Support and two types of Website Data. The risks will subsequently be classified according to the likelihood they might occur, and the impact on the rights and freedoms of the data subjects when they do. 16. Risks 16.1 Identification of risks Different from other DPIAs performed for SLM Rijk this report does not distinguish between risks for the Content Data and risks for the metadata. The category of Security Event Data forms the core of ESET’s data processing, and is a mix of Content and meta data. The term Content Data in this report is reserved for the data processed by customers in their own environment, such as the documents scanned on Windows desktops or cloud storage ( this DPIA tested storage in Microsoft S harePoint and Google Workspace D rive ).

In total this DPIA identifies 16 specific data protection risks . The data protection risks can be grouped in the following categories: • inability to exercise rights (including but not limited to privacy rights) • inability to access services or opportunities • loss of control over the use of personal data • discrimination • identity theft or fraud • financial loss • reputational damage • physical harm • loss of confidentiality • re - identification of pseudonymised data or • any other significant economic or social disadvantage 150 These risks have to be assessed against the likelihood of the occurrence of these risks (the probability) and the severity of the impact. The Dutch government provides a risk scoring table in the model DPIA. 151 In order to weigh the severity of the impact, and the likelihood of the harm for these generic risks, this report combines a list of specific risks with specific circumstances of the specific investigated data processing. 150 List provided by the ICO in preBrexit guidance about DPIAs, no longer publicly available. 151 Model DPIA Rijksdienst v3.0, September 2023, URL: https://www.kcbr.nl/sites/default/files/2023 - 08/Rapportagemodel%20DPIA%20Rijksdienst%20v3.0.docx DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 111 of 132 Table 9 : Risk scoring matrix Severity of impact Serious consequences Low risk High risk High risk Some impact Low risk Medium risk High risk Minimal impact Low risk Low risk Remote Reasonable possibility More likely than not Likelihood of risk (occurrence) At the start of this DPIA, ESET qualifie d itself a s an independent data controller for 22 purposes for all personal data , except for the Content Data .

This means ESET determine d the purposes for the processing of the Account, Security Event, Diagnostic, Support, and (two types of) Website Data. As controller ESET also determine d what third parties it engages, including transfers to third countries, but d id not publicly document these parties or processors , and d id not allow its customers to object. This lead to a number of high risks related to a loss of control of the processing, due t o a lack of transparency . ESET show ed customers many different versions of its Privacy Policy and Cookie Policy with broad and vague terms for many processing purposes . ESET a llow ed itself to unilaterally change the 22 controller purposes. Th ese circumstances also lead to several high risk s related to loss of control o f the processing purposes . Other identified high risks related to an incomplete reply to Data Subject Access Requests and the use of 3 US American parties, including Microsoft Azure for the core data processing and use of Salesforce for a support ticketing system in ESET’s standard public cloud offer.

ESET has succeeded in mitigating all of these high risks by a combination of technical and organisational measures, including agreeing to a new Framework Agreement with the Dutch government and creating a new EU - exclusive private cloud offer. To increase transparency, ESET has also agreed to update relevant documentation about the personal data it processes, the purpos es and the retention periods. The measures already taken or agreed to by ESET are highlighted throughout this DPIA, and will be described in more detail in the 1 6 subsections below. 16.2 Assessment of risks 16.2.1 Loss of control 22 ‘controller’ purposes processing of Account, Security Event, Diagnostic, Support and Website Data ESET qualifie d itself as data controller for 22 identified purposes for the processing of the Security Event, Account, Diagnostic, Support and two types of Website Data . As analysed in Section 6.3 this mean t ESET was either a joint controller, or a third party for the Dutch government .

As assessed in Section 13 most of the 22 identified controller purposes were too broad or too vague to qualify as specific and explicit . It was unclear what ESET mean t with terms and purposes like ‘ research’ , ‘improvement’, ‘optimisation’ and ‘aggregate’ . Because these terms and purposes were not specific enough, their scope wa s unclear or their application unclear . This in turn mean t the Dutch g overnment organisations were not able t o determine the legitimacy of the data processing. It is inevitable that every cloud service provider has to process some personal data for its own legitimate business purposes. Even though ESET has agreed to become a processor for all personal data, the company still needs to process some personal data for comm on business purposes, to send invoices based on the use of the contracted services, to verify customers pay for the right amount of licenses, to use some aggregated personal data for technical software improvements, for internal bookkeeping and forec asting and for web analytics.

