Effective date: 1 October 2026. This policy replaces the version effective 1 September 2018.
Athena Security, Inc. (“Athena”, “we”, “us”) is the controller of the personal data described in this policy, except where Section 1.2 says otherwise. Our registered address is 248 Addie Roy Rd. C101, Austin, Texas 78746, United States. You can reach our privacy team at [email protected].
This policy applies to athena-security.com and its subdomains (including ai.athena-security.com, support.athena-security.com and status.athena-security.com), to the Athena Compliance Platform (our cloud platform), to the Athena Weapons Detection System Alert App and to our other mobile apps, and to the hardware we deploy on customer sites: the Apollo 500 weapons detection system, the AI X-ray A and C Series, and related screening products.
It is written to meet the EU General Data Protection Regulation (GDPR), the UK GDPR and the Data Protection Act 2018, and it also describes rights available under US state privacy laws (Section 10). Where a term such as “personal data” or “processing” is used, it has the meaning given in the GDPR.
1.1 When Athena is the controller
We decide how and why personal data is processed when you visit our website, contact us, request a demo, apply for a job, sign up for a trial, buy from us, or open a support ticket. For that data, Athena is the controller and this policy applies in full.
1.2 When Athena is a processor
When a hospital, school, government body, venue or other organization (a “Customer”) uses our products to screen people entering its premises, that Customer decides what is captured, how long it is kept and who may see it. The Customer is the controller of that screening data (such as alert images, incident records and visitor check-in records), and Athena processes it only on the Customer’s documented instructions under a data processing agreement that meets Article 28 GDPR.
If you were screened at a Customer site and want to exercise your rights over that data, please contact the organization that operates the site; it holds your data and controls it. We will help the Customer respond to you, and if you contact us directly we will pass your request to the right Customer within five business days. Sections 5 to 8 describe how we protect that data on the Customer’s behalf.
We collect only the data needed for the purpose you came to us for. We do not collect personal data about you unless you provide it, our systems record it automatically as described below, or a Customer provides it to us so that we can deliver our services.
2.1 Data you give us
When | What we collect |
|---|---|
Website forms, demo requests, downloads | Name, work email, company, job title, phone number, country, and anything you write in a message field |
Platform accounts (Athena Compliance Platform, mobile apps) | Name, work email, role, organization, login credentials, multi-factor authentication details, and the settings you choose |
Support tickets and remote-view sessions | Contact details, ticket content, and screen or log data you choose to share with our support team |
Purchases and contracts | Billing contact, invoicing address, purchase order details; payment card data is handled by our payment processor and is not stored by Athena |
Job applications | CV, cover letter, contact details and anything else you submit |
Phone, email and chat (including Ask Athena) | The content of the conversation and your contact details |
2.2 Data collected automatically
When you use our website or platform, our servers and analytics tools record your IP address, browser type and version, device and operating system, pages viewed, time of access, referring site and approximate location derived from your IP address. Our platform also keeps audit logs of every login and every action taken in an account; these logs are a core security feature and Customers can see all of them. Section 4 explains cookies.
2.3 Data we process for Customers
Depending on how a Customer configures its system, our products may process: images captured when a possible weapon is detected (the person and the item); incident records whose fields the Customer defines (often a name, a description of what happened and the images); visitor check-in records in our visitor management app, which may include a visitor’s name, contact details, identification details, the patient or person being visited and, in healthcare settings, protected health information; and operator and staff accounts. Our products can run without capturing or storing any image at all, and the Customer decides which fields exist, whether images are kept and for how long.
Where a healthcare Customer’s records include protected health information under the US Health Insurance Portability and Accountability Act (HIPAA), Athena acts as the Customer’s business associate under a business associate agreement, in addition to the data processing agreement described in Section 1.2.
Some of this data may reveal special categories of personal data under Article 9 GDPR, for example an image that shows a person’s apparent health, religion or ethnicity. We do not analyze or use such data for any purpose; it exists only because an image was captured. The Customer, as controller, is responsible for the Article 9 condition it relies on, and our data processing agreement records that.
