KELA Privacy Policy
Last Revised: August 2026
1. Introduction and Commitment to Regulatory Compliance
Kela Research and Strategy Ltd. (“us”, “we”, “the Company” or “Kela”) is a leading private company specializing in the provision of cyber threat intelligence solutions, primarily serving organizations and governments across various industries. We are the owner and operator of the website: https://www.kelacyber.com/.
Kela is committed to protecting the privacy of Users who access, visit, use, or otherwise interact with our KELA cyber threat intelligence platforms, our corporate website and associated marketing, sales and business activities (collectively, the “Services”).
This Privacy Policy explains how KELA collects and processes Personal Data. By using the Website, including the services provided by the Company, you acknowledge that you have read and understood this Privacy Policy. Where applicable law requires your consent for any new processing activity, KELA will obtain such consent separately before commencing that processing.
We may update this Privacy Policy from time to time. Where required by applicable law, we will provide appropriate notice before material changes become effective. Your continued use of the Services after such updates constitutes your acknowledgement that you have been informed of the updated Privacy Policy. Where consent is required by applicable law, KELA will obtain such consent separately.
The Company collects and processes Personal Data relating to its clients and Website users in accordance with all applicable laws and regulations governing its activities, as further described in this Privacy Policy.
Personal Data is processed solely for specified, explicit, and legitimate purposes, including, without limitation, the provision and management of the Company’s services, the creation and administration of user accounts, the performance of contractual engagements with clients, the provision of client support and responses to inquiries, ensuring the security of the Website and the Company’s services, preventing fraud and misuse, complying with legal obligations, improving and developing the Company’s services, and sending marketing communications, where permitted by applicable law and based on the applicable legal basis, including the user’s consent where required.
Personal Data is processed, as applicable, on the basis of the performance of a contract with the user, compliance with a legal obligation, the legitimate interests of the Company or a third party, where applicable, or the user’s consent where such consent is required by applicable law.
Additional information regarding the categories of Personal Data collected, the purposes of processing, the applicable legal bases for processing, the recipients or categories of recipients of Personal Data, data retention periods, international data transfers (where applicable), and the rights of data subjects is set out in this Privacy Policy.
KELA maintains a robust security posture, evidenced by its existing ISO 27001:2022 certification. This Privacy Policy is designed to comply with applicable data protection laws, including the General Data Protection Regulation (EU) 2016/679 (the “GDPR”), where applicable.
2. KELA’s Role and Scope of Data Processing
2.1. KELA as a Data Controller
KELA’s role as a Data Controller or Data Processor depends on the nature of the Services provided and the purposes for which Personal Data is processed. KELA may act either as a Data Controller or as a Data Processor under applicable data protection laws, including the GDPR.
KELA acts as a Data Controller when determining the purposes and means of processing Personal Data, including in connection with our corporate website, marketing and sales activities, support services and the operation of our proprietary cyber threat intelligence services.
KELA acts as a Data Controller with respect to:
- The collection, analysis, enrichment, and management of cyber threat intelligence data that supports the operation and continuous improvement of KELA’s products and services.
- Marketing, sales, and business development activities, including the operation of our corporate website, lead generation, event registrations, and communications with prospective and existing clients.
2.2. KELA as a Data Processor
In its B2B services, KELA acts as a Data Processor when processing end-user Personal Data on behalf of its corporate clients in connection with the provision of its SaaS platforms and related services. In such cases, KELA processes Personal Data solely in accordance with the client’s documented instructions, as set out in the applicable Data Processing Agreement (DPA).
3. Information Collected for Sales, Marketing, and Intelligence
When you interact with our website or services, we may collect information associated with you (“Personal Data”). For the purposes of this Privacy Policy, “Personal Data” has the meaning assigned to it under Article 4(1) of the GDPR.
When you interact with our Website or Services, we may collect the following categories of Personal Data:
Information Provided by Users (PII)
This information is voluntarily provided when you register for services, sign up as a potential client or partner, or communicate with us.
This includes Contact Information such as your full name, email address, phone number, company name, job title, and any other information you agree to share.
