CYBERWARE PRIVACY POLICY

I. ABOUT THIS PRIVACY POLICY

This Privacy Policy explains how Cyberware Ltd ("Cyberware", "we", "us" or "our") collects, uses, stores, shares and protects personal data when you visit or interact with the Cyberware website, submit an enquiry, apply for a role, begin or complete a checkout, purchase our services, consent to marketing communications, or otherwise interact with the website, and when you take part in, or approve, a Cyberware case study, customer story or testimonial.

This Privacy Policy applies to personal data processed through this website and in preparing the client case studies, customer stories and testimonials described in Section XIV. Personal data processed by Cyberware in connection with the performance of penetration testing or other services for a customer may also be governed by our Terms of Service, a Data Processing Agreement, an Order, Statement of Work or other contractual documentation.

Our use of cookies, analytics technologies and similar technologies is described in our Cookie Policy. You can change your choices at any time through the Cookie Preferences control available in the website footer.

Where this website is available in multiple languages, the English version of this Privacy Policy is the authoritative version unless applicable law requires otherwise.

II. DATA CONTROLLER AND CONTACT DETAILS

The controller responsible for the personal data described in this Privacy Policy is:

Cyberware Ltd (formerly Bulhack Ltd), 16 Hadzhi Dimitar St., 2100 Elin Pelin, Sofia Region, Bulgaria. Company registration number (UIC): 206948918.

VAT number: BG206948918

Business contact office:

Okolovrasten pat 46, Sofia, Bulgaria, European Union

Privacy and data-subject requests should be sent to:

[email protected]

General commercial enquiries may be sent to:

[email protected]

Career-related enquiries may be sent to:

[email protected]

Security vulnerabilities relating to Cyberware systems may be reported through:

[email protected]

Cyberware is established in the European Union and therefore does not require a representative under Article 27 GDPR for its EU processing.

Cyberware will publish the contact details of a Data Protection Officer if appointment of one becomes legally required or Cyberware appoints one voluntarily.

III. PERSONAL DATA WE COLLECT

Depending on how you use the website, we may process the following categories of personal data.

1. Identification and contact information

This may include:

your first and last name, email address, telephone number, company name, company domain and job title.

2. Information you provide in communications

This includes information contained in notes, enquiries, requests, career messages and other free-text fields.

Please avoid submitting sensitive personal data unless it is genuinely necessary for your request.

3. Order and service information

When you begin or complete a Cyberware checkout, we may process:

the selected plan, test type, test category, free-trial status, target URL, application platform, application download link, source-code repository link, smart-contract address, whitepaper link, previous audit link, and other technical information necessary to understand or perform the requested service.

4. Test-account credentials

Where authentication is required to perform an authorised security assessment, you may provide credentials for a dedicated test account.

Credentials entered through the checkout flow are encrypted in your browser before transmission using RSA-OAEP with SHA-256. The website sends and stores the encrypted value rather than the plaintext password.

You should provide dedicated, temporary test credentials wherever possible and should not provide credentials used for unrelated systems or personal accounts.

5. Payment information

Payments are processed through Stripe.

Cyberware does not receive through its own website endpoints your full payment-card number, card security code or similar card credentials entered directly into Stripe's payment interface.

Cyberware may receive information connected with the transaction such as your email address, Stripe checkout/session identifier, payment status, selected product or plan, invoice information and other information necessary to reconcile and administer the transaction.

6. Technical and usage information

When you access the website, Cyberware and its service providers may process technical information including:

IP address, request identifier, HTTP method, host, requested URL, referring URL, approximate country derived from network information, browser and user-agent information, request timing, security information and other standard technical data associated with a website request.

7. Cookie and consent information

Where you make a cookie choice, we may process a randomly generated consent identifier, your selected categories, the consent-notice version, page language, relevant page path and the time of the decision.

Our Cookie Policy provides additional information about cookies and similar technologies.

8. Client-marketing information

If you take part in, or approve, a Cyberware case study, customer story or testimonial, we process the information described in Section XIV.

9. Personal data we receive from others

Some personal data reaches Cyberware from someone other than the person it relates to. The contact details of a client's Approver or signatory for a case study, customer story or testimonial come from their organisation, and a customer may give us information about other individuals, such as the holders of test accounts or its own personnel, when it places or administers an order. Section XIV and Section XXIV describe how that information is handled.

IV. CONTACT ENQUIRIES

The contact form may collect your:

name, email address, telephone number, company name and the note you submit.