2.4 Data from other sources
We may receive your business contact details from a channel partner or reseller who introduces you to us, from publicly available sources such as your employer’s website or LinkedIn, and from an event organizer when you visit our stand. We do not buy marketing lists.
Under Article 6 GDPR we need a lawful basis for every use of personal data. The table below lists each purpose and the basis we rely on. Where we rely on legitimate interests, you can ask us for the balancing assessment we carried out, and you can object (Section 8).
Purpose | Data used | Legal basis |
|---|---|---|
Answer your enquiry, schedule a demo, send a quote | Contact details, message content | Pre-contract steps at your request (Art. 6(1)(b)); legitimate interest in responding to business enquiries where you act for an organization |
Create and run your platform or app account | Account data, audit logs | Performance of the contract with you or your organization (Art. 6(1)(b)) |
Deliver, support and maintain our products for Customers | Customer-controlled screening data | Processor acting on the Customer’s instructions (Art. 28); the Customer holds the Art. 6 basis, usually public task or legitimate interest in site safety |
Provide technical support, including remote view | Ticket content, screen data you share | Contract (Art. 6(1)(b)); remote view takes place only after your in-product approval and with an on-screen indicator |
Keep our systems secure, detect and investigate misuse | IP address, logs, account data | Legitimate interest in network and information security (Recital 49) and legal obligation to secure personal data (Art. 32) |
Invoice and collect payment, keep accounting records | Billing data | Contract (Art. 6(1)(b)) and legal obligation (tax and accounting law) |
Send product news and marketing to business contacts | Name, work email, company | Consent (Art. 6(1)(a)) for EU and UK contacts; we do not send unsolicited marketing email to the EU or UK. Legitimate interest in business-to-business marketing elsewhere |
Measure how our website is used, improve it, and measure advertising | Analytics and advertising cookies, usage data | Consent (Art. 6(1)(a)) through our cookie banner; strictly necessary cookies rely on legitimate interest |
Assess your job application | Application data | Pre-contract steps (Art. 6(1)(b)) and legitimate interest in recruiting |
Comply with law, respond to lawful requests, defend legal claims | Any relevant data | Legal obligation (Art. 6(1)(c)) and legitimate interest in protecting our rights |
We never use Customer alert images, incident records or visitor records to train or improve our detection models, and we never sell personal data.
If we need to use your data for a purpose not listed here, we will tell you first and, where the law requires it, ask for your consent.
Our website sets cookies only after you choose them in the consent banner, except for strictly necessary cookies that make the site work. You can change your choice at any time through the “Manage consent” link in the footer, and declining optional cookies does not stop you from using the site.
Category | What it does | Set without consent? |
|---|---|---|
Strictly necessary | Keeps you logged in, remembers your cookie choice, protects forms against abuse | Yes |
Preferences | Remembers settings such as language | No |
Statistics | Google Analytics measures pages visited, time on site and traffic sources, with IP addresses truncated | No |
Marketing | Google Ads conversion tracking, LinkedIn Insight Tag and Meta Pixel measure whether our advertising brought you here and may show you Athena advertising on those platforms. Each provider’s own privacy policy governs what it does with the data | No |
Our platform and mobile apps use only the session and security tokens needed to keep your account signed in and protected.
Most browsers let you block or delete cookies in their settings. If you block strictly necessary cookies, parts of the website and platform will not work.
We do not sell, rent or lease personal data, and we do not share it with third parties for their own marketing. We share personal data only with the recipients below, each bound by contract to use it solely to provide services to us.