ESET also has to comply with Slovak legal obligations and process personal data for audit and compliance purposes. As assessed in Section 11.2 the processing for these 8 purposes is compatible with the original data collection and data generation purposes. Based on the agreed limitative list, government organisations can comply with Article 5(2) of the GDPR, and prove they comply with the principle of purpose limitation (accountability). While the impact of a loss of control through lack of purpose limitation may differ from some to serious, the probability has been reduced to near - zero based on the new Framework Agreement. Therefore the risk of loss of control through lack of purpose limitation can be qualified as low . 16.2.2 Loss of control: use of unspecified third parties by ESET as controller As identified in Section 5.3.2 ESET as controller permit ted itself to ‘share’ personal data for 11 purposes.

ESET d id not specify what third parties or processors it engage d when it qualifie d itself as independent controller. The new Framework Agreement with the Dutch government contains a list of authorised sub - processors. If a Dutch government organisation chooses the recommended new EU private cloud o ption or the on - premises offer, ESET commits to only use EU - native sub - processors, with the exception of the use of an AWS CDN for some static content on its website and Google Tag Management for analytics, both on the Admin Console and on its publicly accessible websites. In its standard public cloud offer, ESET hosts many core services on Microsoft Azure , and uses Salesforce for a support ticketing system, plus the above mentioned AWS CDN and Google Tag Management. DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 113 of 132 The limited list means customers have control over the data processing , including data transfers , of the Account, Security Event, Diagnostic, Support and both types of Website Data for the agreed 4 processor purposes , and for the 8 authorised further processing purposes.

The probability of loss of control through the use of unspecified parties by ESET has been reduced to near - zero in the new Framework Agreement , while the impact may differ from some to serious. Therefore the risk of loss of control can be qualified as low 16.2.3 Loss of control and loss of confidentiality: compelled disclosure personal data to government authorities in and outside of the EU As described in Section 14.2 even though ESET as a n independently held Slovak company is not subjected to foreign law or jurisdiction, ESET may be ordered by government authorities, agencies or courts in or outside of the EU, or parties that can invoke EU law, to disclose personal data from its customers . As described in Section 8.2 , ESET uses services from US American providers , mainly in its standard public cloud offer, but also uses Google and AWS for very limited Website Data . That means the personal data it processes through these providers can be subjected to US American law, including the US Cloud Act and executive orders of the president.

Additionally, in ESE T 's standard public cloud offer, ESET can process LiveGrid requests in its own data centre in San Diego, and contents of LiveGrid Feedback in its own data centres Japan and Canada (see Figure 21 ). As described in the Sections 8.3.1 and 8.3.2 , as long as the EU US Data Privacy Framework remains valid, the USA formally have an adequate level of data protection. Similarly, the EC has issued adequacy decisions for Japan and for companies in Canada that are subject to the Canadian data protection law PIPEDA. It is unclear what the role is of the ESET LLC Office in Diego, and why it has not registered as participant to EU US DPF. There is a possibility that the European Court of Justice will suspend or invalidate the adequacy decision if Latombe succeeds in his appeal, or if some other court in the EU asks a prejudicial question to the ECJ. Based on the Dutch national cloud policy, governments have to generally refrain from using public cloud services for the processing of unencrypted BBN - 3 data, unless they can guarantee that the encryption cannot be broken or circumvented.

This means they s hould not allow ESET to scan files with such data in the standard public cloud solution, but they can use private cloud or on - premises solutions. Since March 2026 ESET offers a new EU private cloud to Dutch government customers . This includes the LiveGrid service (also available for the on - premises software). ESET has ensured SLM Rijk that employees from outside the EU do not have access to any personal data processed in that EU private cloud. A s described in Section 6.3 and assessed in 11.2 in the new Framework Agreement ESET has committed to reject all requests from non - EU authorities. T he Dutch government has also agreed with ESET on risk minimisation steps when responding to a valid order from an EU authority , to ensure ESET only discloses personal data when it is legally inevitable. ESET has agreed in the Enterprise Agreement to: • Attempt to redirect the third party to request the data from the customer directly. • Notify the customer prior to the disclosure, unless legally prohibited from doing so. • Challenge the order if legally possible. • If the order is valid and legitimate, and ESET cannot oppose, ESET will narrow down the disclosure to the minimum necessary and inform the customer as soon as legally permitted.

Additionally, ESET has agreed to publish annual transparency statistics about the number of requests it has received, and the number of times it has disclosed any personal data. In ESET’s standard public cloud offer, ESET uses 4 US American processors. These parties may be compelled to disclose data stored in the EU or in the US and third countries. If Dutch government organisations do not want to use ESET’s new EU private cloud services, they must anticipate on a future high data protection risk . If the EU US DPF is annulled, this risk not only applies to disclosure in the USA, but also to the 30 third countries from which Microsoft engineers have access to the Azure data stored i n the EU, and other countries where Google, AWS and Salesforce engineers may access the data, even if processed in the EU. ESET has committed to ensure that its sub - processors Microsoft, AWS, Google and Salesforce inform ESET if they receive an order for compelled disclosure of personal data relating to Dutch government customers, and follow the same probability reducing steps .

