Data Breach Response Policy

Last Updated: July 28, 2025

This Data Breach Response Policy outlines how Consentmo (iSenseLabs dba as Consentmo) detects, responds to, and communicates about potential or confirmed data breaches. It ensures that we take swift, effective, and transparent action to protect personal data, fulfill legal obligations, and maintain trust with merchants and their customers.

Purpose

Consentmo is committed to protecting the personal data processed through our services. This policy defines our approach to identifying, managing, and responding to data breaches involving personal or sensitive data collected through the Consentmo app or website.

It applies to all personnel, systems, and third-party services involved in the handling of personal data. Our goal is to mitigate risks, preserve data integrity, and ensure compliance with applicable data protection laws, including GDPR, CCPA, and other global regulations.

What Is a Data Breach?

A data breach refers to any confirmed or suspected incident where personal data is:
  • Lost or stolen
  • Accessed or disclosed without authorization
  • Altered or destroyed unlawfully
This includes both accidental and deliberate actions, whether caused internally or by external actors.

How We Detect and Report Breaches

Internal Detection

Our systems and personnel continuously monitor for anomalies or signs of unauthorized data access. If a Consentmo employee, contractor, or partner suspects a data breach, they must immediately report it via:
  • Email: security@consentmo.com
  • Internal Ticketing System or Help Desk: Accessible to all team members
Reports are reviewed promptly by our Information Security Administrator and incident response team.

Merchant or External Reporting

If you are a merchant using the Consentmo app and suspect a breach involving your store’s data, please notify us immediately at security@consentmo.com. We will investigate and provide a formal response within a reasonable timeframe.

Breach Response Process

Our response process follows a structured 6-step methodology based on the SANS Incident Handler’s Handbook:
1. Preparation
  • Regular risk assessments and breach simulations
  • Clear roles and responsibilities for incident handling
  • Ongoing employee training and readiness checks
2. Identification
  • Confirm the incident and classify the type of breach
  • Log details, assess scope and severity, and document findings
3. Containment
  • Isolate affected systems to prevent further exposure
  • Apply short- and long-term containment measures
4. Eradication
  • Remove malicious files or unauthorized access points
  • Identify root cause and take preventive measures
5. Recovery
  • Restore affected systems and verify their integrity
  • Resume normal operations with heightened monitoring
6. Lessons Learned
  • Conduct a full review within 2 weeks of resolution
  • Update documentation, processes, and employee training
  • Share relevant findings with affected parties (if appropriate)

Roles and Responsibilities

To ensure a coordinated response, we engage an internal Incident Response Team (IRT) chaired by executive management. The team may include representatives from:
  • IT Infrastructure & Engineering
  • Product and Application Security
  • Legal & Compliance
  • Communications & Public Relations
  • Human Resources and Support Operations
Additional specialists (e.g., external forensic investigators or insurance providers) may be involved based on breach severity.
Information Security Administrator
This designated individual oversees incident coordination, reporting, documentation, and resolution, and liaises with relevant stakeholders.
Users and Staff
All Consentmo personnel are responsible for promptly reporting any suspicious activity. They are also required to follow security protocols to prevent data exposure.

Notifying Affected Parties

If a breach is likely to result in a risk to the rights and freedoms of individuals, we will notify:
  • Affected merchants or users (as soon as reasonably possible)
  • Supervisory authorities (within the legally mandated timeframe, e.g., 72 hours for GDPR-covered data)
Our communications will include:
  • The nature and scope of the breach
  • The types of personal data involved
  • Steps we are taking to mitigate the damage
  • Guidance for affected individuals (e.g., password resets, data review)
All breach notifications will be clear, accurate, and timely.

Working with Forensic Investigators and Insurers

In cases of confirmed or high-risk incidents, we will engage professional forensic teams (as provided through our cybersecurity insurance) to analyze:
  • How the breach occurred
  • Which systems and data were involved
  • The number of users affected
  • Any vulnerabilities exploited
This analysis informs our remediation and legal obligations.

Security Enforcement

Employees who violate this policy or who fail to follow proper breach reporting protocols may be subject to disciplinary action, up to and including termination. Third-party vendors in breach of contract may have their access revoked.

Data Security and Prevention

We aim to prevent breaches through:
  • Secure encryption of data in transit and at rest
  • Access controls and audit logs
  • Continuous system monitoring and vulnerability patching
  • Regular security awareness training
These measures are aligned with our broader security and privacy policies.

Definitions

For clarity, the following terms are used:
  • PII (Personally Identifiable Information): Any data that can identify a person (e.g., name, email, IP address)
  • Sensitive Data: Any PII or data classified as Protected Health Information (PHI)
  • Data Breach: Unauthorized access, disclosure, or loss of personal or sensitive data
  • Encryption: The process of converting data into a secure format to prevent unauthorized access

Questions or Reporting

If you have questions about this policy or need to report a potential data breach, please contact us:

Email: security@consentmo.com
Address: Prof. Georgi Bradistilov Str. No.4, 1700 Sofia, Bulgaria
EU Registration Number: 112660079