﻿STATEMENT REGARDING DATA PROCESSING FOR KASPERSKY MANAGED PROTECTION

Statement regarding data processing for Kaspersky Managed Protection (hereinafter “Statement”) relates to the computer program Kaspersky Endpoint Agent (hereinafter “Software”).
All terms used in this Statement have the same meaning defined in the End User License Agreement (EULA) under the clause “Definitions”.
The Statement along with the End User License Agreement for Software, in particular in the Section “Conditions regarding Data Processing” specifies the conditions, responsibilities and procedures relating to transmission and processing of the data, indicated in the Statement. Carefully read the terms of the Statement, as well as all documents referred to in the Statement, before accepting it.

When the End User activates the functionality of the Software related to data processing for Kaspersky Managed Protection, the End User is fully responsible for ensuring that the processing of personal data of Data Subjects is lawful, particularly, within the meaning of Article 6 (1) (a) to (1) (f) of Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”) if Data Subject is in the European Union, or applicable laws on confidential information, personal data, data protection, or similar thereto.

Data Protection and Processing
Data received by the Rightholder from the End User are handled in accordance with the Rightholder’s Privacy Policy published at: https://www.kaspersky.com/Products-and-Services-Privacy-Policy.

Purpose of Using the Functionality Related to Data Processing for Kaspersky Managed Protection
Use of the functionality related to data processing for Kaspersky Managed Protection could lead to increase the effectiveness of protection provided by the Software, against information and network security threats.
The declared purpose is achieved by:
•	determining the reputation of scanned objects;
•	identifying information security threats that are new and challenging to detect, and their sources;
•	taking prompt measures to increase the protection of the data stored and processed by the End User with the Computer;
•	investigating of infection of a user’s computer.