ESET shall use commercially reasonable efforts to ensure that its sub - processors provide notification, where legally permissible, of compelled disclosure requests concerning Personal Data. Dutch government organisations cannot assess the probability of compelled d isclosure down the processing chain. T he impact of such disclosure may be severe , given the sensitive nature of the Security Event Data that may include URLs and names of files . Provided Dutch government organisations choose the new EU private cloud offer or the on - premises solution , the probability of compelled disclosure becomes remote, even though the impact remains high. Hence the risk can be qualified as low . 16.2.4 Loss of control processor purposes ESET has agreed to only process the 5 categories of personal data as a processor, for the 4 main purposes, with sub - purposes. Simply summarised, to provide and maintain well - functioning and up - to - date requested software and services, to secure the software and services for all customers and to provide technical support.

ESET has also agreed to no longer further process these data for purposes it determines itself, but only for the limitative list of 8 authorised further processing purposes. Thanks to these specifications in the Framework Agreement there is no longer a risk that ESET takes deci sions about the purposes of the processing, and unintentionally becomes a data controller, in contravention of its role as processor. To ensure that ESET not just formally, but also factually processes personal data as processor, a s analysed in Section 6.2 , the amended data processing agreement with the Dutch government cover s all personal data, include s a n effective objection DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 115 of 132 procedure against new sub - processors and contains an unconditional right to audit the agreed purpose limitation. The impact on admins and employees could be high if ESET were to independently take decisions to process their personal data for other purposes, since government organisations have to give ESET access to all personal data they process in documents, files and mails , including sensitive, special categories and confidential data.

However, based on the Framework Agreement, the probability of ESET taking such decisions about the purposes of the processing is near - zero. Therefore the risk of loss of control over the processor purposes can be qualified as low . 16.2.5 Loss of control due to lack of transparency retention periods for Account, Security Event, Diagnostic, Support and Website Data As described in Section 10.2 ESET publishes limited information about the retention periods of the relevant 5 categories of personal data , especially about the different operational and security logs . In reply to this DPIA, ESET has provided more detailed information to SLM, included in Table 6 and Table 7 and explained in 10.2.1 , 10.2.2 and 10.2.3 . Some of ESET’s standard retention periods a re excessive, such as a retention period of 4 years for support tickets after closure. See Section 16.2.9 below. Similarly, retention of all admin and end user Account Data for 3 years after subscription termination, not limited to the Commercial Contact Data of a specific customer who filed a legal claim, was disproportionate.

ESET has since shortened this period, by distinguish ing between the Account Data and the Commercial Contact Data and their retention periods, and will delete the Account Data after contract or license termination, plus a period of 30 days in which the account name may still appear in operational logs. ESET has also convincingly explained the necessity of other retention periods, for the Website Data, but also to comply with Slovak mandatory data retention of ESET’s internal security logs relating to its own infrastructure (not to customers’ instances) for a period of 3 years. The impact on data subjects becomes higher if the retention period is longer. ESET has taken the mitigating measure to limit the access to the encrypted archive with the 3 years retention to a limited set of people with a sufficient ly high authorisation. Furthermore, ESET has granted SLM Rijk a broad right to audit.

This means the Dutch government can assess if ESET complies with the agreed retention periods, and the processing does not go further than what is necessary. T he impact of the lack of information about the retention periods would have to be qualified as serious , because government organisations could not adequately comply with their transparency obligation towards employees. Absent information about the effective retention periods, employees cannot exercise their rights, such as the right to access their data. However, ESET will publish detailed documentation about the retention periods, separate from the Privacy Policy, by the end of Q3 2026. In the meantime, g overnment organisations can use the information in this DPIA to prevent occurrence of a loss of control through the lack of transparency about the retention periods. Therefore, the risk of loss of control due to the lack of transparency can be qualified as low . 16.2.6 Loss of control due to lack of transparency Security Event Data As assessed in Section 14.1.1 ESET does not publish documentation about the contents of the Security Event Data ESET collects through its two types of cloud LiveGrid services: Reputation and Feedback.

