Notice to employees: security monitoring of our accounts and computers

1. Who is responsible

[Company name, address] is responsible for this monitoring (controller). Contact for questions: [name, email].

We use the service Ojava (Ojava, Dhanush Kalyan Guntaka, Geneva, Switzerland) to do it on our behalf (processor).

2. Why

To detect attacks on our company accounts and computers, such as a stolen password, a hijacked mailbox, ransomware or malware, and to alert [who receives the alerts]. The monitoring is for security only. It is not used to assess your work, your performance or your behaviour.

3. What is collected

• Microsoft 365 / Google Workspace [delete what we do not use]: sign-in events (time, IP address, approximate location, device), changes to sign-in methods, mailbox rules and forwarding, app permissions, administrative actions, files shared outside the company and file downloads, without their content.
• Windows PCs [delete if not used]: Windows security events, the names, paths and command lines of programs that start, the type of folder and the extension of changed files (not their names), the addresses of network connections, programs that start automatically, security settings and the PC's name. Windows also keeps, on the PC itself, a local record of which program changes files in your user folders; the PC's administrators can see it, and it is not sent to Ojava.
• Never collected: the content of emails, documents, files or chats, browsing history, keystrokes or the screen.

4. Who sees it

[Names or roles, for example the managing director and our IT provider] see the alerts. Ojava processes the data in Switzerland (Geneva). To explain an alert in plain language, Ojava sends its details to its AI provider Anthropic (USA) with names, email addresses, IP addresses and PC names replaced by placeholders.

5. How long

Sign-in and activity events: 90 days. Raw events from PCs: 30 days. An alert, with the details it is based on, is kept until it is closed and then for [3 months / 2 years / 5 years, depending on our Ojava plan].

6. Your rights

You can ask us what data about you is processed, have it corrected, and object to processing, by writing to [contact]. You can also complain to the Federal Data Protection and Information Commissioner (FDPIC) or, in the EU, to your data protection authority.

[If applicable: our employee representatives / works council were consulted on (date).]