Processed Data
During use of the functionality related to data processing for Kaspersky Managed Protection, the Rightholder will automatically receive and process the following information about objects being processed, the Software used, and the environment where the Software is installed, and information about objects being processed in the compatible anti-virus software: 
•	Source ID of the event
•	Endpoint product installation ID
•	Software (endpoint application) customer license ID
•	Software customer license serial number
•	Full name of the object being processed
•	MD5 hash of the object being processed
•	MD5 hash calculation error code
•	KSN object info retrieval error code
•	Object access error code
•	Local file storage operation error code
•	File system object info
•	Name of the Computer
•	Command-line arguments passed to the process
•	Size of object (data in bytes)
•	List of the Computer network interfaces
•	Installed OS version
•	Software version
•	Time stamp of the anti-malware database
•	Last 12 bytes of the Computer security identifier (SID)
•	Software decision on the object being processed
•	Internal name of the Windows event
•	ID of the triggered anti-virus database record
•	Anti-virus protection mode
•	MD5 hash calculated from the Computer name
•	Time stamp of the event
•	Software action taken on detection
•	Error code for the Software action taken on detection
•	Reason code for the Software action taken on detection
•	Logged file operation code
•	Logged file operation flags
•	Source file path for file renaming operation
•	MD5 hash of the object calculated by using anti-rootkit technology
•	Auto-run (startup) location
•	Notification type numeric ID;
•	Notification subtype numeric ID
•	Executable file path for the current process
•	MD5 hash of the executable file for the current process
•	MD5 hash of the executable file calculation error code for current process
•	Type of object (file data or file path) added to the local storage for additional processing
•	Local IPv4 address
•	Second part of the local IPv6 address in numerical form
•	First part of the local IPv6 address in numerical form
•	Zone index of the local endpoint IPv6 address
•	Local port number
•	Remote IPv4 address
•	Second part of the remote IPv6 address in numerical form
•	First part of the remote IPv6 address in numerical form
•	Zone index of the remote endpoint IPv6 address
•	Remote port number
•	Direction of network connection (inbound/outbound)
•	System-provided process identifier (PID) for the process
•	User account security identifier (SID) for the process
•	Logon session identifier for the process
•	Integrity level for the actor process
•	Unique process identifier for the process
•	System-provided process identifier (PID) for the parent process
•	Unique process identifier for the parent process
•	Executable file path for the parent process
•	Logon session type for the process
•	MAC address of the detected network attack source
•	Network protocol used in the detected network attack
•	Name of the registry key being processed
•	Name of the created or modified registry value
•	Type of the created or modified registry value
•	Content of the created or modified registry value
•	Type of the modified registry value before modification
•	Content of the modified registry value before modification
•	Time stamp of the last write operation for the registry key
•	Unique identifier of the logon session
•	Account name of the security principal that owns the logon session
•	Name of the domain used to authenticate the owner of the logon session
•	DNS name for the owner of the logon session
•	Type of the logon session
•	Name of the authentication package used to authenticate the owner of the logon session
•	Name of the server used to authenticate the owner of the logon session
•	User principal name (UPN) for the owner of the logon session
•	Security identifier (SID) of the owner of the logon session
•	MD5 hash of Kerberos ticket data
•	Name of the account or computer for which the ticket was requested
•	Name of the Kerberos Realm that Server Name belongs to
•	User Principal Name (UPN) of the account that requested the ticket
•	Name of the Kerberos Realm that Client Name belongs to
•	Cryptographic suite that was used for issued Kerberos ticket
•	Mask of Kerberos ticket flags, in hexadecimal format
•	Time at which Kerberos ticket was issued
•	Time at which Kerberos ticket expires
•	Final ticket expiration date (beyond which the ticket cannot be renewed)
•	Cryptographic suite that was used for Kerberos session key
•	Binary mask of Kerberos ticket cache options
•	Name of the domain controller used to issue Kerberos ticket
•	Command-line arguments for the process
•	Binary mask of the user account properties for the process
•	MD5 hash of the executable file for the parent process
•	MD5 hash of the executable file calculation error code for the parent process
•	User account security identifier (SID) for the parent process
•	Logon session identifier for the parent process
•	Integrity level for the parent process
•	Logon session type for the parent process
•	Binary mask of the user account properties for the parent process
•	Command-line arguments for the parent process
•	Software action taken on detection: the Web Anti-Malware component 
•	Full path to the last document opened by the third-party software
•	Time stamp of the last document open operation by the third-party software
•	Type of performed DNS query
•	Binary mask of options of the performed DNS query
•	Operating system error code for the DNS query operation
•	DNS query response
•	DNS server being queried
•	Call stack for the thread
•	Unique identifier of the activity log for the process that generated the event
•	Name and/or address of the code injection location
•	Access rights for the process open operation
•	Name of the created/modified Windows service
•	List of Windows services hosted in the actor process
•	Type of the created/modified Windows service
•	Start type of the created/modified Windows service
•	Time stamp of the behavior detection Software database
•	Full name for the object parsed from the process command line
•	MD5 hash for the object parsed from the process command line
•	MD5 hash calculation error code for the object parsed from the process command line
•	List of file packers that the object is packed with
•	Event-specific error code
•	Version of the System Watcher component of the Software
•	Software update source;
•	Flags indicating that the Software is launched in the Rightholder internal test environment
•	Incremental event sequence number
•	Time stamp when object was added to the local storage for additional processing
•	Digital signature verification flags mask for the executable file of child process
•	URL from where the child process executable file was downloaded
•	Path to the executable file of the process that downloaded the child process executable file
•	Time stamp of the last modification operation for the file
•	Path to the file’s modifier process executable file
•	First time that the executable file was launched
•	Total number of executions of the executable file
•	Information about the organization that signed the file
•	MD5 hash of the executable file for the process that downloaded the file
•	MD5 hash of the file’s modifier process executable file data
•	File format ID
•	Company name value from the VERSIONINFO resource
•	Product name value from the VERSIONINFO resource
•	Security zone identifier extracted from the Zone.Identifier NTFS stream
•	Referrer value from the HTTP request headers
•	User-Agent value from the HTTP request headers
•	Description value from the VERSIONINFO resource
•	Original file name value from the VERSIONINFO resource
•	Customer description from the license info file
•	Auto-run object type
•	Namespace name for the Windows Management Instrumentation (WMI) event consumer
•	Name of the filter used by the WMI event consumer
•	Name of the created WMI event consumer
•	WMI event consumer source code
•	HTTP request method
•	Raw HTTP request header
•	List of installed OS updates with update names and installation dates

Your Choice to Participate
Providing the above information to Kaspersky Managed Protection is voluntary. After installing the Software, the End User can at any time enable or disable the use of this functionality in the Software settings as described in the User Manual.

© 2018 AO Kaspersky Lab