In reply to this DPIA ESET provided a useful explanation (see Section 3.2.2 ), and has remove d the session ID from the LiveGrid data flow that made the users more easily identifiable for ESET. ESET has also commit ted to publish detailed technical documentation by the end of Q3 2026 that will enable an auditor to assess if these descriptions match the observed data processing at ESET. The lack of publicly available technical documentation makes it difficult for potential new customers to assess compliance before procuring/using the service. The absence of detailed documentation also prevents existing customers from comparing observed da ta in logs with the documented data processing and explaining the data processing to the government employees, including ESET’s further processing for the authorised 8 purposes. As mentioned before, the impact of a lack of transparency would be high, since Security Event Data processed by LiveGrid Feedback can contain potentially sensitive and confidential Content Data .

As mentioned in Table 3 , “ Feedback involves sharing data, including the suspicious file itself, associated metadata (file path, timestamp, process information), device details, internet usage data like IP addresses and URLs, and even crash dump files .” However, based on ESET’s commitment to publish detailed documentation by the end of Q3 2026, and the information already shared via this DPIA , the probability of a loss of control through the lack of transparency about the actual Security Event Data has been reduced to remote. Therefore, the risk of loss of control due to the lack of transparency can be qualified as low . 16.2.7 Re identification of pseudonymous data through long or unspecified retention periods Related to the lack of transparency about the retention periods analysed in Section 16.2.5 , long retention periods increase the probability of reidentification of pseudonymised data.

Even after aggregation , ESET still has access to the Account Dat a and the Diagnostic Data from its customers. ESET is technically capable to combine these data with the aggregated or pseudonymous data. Even without such a combination, the probability of reidentification of pseudonymous data becomes higher if the data are retained for a longer period, because the dataset increases over time. Prior to the new agreement with the Dutch government, ESET wasn’t specific enough to determine the probability of this risk of reidentificatio n , for example when ESET uses the term ‘aggregate’. As explained in Section 11.2.2 ‘aggregate’ could theoretically also refer to an overview of actions of admins of 1 customer over time, or aggregation of all security incidents of 1 customer. In the new Framework Agreement, the term aggregation is defined, and the authorised purposes specify that ESET is not allowed to create statistics per customer.

As described in Section 3.2 i f ESET detects a new event, it will have to access a lot of details about the environment and nature of the attack to create effective protection for all customers. ESET can perform this processing as processor, also when it reuses the data to protect all of its customers. A measure such as aggregation of Security DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 117 of 132 Event Data would be ineffective, and is therefore not permitted as authorised further processing purpose with ESET in a role as controller. In view of the agreement about aggregation, the probability of reidentification has become remote, while the impact on data subjects remains potentially high (especially reidentification of admins) . Therefore the risk of reidentification of pseudonymised data can be qualified as a low risk . 16.2.8 Inability to exercise data subject right to access Website and Diagnostic Data (except for audit logs).

As described in Section 3.7 and analysed in Section 15.2 Privacy Company filed two Data Subject Access Requests (DSARs) , as admin and as test - user. ESET initially referred the requesters to information already available in the Admin Console and in the end user client. However, t he available information via these interfaces is incomplete, and d oes not include Management logs (with Account Data) , Installation of updates or ESET’s own security logs . ESET initially claimed it would be too difficult t o reidentify individual end users in the update logs for all customer licenses, but later agreed to provide access. 152 ESET also allowed Privacy Company to view a sample of relevant security logs and explained the contents of its webserver access logs. As a processor , ESET must assist its customers, the data controllers, to respond to DSARs (Art. 28(3) sub e GDPR). This means ESET must organise the data processing in such a way that it can reply to data subject access requests in a meaningful way .

The larger a company, the more difficult it becomes to claim the effort is disproportionate, as confirmed by a German appellate court. 153 The impact of an access limitation is high, because access to personal data is a fundamental right. Data subject access is a building block of the GDPR as starting point for data subjects to exercise their other rights. However, in view of ESET’s commitment to develop a standard form to provide a complete reply to DSARs by the end of Q3 2026, the probability of an inability to exercise the right to access will soon become remote. Therefore, the risk can be qualified as low . 16.2.9 Inability to exercise data subject right to delete, and loss of control, Support Data As described in Section 3.5 and assessed in Section 15.3 ESET does not yet allow customers to delete all or individual support tickets or attachments . ESET enables admins to upload attachments in a support conversation, but does not yet show a warning not to upload personal or confidential data.

However, ESET has since agreed to develop a DIY option for admins in the Protect Hub to delete tickets and attachments, and hence determine the necessary retention period themselves. ESET will also implement a warning not to upload personal or confidential data or give government organisations a central option to prevent sharing of screenshots and attachments by the end of Q3 2026. Admins may inadvertently overshare personal data via support tickets, especially via attachments. The impact of an inability to delete these data can be high in view of the long retention period of 4 years. However, even before ESET has implemented 152 ESET reply to the Technical Appendix, 9 April 2025. 153 OLG Köln, Urteil vom 26.07.2019, par. 81, URL: https://openjur.de/u/2177719.ppdf . the new DIY option, admins can already request ESET to delete specific tickets and attachments. This means ESET will reduce t he probability that admins cannot delete a support ticket to near - zero.