All of these fields are required, because we need them to reply to your enquiry; the form cannot be sent without them. The box for receiving product updates, offers and educational content by email is optional.

The information is processed so that Cyberware can understand and respond to your request, communicate with you regarding potential services, maintain appropriate business records and protect Cyberware against misuse or fraudulent requests.

Contact submissions are transmitted through Cyberware's server and may be forwarded to authorised internal Cyberware personnel through our business communication systems, including Google Chat and Slack.

Cyberware does not use a website database as the permanent record of the contact submission.

The legal basis is:

• Article 6(1)(b) GDPR where processing is necessary to take steps at your request before entering into a contract; and
• Article 6(1)(f) GDPR where processing is necessary for our legitimate interests in responding to business communications, maintaining business correspondence, preventing misuse and administering our commercial operations.

Contact enquiries that do not become part of an ongoing customer relationship are normally retained for no longer than 24 months after the last substantive interaction, unless a longer period is necessary to establish, exercise or defend legal claims or is required by law.

V. CAREERS ENQUIRIES

The careers form may collect your:

name, email address, telephone number, role of interest and the note you submit.

All of these fields are required, because we need them to consider your enquiry or application; the form cannot be sent without them. The box for receiving product updates, offers and educational content by email is optional.

Career submissions may be forwarded to authorised personnel through Google Chat and Slack.

The form does not currently accept CV or portfolio file uploads. If you submit recruitment information separately by email or another agreed channel, that information may also form part of your application record.

We process candidate information to consider your enquiry or application, communicate with you about employment opportunities, administer recruitment processes and comply with applicable employment and legal obligations.

The principal legal basis is Article 6(1)(b) GDPR, because processing is necessary to take steps at your request before potentially entering into an employment relationship.

Where necessary, we may also process recruitment information under Article 6(1)(c) GDPR to comply with a legal obligation or under Article 6(1)(f) GDPR for legitimate interests such as preventing fraud, securing our recruitment systems and establishing or defending legal claims.

For unsuccessful candidates, Cyberware will retain recruitment-selection personal data for no longer than six months after completion of the relevant recruitment procedure, unless you expressly consent to a longer retention period or another law requires longer retention.

VI. CHECKOUT AND ORDER PROCESSING

When you begin checkout, the website creates a random checkout identifier so that the different stages of the same request can be associated with one another.

Depending on the service selected, checkout may collect your:

name, email address, telephone number, job title, company name, company domain, selected plan, test type, test category, target-system information, repository or application links, technical information and agreement to the applicable Terms of Service.

This information is necessary to prepare, validate, administer and perform the service you request.

In each checkout step, the fields needed to prepare your order are required, and you cannot continue without them. Test-account credentials, additional source-code, documentation or previous-audit links, smart-contract addresses and the box for receiving marketing emails are optional.

The principal legal basis is Article 6(1)(b) GDPR, because processing is necessary to take steps at your request and, when an order is placed, to perform our contract with you.

We may additionally rely on:

• Article 6(1)(c) GDPR for legally required tax, accounting, regulatory and compliance records; and
• Article 6(1)(f) GDPR for fraud prevention, service security, order verification, contacting you about a checkout you started but did not complete, and establishing, exercising or defending legal claims.

Temporary checkout storage

Completed checkout steps may temporarily be held in the memory of the running server process and associated with the random checkout identifier.

The website does not use this temporary store as a permanent customer database.

Temporary checkout data is deleted from this in-memory store no later than 24 hours after it has been forwarded for internal processing.

Completed checkout

When checkout is completed, the assembled request may be forwarded to authorised Cyberware personnel through internal Google Chat and Slack channels.

Incomplete checkout

If you stop after completing one or more checkout steps, information already submitted may be treated as an incomplete or abandoned checkout.

Cyberware may internally record that incomplete request so that we can identify technical problems, prevent fraud and, where appropriate, contact you to help you complete the order you started.

Any such contact concerns only that order, and you can ask us at any time not to contact you about it again.

Information from an abandoned checkout will not by itself be treated as consent to receive marketing communications.

Abandoned-checkout records are normally deleted within 90 days unless they become connected with a completed order, dispute, security investigation or other legitimate business record requiring longer retention.

VII. TEST-ACCOUNT CREDENTIALS

Where the authorised test requires authentication, the checkout may allow you to provide usernames and passwords for test accounts relating to the system you have asked Cyberware to assess.