5.1 Our processors (sub-processors for Customer data)
Recipient | Purpose | Location |
|---|---|---|
Linode (Akamai Technologies) | Hosting of the Athena Compliance Platform, apps, databases (incident records, visitor records and any personal or health data they contain), logs, reports and backups | Frankfurt and Amsterdam (EU) and London (UK) data centers for EU and UK Customers; US data centers for all others |
Amazon Web Services (AWS) | Storage of encrypted alert images only | EU regions for EU and UK Customers; US regions for all others |
Apple (Apple Push Notification service) | Delivery of alert notification links to iOS devices (login-protected links only, no images or personal data in the message) | United States |
Google (Firebase Cloud Messaging) | Delivery of alert notification links to Android devices (login-protected links only, no images or personal data in the message) | United States |
Google Workspace (Gmail) | Sending email notifications, reports and correspondence | United States and EU |
Freshworks (Freshdesk) | Support ticketing at support.athena-security.com | United States and EU |
Payment processor | Card payments for purchases | United States |
Website, analytics, advertising and support tools | Running athena-security.com, Google Analytics, Google Ads, LinkedIn, Meta and our CRM | United States and EU |
There are no other sub-processors for Customer screening data. Our current sub-processor list is published at athena-security.com/subprocessors, and we give Customers at least 30 days’ notice before adding one, with the right to object.
5.2 Other recipients
5.3 EU and UK data stays in the EU and UK
Personal data of EU and UK Customers and their visitors is hosted only in Linode data centers in Frankfurt, Amsterdam and London and in AWS regions inside the European Union, in an environment configured so that data cannot leave the EU and UK. Data held in London is covered by the European Commission’s adequacy decision for the United Kingdom, so no further transfer safeguard is needed for EU Customers. Access from US IP ranges to those systems is blocked, and Athena staff reach them only through a VPN, on a support ticket, with the Customer’s in-product approval and a visible on-screen indicator. Athena has no remote access to Customer systems beyond this remote view.
5.4 Transfers outside the EU and UK
Athena is based in the United States, so website enquiries, account data for US-hosted Customers, support tickets and marketing contacts are processed in the US. For any transfer of EU or UK personal data to the United States we rely on the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum), together with the safeguards in Section 7. Where a transfer tool is not available, we transfer data only with your explicit consent or where necessary for a contract you have requested. You can ask us for a copy of the clauses we use at [email protected].
We keep personal data only as long as needed for the purpose it was collected for, then delete or anonymize it.
Data | Retention |
|---|---|
Website enquiries and demo requests | 24 months after our last contact with you, then deleted |
Platform accounts and audit logs | For the life of the Customer contract; deleted or returned within 90 days after the contract ends, at the Customer’s choice |
Customer screening data (alert images, incident records, visitor records) | Set by the Customer in the platform. Incident alerts can carry a separate retention period from other alerts, because some regulators require longer holds on violence incidents. Customers can request deletion of any record at any time through a support ticket, which provides an audit trail of each request |
Support tickets | 3 years after closure |
Billing and accounting records | As long as tax and accounting law requires, typically 7 years |
Job applications | 6 months after the role closes unless you agree to a longer period |
Server and security logs | 12 months |
Backups | Deleted data is purged from backups within 30 days |
Where a legal hold, a dispute or a regulatory obligation requires it, we keep the affected data for longer and restrict it to that purpose.
We apply technical and organizational measures appropriate to the risk, as Article 32 GDPR requires, and we hold a SOC 2 Type II attestation covering them. In summary:
No system is perfectly secure. If we become aware of a personal data breach, we will notify affected Customers without undue delay and in any event within 72 hours of becoming aware of it, publish a notice at status.athena-security.com, and notify the relevant supervisory authority and affected individuals where the GDPR requires it.
If you are in the EU, the UK or another place with similar laws, you have the following rights over the personal data we hold as controller. They are free to exercise, and we will answer within one month (extendable by two further months for complex requests, in which case we will tell you why).