Therefore the risk of the inability to delete support tickets and loss of control over the contents of support requests can be qualified as low . 16.2.10 Loss of control: maze of different Privacy and Cookie Policies. As described in Section 2.3 and assessed in Section 13 ESET presents customers with many different privacy policies , cookie policies and terms , sometimes undated, and mostly without access to earlier, archived versions. ESET can unilaterally change its Privacy Policy and asks customers ‘ to review this Policy regularly ’ . This practice makes it impossible for government organisations to correctly inform employees what personal data ESET processes for what purposes. This lack of transparency makes the processing inherently unfair. ESET has already implemented a new data flow that redirects Dutch visitors to eset.com/nl. The (renewed) technical analysis of the cookie flows (on 21 November 2025, described in Section 3.6 ) shows that ESET ha s also already updated the Cookie Policy for admins on the restricted access website.

Currently ESET still has 3 different cookie policies, with different dates, for its public websites, but ESET has committed to provide a single document, including cookie retention periods (e.g. webserver access logs, optional marking cookies, etc.), by the end of 2026. The impact of in adequate legal documentation about the core elements of the data processing can be high , as government organisations cannot adequately comply with their transparency obligation towards employees , and this in turn can negatively impact their rights to access their data. However, in view of ESET’s commitments, the probability of loss of control due to the lack of transparency is reduced to remote. Therefore the risk can be qualified as low. 16.2.11 Loss of control: incorrect cookie consent management As assessed in Section 3.6.1 and 3.6.2 ESET incorrectly informs visitors of its websites website it will only set analytical and marketing cookies with consen t. D espite testing without providing consent for anything but the ‘Essential’ cookies, ESET set Google analytics cookies on both the restricted access and public web pages.

Privacy Company also observed a Google advertising cookie on the Admin Console , but ESET explained this was a bug, and quickly removed this cookie from the default. ESET has explained how it ha s minimised the data processing via the analytics cookies. ESET does not send traffic to Google analytics domains by deploying server side analytics . ESET also delet es the last octet of each IP address and remov es the user ID. ESET has harmonised the cookie consent flow on both types of websites. As last tested in March 2026, ESET no longer sets Google analytics cookies on the Admin Console if the admin does not consent to analytical cookies. ESET has committed to implement effective controls to prevent mistakes on an ongoing basis. ESET has already updated the relevant Cookie Policy, and will fully document cookie retention periods (e.g. webserver access logs, optional marking cookies, etc.) by the end of 2026.

DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 119 of 132 The impact of the misinformation can be medium to high, particularly in case of the bug with the observed Google tracking cookie . However, in view of the mitigating measures , ESET has reduced the probability of a loss of control due to incorrect cookie consent management to low. Therefore the risk can be qualified as low. 16.2.12 Loss of control: lack of separation restricted access and publicly accessible websites ESET has not drawn hard technical borders between its restricted access and publicly accessible relevant web pages. Admins have to log - in to the Admin Console via ESET’s publicly accessible identity.eset.com site, and have to visit help.eset.com to look up essential technical information. ESET initially qualifie d itself as controller for all Website Data. ESET has since agreed to become a data processor for the restricted access Admin Console, and has agreed to process website visitor statistics relating to the public website as an authorised controller, within the boundaries of the amended DPA with the Dut ch government.

ESET has also committed to maintain the current privacy friendly settings . The impact of the lack of separation between the two types of websites can be high, because admins and privacy/procurement officers have no choice but to visit the publicly accessible websites to perform their work duties. However, ESET has effectively red uced the probability of occurrence of a loss of control to remote. Therefore, the risk of loss of control due to the lack of separation between the Admin Console and the public ly accessible websites can be qualified as low . 16.2.13 Loss of control through lack of transparency contents of webserver access logs As noted in Section 3.6 and assessed in Section 14.1.1 ESET does not publish documentation about the contents of its webserver access logs, or how long it retains these data about the website visits. As described in Section 10.2.3 ESET has explained it retains the restricted access Website Data for 90 days, the public Website Data for 6 months.