Credentials are encrypted in your browser using RSA-OAEP with SHA-256 before transmission. The encrypted result, rather than the plaintext password, is transmitted through the website.

Access to the corresponding private key and to decrypted credentials is restricted to personnel who require that access for the authorised engagement.

Credentials are decrypted only where necessary to perform the authorised service.

Cyberware will retain test credentials only for as long as necessary to perform the relevant authorised testing and any immediately related verification or retesting. Unless a shorter period is agreed with the customer, credentials will be deleted no later than 30 days after completion of the relevant engagement.

The legal basis for this processing is normally Article 6(1)(b) GDPR, because the processing is necessary to perform the service requested by the customer.

Customers should create dedicated, limited-permission test accounts and revoke or rotate their credentials once testing is complete.

VIII. PAYMENTS AND STRIPE

Cyberware uses Stripe to process online payments.

When Cyberware creates a Stripe checkout session, information sent to Stripe may include your email address, the selected product or price, the Cyberware checkout identifier and other transaction metadata required to process the purchase.

Stripe's payment interface may separately collect information including card details, billing address and tax information.

Payment information entered directly into Stripe's payment interface is processed by Stripe and is not submitted to Cyberware's own payment-card processing infrastructure.

Stripe may act as a processor for certain services performed on Cyberware's instructions and as an independent or joint controller for activities for which Stripe determines its own purposes and means of processing, including certain payment, fraud-prevention, regulatory and compliance activities.

For Cyberware's European Stripe relationship, the relevant Stripe entities may include Stripe Payments Europe, Limited and other Stripe group entities depending on the particular service and processing activity.

Cyberware processes transaction information on the basis of Article 6(1)(b) GDPR to process and administer the transaction, Article 6(1)(c) GDPR for applicable tax, accounting and regulatory obligations, and Article 6(1)(f) GDPR for fraud prevention and the establishment or defence of legal claims.

Stripe maintains its own privacy information describing how it processes personal data in its different roles.

IX. SERVER LOGS AND NETWORK SECURITY

Cyberware creates and uses server and security logs in order to operate, protect, diagnose and maintain the website.

Logs may contain:

a request identifier, request method, host, requested URL, referring URL, IP address, network-supplied country code, browser or user-agent information, request timing and information concerning suspicious or malicious traffic.

Production systems are configured so that ordinary form contents are not intentionally written to production logs.

Sensitive keys such as passwords, tokens, API keys, authorisation values, cookies and secrets are excluded or redacted from application logging where technically applicable.

Ordinary server logs are normally retained for no more than 30 days.

Where particular records are required to investigate a security incident, fraud, attack, abuse or legal dispute, the relevant records may be isolated and retained for longer, but only for as long as reasonably necessary for that purpose.

Processing of security and operational logs is based on Article 6(1)(f) GDPR, namely Cyberware's legitimate interests in maintaining the availability, integrity and security of its website, systems and services, detecting attacks, preventing abuse and diagnosing technical faults.

X. HOSTING AND NETWORK DELIVERY

Cyberware hosts this website on DigitalOcean servers in Amsterdam, the Netherlands. DigitalOcean, LLC runs the servers that process every request to the website and stores the images and other static files the website serves.

Cyberware uses Cloudflare, Inc. in front of that hosting as a reverse proxy, content-delivery network and web application firewall, so requests to the website pass through Cloudflare before they reach DigitalOcean.

DigitalOcean may process IP addresses, HTTP request information, browser information and the content of the requests and form submissions the website receives, as Cyberware's processor and only to provide the hosting.

Cloudflare may process IP addresses, HTTP request information, device or browser information, security signals, cookies or similar technical information according to the services Cyberware uses and Cloudflare's applicable terms.

Cyberware relies on Article 6(1)(f) GDPR for this processing where it is necessary for website availability, security, fraud prevention, attack mitigation and network performance.

The Cloudflare technologies used on this website are classified as Necessary and are therefore not offered as an optional category. Our Cookie Policy lists them.

XI. COOKIES, ANALYTICS AND EMBEDDED CONTENT

Cyberware uses a consent-management mechanism to control non-essential cookies and scripts.

Strictly necessary technologies required to provide, secure or remember essential website functionality may operate without optional consent where permitted by applicable law.

The optional categories are Experience and Measurement, as described in our Cookie Policy. Technologies in those categories do not run until you have granted the category they belong to.

Google Analytics 4

Cyberware may use Google Analytics 4 to understand how visitors use the website, measure traffic and improve website performance.

Google Analytics is activated only after the Measurement category has been granted.

