📝 Amend Data Retention Policy (#16)

This PR amends the current SEAL 911 Data Retention Policy based on
lawyer feedback.

DATA_RETENTION_POLICY.md

@@ -2,34 +2,47 @@
 
 ## Privacy Protection
 
-**Your privacy is our highest priority and is always protected.** We never share your data outside of SEAL 911 without your explicit consent.
+**Your privacy is our highest priority and is always protected.** We never share your data outside of SEAL 911 without your explicit consent. This policy explains how we protect your personal data.
+
+> [!IMPORTANT]
+> You should always ensure that you contact the official [SEAL 911 Telegram bot](https://t.me/seal_911_bot).
+
+## How We Handle Your Personal Data
+
+If you submit a ticket via the [SEAL 911 Telegram bot](https://t.me/seal_911_bot), we may receive and process personal data that you provide to us for the purpose of detecting, preventing, or responding to a cyber security matter. Personal data includes your Telegram display name and profile (if public) as well as any additional information you disclose within the ticket such as your pseudonym, email address, location data, or financial information. We may only use and share your personal data for this purpose and in accordance with this Data Retention Policy.
 
 ## Data Retention Period
 
-The default retention period for your data is **12 months**. You have the option to opt out of this default retention period at any time. To do so, please notify us through a new ticket in the [SEAL 911 Telegram bot](https://t.me/seal_911_bot).
+The default retention period for your data is **12 months** to allow us to respond to your ticket and any related incidents. You have the option to opt out of this default retention period at any time. To do so, please notify us through a new ticket in the [SEAL 911 Telegram bot](https://t.me/seal_911_bot).
 
-## Data Retention Cycle
+## Data Retention System
 
-The personal data retention cycle consists of three distinct successive phases:
+The personal data retention system consists of three phases:
 
-1. Active ticket: Your data is actively used and managed inside of the SEAL 911 Telegram bot.
-2. Intermediate archiving: Upon closing of the ticket, your data is moved to a secure intermediate archive.
-3. Deletion: After 12 months, your data is fully deleted within the SEAL 911 Telegram bot and the intermediate archive.
+1. **Active ticket:** Your data is actively used and managed inside of the SEAL 911 Telegram bot.
+2. **Intermediate archiving:** Upon closing of the ticket, your data is moved to a secure intermediate archive.
+3. **Deletion:** After 12 months, your data is fully deleted within the SEAL 911 Telegram bot and the intermediate archive.
 
 If special circumstances require us to retain the data beyond the 12-month period, we will contact you to seek your consent. If we do not receive a response, we will assume that you do not consent.
 
+SEAL 911 applies best practice security processes and procedures to secure its systems and archived data.
+
 ## Data Sharing With SEAL-ISAC
 
-SEAL 911 members may share non-PII (Personal Identifiable Information) data and moderately sensitive data with SEAL-ISAC (Information Sharing and Analysis Center), which operates under a separate data retention policy. To enable potential future communication with victims, we collect and store Telegram usernames and jurisdiction information, classified as **TLP:RED** within SEAL-ISAC. When relevant, we will include essential details about the incident, such as compromised on-chain addresses, destinations of stolen funds, and pertinent Indicators of Compromise (IoCs) and Tactics, Techniques, and Procedures (TTPs). These efforts are designed to support future investigations or cases involving the same threat actors. You can opt out of this sharing at any time and request deletion of your data from SEAL-ISAC. To do so, please notify us through a new ticket in the [SEAL 911 Telegram bot](https://t.me/seal_911_bot).
+SEAL 911 does not share personal data (including Personal Identifiable Information (PII)) with SEAL-ISAC (Information Sharing and Analysis Center), which operates under a separate data retention policy. To enable potential future communication with victims, we collect and store Telegram usernames and jurisdiction information, classified as **TLP:RED** within SEAL-ISAC. We may share essential details about an incident with SEAL-ISAC, such as compromised on-chain addresses, destinations of stolen funds, and pertinent Indicators of Compromise (IoCs) and Tactics, Techniques, and Procedures (TTPs). These efforts are designed to support future investigations or cases involving the same threat actors. You can opt out of this sharing at any time and request deletion of your data from SEAL-ISAC. To do so, please notify us through a new ticket in the [SEAL 911 Telegram bot](https://t.me/seal_911_bot).
 
 ## Communication Channels
 
 Please note that the SEAL 911 Telegram bot operates on Telegram, which is not encrypted by default. We are happy to open other communication channels (e.g., Signal) to exchange sensitive information securely.
 
+You can find further details of how Telegram handles your data and their privacy policy [here](https://telegram.org/privacy).
+
 ## Your Concerns and Requests
 
 As security professionals, we value your privacy above all. If you have any questions or specific requests, please let us know via the [SEAL 911 Telegram bot](https://t.me/seal_911_bot), and we will do our best to address your concerns. **Privacy is not a meme at SEAL 911; it is one of our core principles!**
 
 ---
 
 By adhering to this policy, SEAL 911 ensures the protection and respectful handling of your personal data at all times.
+
+SEAL 911 is an initiative of the [Security Alliance](https://securityalliance.org).