ESET has committed to publish a description of the data it collects via its webserver access logs by the end of 2026. The impact of a lack of information about these logs varies, depending on the retention period and the contents, but absent information has to be set to high. In view of ESET’s commitment to publish information about the contents of these logs, ESET will e ffectively reduce the probability of occurrence of a loss of control to remote. Therefore, the risk of loss of control due to the lack of transparency about the contents of the webserver access logs can be qualified as low . 16.2.14 Loss of confidentiality and annoyance: Feedback and commercial communications As highlighted in Section 14.1.2 E SET Protect offers many privacy friendly default settings and options. ESET does not send unsolicited mails, and does not actively push admins to provide Feedback. However, ESET does offer options to users to consent to commercial communications and has a form through which admins can provide Feedback.

The form does not enable admins to upload attachments. This largely mitigates the risk of a loss of confidentiality caused by admins uploading confidential materials. Government organisations can advise admins never to provide Feedback to ESET and end users not to tick the checkbox for commercial communications to prevent annoyance and loss of time due to commercial mailings. This can reduce the probability of occurrence to remote. There may be some impact of the disclosure of personal data via Feedback, but no serious consequences absent the option to add attachments. Assuming government organisations apply the recommended measure, the risks for data subjects can be qualified as low. 16.2.15 Chilling effect use of available logs for employee monitorin g Government organisations have access to audit logs with inf o rmation on the specific admin and user actions, and access to some license management data, as described i n Section 3.4.1 and 3.4.2 .

The logs contain directly and indirectly identifying data. These logs can provide some insights in risky behaviour of employees , if the files they work with are flagged as potentially malicious. The behaviour of admins is also logged, how often they access the Admin Console, and use the drill down options or access the quarantined files. E E SET does not offer profiles of risky users, and does not use the e - mail addresses of employees, but the device names in the lists of flagged activities or files. ESET also only shows risky activities to admins , not all URLs visited or files opened or shared by users. As described in Section 14.1.2 this is an commendable privacy by design measure. Based on the logs about admin activity , managers could (try to) assess the productivity and effectivity of an admin . However, t he probability of such use is remote, because ESET admins spend relatively little time per day on the Admin Console, and access to these logs therefore only provides limited insights.

Other logs from commonly used work tools (text, e - mail, online calling etc) provide more detailed information about admin activities. If customers would create profiles of risky users , that data processing could have a chilling effect on government employees. They may fear that such profiles could be used for a negative performance assessment if such processing is not specifically excluded in an (internal) privacy policy for the processing of employee personal data. In the context of the Dutch government, the probability that the detected events are imported in an employee monitoring system and that the data processing leads to chilling effects is remote . This DPIA assumes government organisations will implement an internal privacy policy with rules and legitimate, specific purposes for the (further) processing of the audit logs . Therefore, the risks for data subjects can be qualified as low. 16.2.16 Loss of control: falsely flagged e - mails and files in quarantine All security systems may produce false positives, that is, files or events incorrectly qualifies as suspicious or malicious.

If for example legitimate e - mails are quarantined and nor the sender nor the intended recipient are aware that the mail is quarantined , government organisations risk losing important information or requests. This could even lead to financial risks, if an organisation does not timely answer to legal requests or appeals. More appropriate for a DPIA, the quarantining can be qualified as a data breach because of the unavailability of the data. To mitigate this risk, government organisations can instruct admins to regularly inspect the quarantined files, to prevent data loss, but also to quickly respond to security incidents that may affect many employees. DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 121 of 132 This DPIA assumes government organisations will implement such rules. Such implementation will reduce the probability to remote. Even if the impact on data subjects of false positives can be high, the risk of a loss of control due to falsely flagged files can be qualified as low.

Table 10 : Table with scored risks Severity of impact Serious consequences Low risk 1 , 2 , 3 , 4 , 5, 6 , 7, 8, 9, 10 , 11, 12, 1 3, 15, 16 High risk High risk Some impact Low risk 14 Medium risk High risk Minimal impact Low risk Low risk Low risk Remote Reasonable possibility More likely than not Likelihood of risk (occurrence) Part D. Description of the risk mitigating measures Part D describes measures for government organisations and for ESET to mitigate the risks described in Part C. 17. Risk mitigating measures The following section contains tables of the technical, organisational and legal measures that need to be taken by the government organisation or by ESET in order to ensure the 1 6 identified risks can be qualified as low. 17.1 Measures to mitigate identified risks No. Risks Recommended measures government organisations Recommended measures ESET Measures taken by ESET 1. Loss of control 22 ‘controller’ purposes Become a data processor for the proposed limitative list of 4 main purposes, with sub purposes.