Google Analytics may process information such as:

online identifiers, cookie or tracker information, browser and device information, pages visited, approximate location derived from technical information, session information and website-interaction information.

Cyberware does not use Google Analytics through this website for personalised advertising or remarketing unless this Privacy Policy and our Cookie Policy are first updated accordingly and any legally required consent is obtained.

Google Analytics user-level and event-level data under Cyberware's control is configured for a retention period of no more than 2 months.

Google states that IP addresses are used when a request is received for geolocation-related processing and are not logged or stored as IP addresses in Google Analytics.

Embedded and social content

Some pages may contain content or functionality supplied by professional-network, social-media or video platforms.

Where loading that content would permit the third party to collect information from your browser, the content is blocked until the Experience category has been granted.

Once you choose to load or interact with third-party content, the third party may process your information under its own privacy terms.

Our Cookie Policy lists the providers and categories used on the website, together with the cookie names and durations we are able to document for each of them. Where a provider controls its own embedded service, the identifiers it uses may change independently of Cyberware.

XII. RECORD OF YOUR COOKIE CHOICE

Cyberware records information necessary to demonstrate and administer your cookie-consent choice.

The record may contain:

a random consent identifier, your decision, the categories you chose, whether your browser was sending a Global Privacy Control signal, the versions of the consent notice, this Privacy Policy and our Cookie Policy that were shown to you, language, relevant page path, the time of your decision and the time we received the record.

If the record cannot be delivered to us when you decide, a copy is kept in your browser, as our Cookie Policy describes, and is sent on a later visit.

The same random identifier is also stored in our first-party cw_consent cookie in your browser, which has a maximum lifetime of 180 days. Our Cookie Policy describes it in full.

The consent record does not include your IP address or a device fingerprint, and is not intended to identify you independently of the consent identifier. Our ordinary server log records the IP address of every request to the website, including the request that carries your decision, as section IX describes; that log entry does not carry your consent identifier or the decision itself.

The legal bases are Article 6(1)(c) GDPR, where retaining evidence is necessary to demonstrate compliance with applicable consent obligations, and Article 6(1)(f) GDPR, where applicable, for Cyberware's legitimate interest in maintaining auditable consent records.

Consent evidence is normally retained for up to five years from the relevant decision or withdrawal, unless a shorter period is sufficient or a longer period is required in connection with a legal claim or regulatory obligation.

You can change or withdraw optional cookie consent at any time through Cookie Preferences in the website footer.

XIII. MARKETING COMMUNICATIONS

Where the website presents an optional marketing checkbox, that checkbox is not preselected.

If you actively choose it, Cyberware may use your email address to send:

product updates, promotional offers, educational content and other Cyberware marketing communications described alongside the consent request.

The legal basis is Article 6(1)(a) GDPR — your consent.

Your decision whether to consent to marketing does not affect your ability to submit the underlying contact, careers or checkout form.

You may withdraw your consent at any time by:

• using an unsubscribe facility included in a marketing communication where available; or
• contacting [email protected].

Withdrawal is free of charge.

After you unsubscribe, Cyberware may retain the minimum information necessary on a suppression list so that your address is not accidentally added back to marketing communications.

Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Cyberware will also honour an objection to direct marketing at any time. Once you object, your personal data will no longer be processed for that direct-marketing purpose.

XIV. CLIENT CASE STUDIES, CUSTOMER STORIES AND TESTIMONIALS

Cyberware publishes case studies, customer stories and testimonials about services it has delivered, on getcyberware.com and its other channels. Cyberware is the data controller for the personal data of the people who take part.

Who this covers: people who are interviewed, quoted, named or shown in Cyberware's case studies, customer stories and testimonials, and the client staff who approve or sign the Publicity, Reference and Testimonial Release.

Personal data: name, or the form the person chooses (full name, surname only, a title of their choice with their surname, or role only); job title and employer; interview answers and approved quotes; photograph or video image, only with the person's consent; records of consent, approvals and withdrawal; for the client's Approver and signatory, name, position, business e-mail and, for the signatory, the basis of their authority.

Purposes: preparing and publishing marketing material about services Cyberware delivered, in the final wording the person and their organisation approve; keeping a record of consents and approvals; acting on a withdrawal.

Legal basis: Art. 6(1)(a) GDPR, the consent of each person named, quoted or shown; Art. 6(1)(c), for keeping the record of consent and withdrawal (Art. 7(1)); Art. 6(1)(f), for the Approver's and signatory's contact details, to administer the release. Taking part is voluntary, and refusing consent has no consequence for the person or for their organisation's relationship with Cyberware.