We also collect Voluntary Information, such as feedback and suggestions that you send to us.
Device Information and Website Analytics
We collect technical information from your device, which may include geolocation data, IP address, unique identifiers, browser type, and activity logs (clicks, actions) to enhance service functionality.
We utilize analytics tools (like Google Analytics) to collect information on how often users access the Services to improve our offerings. While these tools collect the IP address assigned to you, this information is not combined with personally identifiable information.
Cyber Intelligence Data (Core Intellectual Property)
As part of our core service activity, KELA collects and analyzes Personal Data from publicly available and open sources, including certain online forums and communities, to identify, verify, correlate, and assess cyber security threats relevant to its clients’ designated assets, domains, or other identifiers for the purpose of protecting our clients from cyber threats.
KELA’s cyber threat intelligence platform, methodologies, analytics, and enrichment capabilities constitute part of KELA’s proprietary intellectual property.
Any processing of Personal Data forming part of these activities is carried out solely on the applicable lawful basis under the GDPR and does not limit or override the rights of Data Subjects under applicable data protection laws.
4. Purposes of Processing and Lawful Basis (GDPR)
We process only when we have a valid lawful basis under GDPR Article 6.
A. Cyber Threat Intelligence Delivery (Core IP)
Processing this data is based on KELA’s Legitimate Interests (Article 6(1)(f)). This processing is crucial for KELA’s core mission: preventing cybercrime, fraud, and protecting client assets.
Where KELA processes Personal Data under Article 9 GDPR, such processing will be carried out only where an appropriate lawful basis and any additional conditions required under applicable data protection law are satisfied.
KELA applies appropriate technical and organizational measures to ensure that such processing is limited to what is necessary and proportionate for the relevant cybersecurity purposes.
B. Sales, Marketing, and Lead Generation
We use contact and device information to respond to inquiries, provide support, and send promotional communications.
The basis relies on either explicit Consent (Article 6(1)(a)), particularly where required for marketing offers (OPT-IN), or our Legitimate Interests for communication with existing clients or business partners.
C. Client and Vendor Management
We process contact information to manage contractual engagements, perform client service agreements, and process payments.
This processing is necessary for Contractual Necessity (Article 6(1)(b)).
D. Security and Legal Compliance
We use information to detect and prevent fraudulent and illegal activity, enforce our policies, investigate violations, establish legal rights, prevent harm, and comply with subpoenas or government requests.
This processing relies on our Legal Obligation (Article 6(1)(c)) or Legitimate Interests.
5. Data Retention and Intellectual Property
KELA adheres to the principle of Storage Limitation (Article 5(1)(e) of the GDPR) and applies retention periods based on the nature of the Personal Data and the purposes of processing.
Cyber Intelligence Data (Core IP) is retained only for as long as necessary to fulfil the purposes for which it was collected, including KELA’s legitimate cybersecurity research activities, the maintenance and continuous improvement of its cyber threat intelligence repository, the prevention of cybercrime, or to comply with applicable legal obligations.
Personal Data is retained only for as long as necessary to fulfil the purposes for which it was collected or to comply with applicable legal obligations, unless a longer retention period is required for security investigations.
Further details regarding retention periods applicable to client data processed on behalf of clients are governed by the applicable Data Processing Agreement (DPA), where relevant.
6. Information Sharing and International Data Transfers
We do not rent, sell, or share your Personal Data with third parties except as necessary to provide the Services or comply with legal obligations.
We may share Personal Data with our subsidiaries, affiliated companies, subcontractors, and other third-party service providers (e.g., cloud computing providers). This sharing is for purposes such as storing or processing information on our behalf, assisting with business operations, performing research, technical diagnostics, and analytics.
We may also disclose Personal Data if we have a good faith belief that disclosure is necessary to comply with applicable law, regulation, legal process, governmental request, enforce our policies, investigate wrongdoing, or enforce intellectual property or other legal rights.
KELA ensures that data transfers outside the EU comply with Chapter 5 GDPR requirements, utilizing mechanisms like Adequacy Decisions or Standard Contractual Clauses (SCCs).