Agreed in DPA with limited list of 4 processor purposes (Account, Security Event, Diagnostic, Support and the restricted access Website Data) Accept the limitative list of 7 proposed authorised further processing purposes. Agreed in DPA with additional 8th purpose: Processing of personal data for the purpose of auditing and verification of compliance (certifications) with the Law or standards (mandatory for Police Data) Agree on GDPR - compliant definitions of terms like ‘ research’ and ‘aggregate’. Agreed in DPA. Include a procedure in the agreement to allow the Dutch government to object to new purposes of the processing without contract termination. Agreed in DPA, with the exception of emergencies. 2. Loss of control and risk of reidentification : use of unspecified third parties as controller If ESET engages third parties for the authorised further processing purposes, they should be subprocessors, bound to the same rules ESET agreed with the Dutch government.

Agreed in DPA (as processor and authorised controller). DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 123 of 132 Provide a limitative list of processors for all purposes of the processing of the Account, Security Event, Diagnostic, Support and Website Data. The DPA includes a list of (sub - )processors both as processor and authorised controller. 3. Loss of control and loss of confidentiality: compelled disclosure of personal data to government authorities in and outside of the EU New customers: Choose (1) the new EU private cloud offer or (2) use the air gapped on - premises solution. Do not use (3) the standard ESET cloud services (based on Microsoft Azure hosting). Ensure that the new EU private cloud offer ensures EU - exclusive processing of the Account, Security Event, Diagnostic, Support and Website Data. Available since March 2026. Offer an effective right to object to new (EU based) sub - processors without having to terminate the contract.

Agreed in DPA. Explain for each (sub - )processor in what countries outside of the EU the data can be processed, including remote access by engineers. ESET will only engage EU native sub - processors for hosting options 1 and 2, including support ticketing provider. Clarified potential transfers in option 3, as well as the data transfers as authorised controller for the authorised further processing purpos es. Existing customers of the ESET standard cloud services: switch to option 1 or 2, or monitor the adequacy status of the USA and prepare for potential changes. Agree on a procedure to minimise the probability of compelled disclosure to government authorities. Agreed in Enterprise Agreement on procedure with data minimisation steps. Publish transparency statistics. Agreed in Enterprise Agreement, ESET will publish annual statistics about requests received and requests resulting in disclosure.

Ensure that the 4 sub - processors Microsoft, AWS, Google and Salesforce inform ESET if they receive an order for compelled disclosure of personal data relating to Dutch government customers, and follow the same ESET shall use commercially reasonable efforts to ensure that its sub - processors provide notification, where legally permissible, of compelled disclosure requests concerning Personal Data. probability reducing steps. 4. Loss of control processor purposes Choose or switch to (1) the new EU private cloud offer or (2) use the air gapped on - premises solution. Do not use (3) the standard ESET cloud services (based on Microsoft Azure hosting). Become a data processor for the 5 categories of personal data for the proposed limitative list of 4 main purposes, with sub purposes. Agreed in DPA, data processor for the 5 categories of personal data for the limitative list of 4 main purposes, with sub purposes.

Accept the limitative list of 7 proposed authorised further processing purposes. Agreed in DPA with additional 8th purpose: Processing of personal data for the purpose of auditing and verification of compliance (certifications) with the Law or standards (mandatory for Police Data) Include a procedure in the new agreement to allow the Dutch government to object to proposed new purposes for the processing without contract termination. Agreed in DPA on a new good faith negotiation procedure. (SLM Rijk) after 1 or 2 years: conduct audits on compliance with purpose limitation. Grant a broad right to audit without first referring to existing audits. Agreed on audit details in Terms and Conditions Framework Agreement. Agree to a contractual commitment to prevent abuse of the inherent access capabilities for ESET in the software ( no backdoors ). Agreed 5. Loss of control due to lack of transparency retention periods for Account, Security Event, Diagnostic, Support and Website Data Customise retention periods.

Publish a list of specific retention periods for the Account, Security Event, Diagnostic, Support and Website Data. Agreed to publication separate from privacy policy by the end of Q3 2026. Distinguish between retention of Account Data of admins and end users, and retention of Commercial Contact Data. Agreed: − Account data (admin log - in credentials and logs) deleted upon termination of account + 30 days for logs + 3 years for security logs) − Commercial Contact Data stored for 4 years. Customers can ask for different retention periods. DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 125 of 132 Clarify how long ESET retains the data available for admins as Detection, Management, Audit and Monitoring logs (for which admins can determine retention periods) Agreed, ESET has provided a description of data categories and retention periods in detail. Clarify if ‘aggregate’ data can still contain personal data, or data relating to a specific organisation, and what the retention period is (for authorised further processing purposes).

