As of September 2026
PasswordPing Ltd. d/b/a Enzoic and its affiliates (collectively, “Enzoic,” “PasswordPing,” “we,” “us,” or “our”) developed this Privacy Policy to explain how we collect, use, share, and protect Personal Information (defined below), and your choices about the collection and use of Personal Information.
This Privacy Policy applies to Personal Information collected or processed through our services, solutions, websites, applications, and platforms that link to this Privacy Policy (collectively, the “Service”). This Privacy Policy does not govern other websites to which we may provide links, because Enzoic is not responsible for, and cannot control the privacy practices or content of, those websites. Acceptance of this Privacy Policy, as updated from time to time, is a condition of
your use of our Services, and you agree to be bound by this Privacy Policy if you use our Services.
Personal Information” is information that, either alone or in combination with other information, identifies you. Examples of Personal Information include, among others, name, email address, phone number, mailing address, Social Security number, date of birth, credit card information, or other account or payment information. In addition, we may obtain information about you from other third parties in connection with providing you with the products or services that you request and to help us better serve our customers. For example, we may obtain information about you from sources such as public record vendors, technology providers, the Internet and other sources. When we combine Personal Information with other information (i.e., information that does not, on its own, identify you), we treat the combined information as Personal Information.
This Privacy Policy applies to all Personal Information collected or processed by Enzoic (PasswordPing Ltd. d/b/a Enzoic), a Colorado-based company operating entirely remotely and offering services worldwide.
It applies to Personal Information collected through our websites, platforms, applications, and services that link to or reference this Privacy Policy (collectively, the “Services”). This Policy is designed to comply with applicable data privacy laws including the Colorado Privacy Act (CPA), California Consumer Privacy Act (CCPA/CPRA), and the EU General Data Protection Regulation (GDPR), as well as other international privacy frameworks where relevant.
We collect and use Personal Information in various ways depending on the context and the particular Service. As part of the standard operation of our Services, we may collect Personal Information (1) provided by you; (2) from public record vendors, technology providers, the Internet and other sources; and (3) automatically through your use of our Services, including cookies. We use Personal Information about you to provide products and services to you, to verify your identity, and to protect against fraud. We also use this information for our everyday business purposes, such as quality assurance and testing; to process your transactions and communicate with you; maintain your account; respond to court orders and legal investigations; or interact with our service providers. In each case, we only collect and use a limited amount of Personal Information as necessary to provide the Services to you.
Where required by law (such as under the GDPR), we only process your Personal Information when we have a legal basis to do so, including:
Our Services may use automated processing to evaluate whether a submitted credential matches a known-compromised credential, or to generate a risk score or similar output for a Business Customer. We do not use automated processing to make decisions that produce legal or similarly significant effects concerning you without appropriate human involvement, except as permitted by and consistent with applicable law. Where required by law — including the GDPR and, beginning January 1, 2027, California’s automated decision-making technology regulations — we will provide additional information about, and rights relating to, this processing upon request.
In order for you to use our Services, we collect your name, email address, and log-in credentials. We may also collect your social security number, physical address, and other Personal Information. We use this information to provide the Services, to enable to you to securely log in to the Services, to send you Service-related notifications, and to administer your account.
When you use the Services, we keep logs relating to your activity on the Services (including, among others, changes you make to your account or configuration settings, features and functions you access within the Services, URLs within the Services you visit, device and browser information, approximate geographic location of your device, and IP address) in order to help detect potential unauthorized use of your account, maintain and improve the Services, and troubleshoot problems.
We and our service providers use cookies and similar tracking technologies (such as pixels and local storage) on our websites and Services, including: (i) Strictly Necessary Cookies, required to operate the Services and maintain a secure log-in session; (ii) Functional Cookies, which remember your preferences; and (iii) Analytics Cookies, which help us understand how visitors use our websites.
Most Internet browsers automatically accept cookies. You can decline non-essential cookies using your browser settings or, where available, our cookie-preference tool; declining Strictly Necessary Cookies may prevent you from logging into or using the Services.
We honor opt-out preference signals, including the Global Privacy Control, as a valid request to opt out of the sale or sharing of Personal Information and targeted advertising to the extent required by applicable law — including the Colorado Privacy Act’s universal opt-out mechanism requirement (in effect since July 1, 2024) and the CCPA/CPRA.
None of our products and services or websites is designed for use by minors under the age of 18. We do not direct our Services to, nor do we knowingly collect any Personal Information from, children. If we become aware that a child has provided us with Personal Information, we take commercially reasonable steps to remove such information. If you are under 18 years old, please do not submit any Personal Information to us. We may collect information from our adult consumer customers or guardians about their children if relevant to the product or service being offered.
We only share your Personal Information with third parties for the purposes described in this Privacy Policy and:
We maintain a list of our current sub-processors, which can be provided upon request.
We do not sell Personal Information to third parties for money.
To the extent we engage in any activity that constitutes a “sale” or “share” of Personal Information as those terms are defined under applicable law, you may opt out as described in the “Your Privacy Rights” section below. When we process Personal Information on behalf of a Business Customer as a service provider or processor (see “Our Role and the Categories of Data We Process” above), we do so only under a written agreement and only for the purposes directed by that Business Customer, and we do not sell or share that information.
We take reasonable physical, electronic, contractual and administrative steps to protect the confidentiality, security and integrity of your personally identifiable information. However, no method of transmission over the Internet or method of electronic storage is completely secure, and we cannot guarantee its absolute security. Please notify us immediately at info@enzoic.com of any actual or suspected unauthorized use or breach of security with respect to our Services.