Right | What it means |
|---|---|
Access (Art. 15) | Ask whether we hold your data and receive a copy together with the information in this policy |
Rectification (Art. 16) | Have inaccurate data corrected and incomplete data completed |
Erasure (Art. 17) | Have your data deleted when it is no longer needed, you withdraw consent, you object and we have no overriding grounds, or it was processed unlawfully |
Restriction (Art. 18) | Have us stop using your data, while still storing it, while a dispute about accuracy or lawfulness is resolved |
Portability (Art. 20) | Receive data you gave us in a structured, machine-readable format, or have it sent to another provider, where we process it by consent or contract |
Object (Art. 21) | Object to processing based on legitimate interests; we will stop unless we have compelling grounds. You can object to direct marketing at any time and we will always stop |
Withdraw consent (Art. 7) | Where we rely on consent, withdraw it at any time; this does not affect processing that already took place |
Not be subject to solely automated decisions (Art. 22) | See Section 9.3 |
8.1 How to exercise them
Email [email protected] or write to our Data Protection Officer at the address in Section 10. Tell us which right you are exercising and enough detail to find your data. We may ask you to confirm your identity before acting, and we will only use that information to verify your request. You may authorize someone else to act for you; we will ask for proof of that authority.
To stop marketing email, use the unsubscribe link in any message or reply with STOP; we will act within 10 business days.
8.2 Data held for a Customer
If your data was collected when you entered a Customer’s site, the Customer is the controller and should receive your request (Section 1.2). If you send it to us instead, we will forward it to the Customer and help it respond. We cannot delete or disclose Customer data on our own initiative.
8.3 Complaints
If you think we have handled your data unlawfully, please contact us first so we can put it right. You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state where you live or work or where the issue arose, or with the UK Information Commissioner’s Office (ICO) at ico.org.uk. A list of EU authorities is at edpb.europa.eu.
9.1 Children
Our website, platform and apps are intended for adults acting for an organization. We do not knowingly collect personal data from anyone under 16 through them, and we do not offer accounts to children. If you believe a child has given us data, contact [email protected] and we will delete it.
Children may be screened by our products when a school or hospital that uses them is the controller. That processing is governed by the Customer’s own notices and, in the United States, by our student data privacy commitments under FERPA; no child’s data is used by Athena for any purpose other than delivering the Customer’s service.
9.2 Marketing communications
We send product news and offers to EU and UK contacts only with your prior consent, and to other business contacts under legitimate interest. Every message includes an unsubscribe link, and you can also opt out at any time by emailing [email protected]. We may record whether an email was opened or a link clicked in order to measure our campaigns; you can block this in most email clients.
We do not share mobile phone numbers or SMS opt-in data with third parties for their marketing.
9.3 Automated decision-making and AI
Our products use artificial intelligence to flag items that may be weapons. That analysis runs on the screening device at the Customer’s site, not on our servers; only the resulting alert is sent to the platform. Every flag is reviewed by a trained human operator at the Customer, who makes the final decision about whether to stop or search a person. No decision that produces a legal or similarly significant effect on you is made solely by automated means, so Article 22 GDPR does not apply. Our AI models are trained on Athena’s own test data, never on Customer alert images.
Any facial recognition capability is switched off by default, is available only to healthcare Customers (never to schools), and can be enabled only when the Customer confirms it has a lawful basis under Article 9 GDPR and local law and has completed a data protection impact assessment. A human reviews every match before any action is taken. We will update this policy before such a capability is offered in the EU or UK.
10.1 United States residents
If you live in California, Colorado, Connecticut, Texas, Virginia or another state with a consumer privacy law, you have similar rights to know, access, correct, delete and opt out of the sale or sharing of personal data. We do not sell personal data. We share website usage data with advertising partners (Google, LinkedIn and Meta) through cookies, which California law treats as “sharing”; you can opt out at any time through the “Manage consent” link or the “Do Not Sell or Share My Personal Information” link in our footer. We do not discriminate against you for exercising your rights. Exercise them through the contact details below. Our California AB 2975 compliance statement is published separately on our website.
10.2 Links to other sites
Our website links to third-party sites, including our support portal, status page and social media. Their privacy policies, not this one, govern what they collect.
10.3 Changes to this policy
We will post any change here with a new effective date. For material changes we will also email account holders and show a notice on our website at least 14 days before the change takes effect. Your continued use after that date does not mean you consent to any new processing that requires consent; we will ask for it separately.
10.4 Contact us
Effective date: 1 October 2026. This policy replaces the version effective 1 September 2018.