KELA currently primarily transfers Personal Data to and from Israel, which has been granted an adequacy decision by the European Commission under Article 45 GDPR, meaning such transfers are lawful without requiring additional transfer mechanisms.
7. Data Security and Compliance Commitments
KELA implements and maintains appropriate technical and organizational measures in accordance with Article 32 of the GDPR, designed to protect the confidentiality, integrity, and availability of the Services and the Personal Data processed through them.
KELA maintains an information security management system certified to ISO/IEC 27001:2022.
We employ industry standard procedures and administrative measures, including the restriction of access to Personal Data to authorized employees and contractors who are bound by confidentiality obligations. Access to sensitive services uses strong authentication methods.
8. Your Rights as a Data Subject (GDPR)
KELA is committed to upholding the rights of data subjects defined in GDPR Chapter 3. You may contact us at any time to exercise the following rights:
- Right of Access (Article 15): To obtain confirmation of processing and access to your data.
- Right to Rectification (Article 16): To correct inaccurate or incomplete Personal Data.
- Right to Erasure (“Right to be Forgotten”) (Article 17): To request the deletion of your Personal Data under certain conditions.
- Right to Restriction of Processing (Article 18): To request limitations on how we process your data under certain conditions.
- Right to Data Portability (Article 20): To receive your Personal Data in a structured, commonly used format.
- Right to Object (Article 21): To object to the processing of your Personal Data.
Limitation on the Right to Erasure
KELA will assess each request for erasure in accordance with Article 17 of the GDPR.
In certain circumstances, KELA may be required or entitled to retain Personal Data where an applicable exception under Article 17(3) applies, including, where relevant, compliance with a legal obligation, the establishment, exercise or defense of legal claims, or any other applicable legal exception under the GDPR.
Any refusal of an erasure request will be assessed on a case-by-case basis and communicated to the Data Subject where required by applicable law.
9. Cookies Consent
The website uses cookies and similar tracking technologies.
Essential cookies are processed on the basis of legitimate interests or necessity or where they are strictly necessary for the operation of the website and the provision of the requested services, including for user authentication, user identification, fraud prevention, and information security purposes.
The use of non-essential cookies and tracking technologies, such as Meta Pixel and Google Analytics, is subject to the user’s consent, in accordance with applicable law, for the purposes of performance measurement, improving the user experience, and marketing.
The user may choose whether to provide such consent, decline it or modify their cookie preferences, and may withdraw their consent at any time by adjusting the browser settings under the Cookies section or by using the cookie management tools available on the website (the cookie banner), without affecting the lawfulness of processing carried out prior to the withdrawal of consent.
10. Applicability of Israeli Privacy Law
In addition to GDPR, KELA’s processing of Personal Data is subject to the Israeli Privacy Protection Law, 5741-1981, as amended, including Amendment No. 13 and the regulations enacted thereunder, including the Privacy Protection Regulations (Data Security), 5777-2017.
Israeli residents may exercise their rights under Israeli law by contacting us at privacy@ke-la.com.
11. Minors, Policy Updates, and Contact
The Services are not designated for individuals under the age of 16. If you are under 16 years old, you should not use the Services or provide any Personal Data to us.
We may revise this Privacy Policy from time to time, and the most current version will always be posted on our website (as reflected in the “Last Revised” heading).
If you have any general questions regarding the Services or the information we collect, please contact us.
If you wish to raise a complaint about how we have handled your Personal Data, please contact us directly. If you are not satisfied with our response or believe we are collecting or processing your Personal Data not in accordance with the laws, you can complain to the applicable data protection authority.
Data subjects may also lodge a complaint with their competent supervisory authority in the jurisdiction applicable to them. Israeli residents may also contact the Israeli Privacy Protection Authority (PPA).
Privacy queries: privacy@ke-la.com
Information about us:
Kela Research and Strategy Ltd.
52 Menahem Begin Street (24th Floor – Sonol Building)
Tel Aviv, Israel.