Definition included in Fwa. 6. Loss of control due to lack of transparency Security Event Data Consider disabling the LiveGrid Feedback function. Publish detailed technical documentation about the specific data processing via the two LiveGrid cloud services (Reputation and Feedback) that allows an auditor to assess if the descriptions match with observed data processing. ESET will update relevant documentation by the end of Q3 2026. ESET will allow customers to disable the LiveGrid feedback function by the end of Q3 2026. Commit to a hard deadline to remove the session ID from the Reputation data flow. Agreed and removed session ID. Opt - out from sharing Content Data in the form of files and crash dumps as part of LiveGrid Feedback. Explain the consequences for ESET’s data collection if an admin opts - out from providing Content Data as part of LiveGrid Feedback to ESET. ESET will update the button pop - up description for the LiveGrid Feedback function, with detailed explanation of what data are shared with ESET, by the end of Q3 2026. 7.

Re - identifiability of personal data through long or unspecified retention periods (SLM Rijk) after 1 or 2 years: conduct audits on compliance with retention periods Do not retain Account Data for 3 years after contract termination " unless ESET requires evidence in case of a dispute with the customer ". Agreed, to be implemented by end of Q3 2026 latest. Allow customers to decide on the maximum retention period for support tickets, for example 13 months (not 4 years). ESET will differentiate between support & complaint cases and will offer DIY delete function in the Service Hub for both support tickets and attachments by the end of Q3 2026. Explain different retention periods of operational and security logs. ESET has provided PC access to relevant samples and has provided detailed explanations. Explain what laws require ESET to retain which personal data, for how long. ESET has explained that it is required under Slovak cybercrime law (implementing NIS2) to retain security logs for 3 years.

Document the retention period of Website Data in for example webserver access logs. ESET retains the restricted Website access logs (Admin Console) for 90 days. Public Website data for 6 months. 8. Inability to exercise data subject right to access Website and Diagnostic Data (except for audit logs). Provide access to personal data in webserver access logs in reply to a DSAR. ESET shall implement templates for complete DSAR responses by the end of Q3 2026. Provide access to personal data about updates, do not refuse access without a valid appeal to a legal exception. Agreed. Inform customers that personal data such as IP addresses appear in ESET’s own security logs, and provide access where possible. ESET will document the existence and retention period of security logs and inform where necessary on it use of the exception to provide access (Art. 15(4) and 23(1) sub i of the GDPR), to protect its own internal security interests. 9.

Inability to exercise data subject right to delete, and loss of control, Support Data Allow admins to delete specific tickets and/or attachments. Agreed, ESET will develop DIY delete functionality in the Service Hub by the end of Q3 2026. Show a warning not to upload personal or confidential data or give government organisations a central option to prevent sharing of screenshots and attachments. Agreed, by the end of Q3 2026. Agree to only process aggregated data higher than tenant level from support tickets as authorised further processing purpose. Agreed in the DPA. 10. Loss of control: maze Commit to a specific deadline in ESET has unified the Privacy Policy and DPIA on ESET end point security services version 1.0 24 June 2026 Confidential Page 127 of 132 of different Privacy and Cookie Policies the near future to publish 1 uniform and consistent Privacy Policy and Cookie Policy. Cookie Policy for eset.com and eset.com/nl (redirected from eset.nl) Date policies and terms, and consistently provide access to previous version.

ESET will disclose the date of the publication of policies and terms and provide previous versions of services within the scope of the FWA by the end of 2026. Do not limit the documentation about the retention period of cookies to the expiry date, but include retention by ESET in for example its webserver access logs. ESET will complete the cookie documentation with relevant retention periods by the end of 2026. 11. Loss of control: incorrect cookie consent management Fix the bug with the Google advertising cookie. Fixed and confirmed via re - testing. Resolved. Commit to only set functional cookies, stop setting Google analytics cookies, and implement effective controls to prevent mistakes. Fixed and confirmed via re - testing. Resolved. 12. Loss of control: lack of separation restricted access and publicly accessible websites Commit to implement one single consent flow for all 5 relevant ESET websites, including eset.com for the legal information at the policy hub, or ensure that all necessary legal and technical information is available via the restricted access Admin Console, and ESET has become a data processor for the restricted access websites.

Agreed, ESET will create one single consent flow for all traffic generated from the two language versions for the Netherlands (English and Dutch) by the end of Q3 2026. 13. Loss of control through lack of transparency contents of webserver access logs Publish documentation about the technical contents of webserver access logs. Agreed, ESET will publish a link to a general description and documentation of webserver components being used, by the end of 2026. 14. Loss of confidentiality: Feedback Instruct admins not to provide Feedback. No measures necessary. No measures necessary. 15. Chilling effect use of available logs Include rules in the internal IT policy how the detections are No measures necessary. No measures necessary. for employee monitoring used, prevent negative assessments. 16. Loss of control: falsely flagged e - mails and files in quarantine Regularly check quarantined mails and files No measures necessary.