Further, while we attempt to ensure the integrity and security of Personal Information, we cannot guarantee that our security measures will prevent third parties such as so-called hackers from illegally obtaining access to Personal Information. We do not represent or warrant that Personal Information about you will be protected against, loss, misuse, or alteration by third parties.
If we become aware of a breach of security affecting Personal Information for which we act as a business or controller, we will notify affected individuals and/or regulators as required by applicable law, including applicable U.S. state breach-notification statutes and, where applicable, Articles 33 and 34 of the GDPR. If we act as a service provider or processor with respect to affected Personal Information, we will notify the applicable Business Customer without undue delay under our agreement with that customer, and that Business Customer will be responsible for notifying affected individuals as required by law.
We retain Personal Information for as long as necessary to provide the Services, maintain your account, and fulfill the purposes described in this Policy, and thereafter for the additional period needed to comply with our legal obligations, resolve disputes, enforce our agreements, and maintain appropriate business records. In determining retention periods, we consider the amount, nature, and sensitivity of the Personal Information, the purposes for which we process it, and applicable legal requirements.
Your rights relating to Personal Information, and how to exercise them, are described in the “Your Privacy Rights” section below.
We do not permit third parties to track Service users, in personally identifiable form, over time and across third-party websites for cross-context behavioral advertising purposes.
As described above, we honor the Global Privacy Control and other recognized universal opt-out mechanism signals as valid opt-out requests where required by applicable law.
We use globally-hosted Services and our data is stored in the United States of America. In order for us to provide the Services to you, it will be necessary for us to process and store Personal Information you provide to us in the United States of America and in other facility locations, which may have different data protection laws than those in the country in which you reside. By using the Services, you are consenting to the transfer of your Personal Information to facilities located in the United States and other facility locations selected by us.
Depending on your location and applicable law, you may have the following rights regarding your Personal Information:
We will respond to verifiable requests within the time required by applicable law (generally within 45 days, which we may extend by an additional 45 days when reasonably necessary, with notice to you).
To exercise any of these rights, please contact us at info@enzoic.com.
NOTICE CONCERNING YOUR COLORADO PRIVACY RIGHTS: “If you are a resident of Colorado, you have the right to withdraw your consent to our processing of your personal data at any time. Upon receiving your request, we will cease processing your data within 15 days. To withdraw consent, please submit a request through our support team info@enzoic.com.
If you are a California resident, you have the right to:
You can exercise these rights by contacting us at privacy@enzoic.com.
We do not knowingly sell or share personal data of individuals under 16 years of age.
In the preceding twelve (12) months, [Enzoic’s privacy/legal team to confirm and state whether Enzoic has sold or shared Personal Information as those terms are defined under the CCPA/CPRA]. The categories of Personal Information we collect, and our purposes for collecting, using, and disclosing each category, are described in the “Personal Information” and “Our Role and the Categories of Data We Process” sections above.
If you exercise a right under the CCPA/CPRA, we may ask you to verify your identity before completing your request. You may also designate an authorized agent to submit a request on your behalf, subject to our ability to verify the agent’s authority and your identity. If we deny your request, you may appeal by contacting us at privacy@enzoic.com; if we deny your appeal, you may submit a complaint to the California Privacy Protection Agency or the California Attorney General.
NOTICE CONCERNING YOUR CALIFORNIA PRIVACY RIGHTS: If you are a California resident, in addition to other rights provided to you under other laws and under this Privacy Policy, California Civil Code Section 1798.83 permits you to request information regarding the disclosure of Personal Information about you by Enzoic to third parties for the third parties’ direct marketing purposes. To make such a request, please send an email to info@enzoic.com.
If you are a resident of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland, Kentucky, Rhode Island, Indiana, Tennessee, or another U.S. state with a comprehensive consumer privacy law, you may have rights similar to those described above, including the right to access, correct, delete, and obtain a portable copy of your Personal Information; to opt out of targeted advertising, the sale of Personal Information, and (in some states) certain profiling; and to appeal a denied request. To exercise these rights, contact us as described in the “Contact Us” section below. We will not discriminate against you for exercising these rights.
Nevada residents may direct us not to sell certain “covered information” as defined under Nevada law (NRS 603A). Enzoic does not sell covered information as defined by Nevada law; if this changes, Nevada residents may submit a request to opt out by contacting us as described below.
If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the rights described in the “Your Privacy Rights” section above, as well as the right to lodge a complaint with your local data protection supervisory authority.
Our Services are operated from the United States, and your data may be transferred to and stored in the U.S. or other jurisdictions.
Where required by law (e.g., under GDPR), we use appropriate safeguards such as Standard Contractual Clauses (SCCs) when transferring data outside of the EEA or UK to ensure your information remains protected.
We may revise and update this Privacy Policy from time to time and will post the updated Privacy Policy to the Services. If these changes are material (i.e., changes we believe you will find important), we will post notice of the changes on the website we maintain in connection with the Services. To the extent required by applicable law, we will obtain your consent. Unless otherwise indicated, any changes to this Privacy Policy will apply immediately upon posting to the Services.
If you have any questions about this Privacy Policy, our practices, our Services, or dealings with the Company, please send us an email at info@enzoic.com or contact us by mail at Enzoic PO Box 20896, Boulder, CO 80308.
To protect your Personal Information, we may need to verify your identity before completing certain requests, which may require you to provide additional information.