Recipients: the public, once published on the channels the organisation permits; the organisation's Approver; authorised Cyberware personnel; Anthropic, which provides the AI tools Cyberware uses to draft and design the material (Claude and Claude Design), as processor; Cloudflare, which stores Cyberware's encrypted backup copies in the EU, as processor; Google, which provides Cyberware's e-mail and document storage (Google Workspace, including Gmail and Google Drive), as processor.

International transfers: Anthropic processes the text and images on servers in the European Union, under its data processing agreement with Cyberware. Backup copies are stored in the EU. Google may process the data on its global infrastructure, including in the United States, under the Standard Contractual Clauses in its data processing terms.

Retention: material stays published only while the consent is in date and not withdrawn; returned questionnaires and interview notes are deleted within 7 days after the final text is approved; photographs are deleted from Cyberware's records and from the design tool on withdrawal or expiry; the record of consent and withdrawal is kept while material relying on it is published, then for 3 years.

Automated decisions: none. The organisation's Approver and Cyberware's management approve every item before it is published.

Rights: access, rectification, erasure, restriction and portability, and, for the Approver's and signatory's contact details, objection. Complaints may be made to the Commission for Personal Data Protection (CPDP), bul. Prof. Tsvetan Lazarov 2, Sofia 1592, [email protected].

Withdrawal: consent can be withdrawn at any time, without reasons, by writing to [email protected]. Withdrawal does not affect the lawfulness of earlier use. Cyberware then stops preparing and publishing the material, removes it from the channels it controls within the period stated in the release, and deletes the person's name, image and quotes from its records and from the design tool, keeping only the record of the consent and of its withdrawal. Material that others have already published cannot be recalled.

Contact: [email protected]

XV. SERVICE PROVIDERS AND RECIPIENTS

Cyberware does not make website submissions publicly available. Client case studies, customer stories and testimonials are published only in the final wording approved as described in Section XIV.

Personal data may be made available to Cyberware personnel and service providers only where necessary for the purposes described in this Privacy Policy.

Relevant recipients may include:

• Google Workspace, including Google Chat, Gmail and Google Drive — internal business communications, receipt of website submissions and consent records, and e-mail and document storage for client-marketing material;
• Slack — internal business communications and receipt of contact, careers and checkout information;
• Stripe — payment and transaction processing;
• DigitalOcean, LLC — hosting of this website on servers and storage in Amsterdam, the Netherlands, as processor;
• Cloudflare, Inc. — website delivery, network security, traffic filtering and related infrastructure in front of the hosting, and storage of Cyberware's encrypted backup copies in the EU;
• Anthropic — AI tools Cyberware uses to draft and design client-marketing material (Claude and Claude Design), as processor;
• Google Analytics — consent-based website analytics;
• X, LinkedIn Ireland Unlimited Company and Google Ireland Limited (YouTube) — embedded social-media, professional-network and video content, where you have enabled the Experience category;
• professional advisers, accountants, auditors, insurers or legal advisers — where reasonably necessary to administer Cyberware or comply with law; and
• public authorities, courts or regulators — where disclosure is required by applicable law or a legally valid request.

Cyberware requires processors handling personal data on its behalf to be subject to appropriate contractual and data-protection obligations where required by law.

Within Cyberware, access is restricted according to business need and role.

XVI. INTERNATIONAL DATA TRANSFERS

Cyberware is established in Bulgaria, within the European Economic Area.

Some service providers operate internationally and may process personal data outside the EEA.

Where the GDPR applies and personal data is transferred to a country outside the EEA, Cyberware relies on a valid transfer mechanism as applicable, such as:

• an adequacy decision adopted by the European Commission;
• the EU-U.S. Data Privacy Framework where the relevant U.S. recipient participates and the transfer falls within its certification;
• the European Commission's Standard Contractual Clauses; or
• another transfer mechanism permitted under Chapter V GDPR.

Where a transfer relies on the Standard Contractual Clauses, the recipient has committed by contract to protect the personal data to the standard that EU data protection law requires.

Google may process personal data on its global infrastructure, including in the United States. Those transfers rely on the European Commission's Standard Contractual Clauses incorporated in its data processing terms.

Anthropic processes client-marketing text and images on servers in the European Union under its data processing agreement with Cyberware, and Cyberware's encrypted backup copies are stored in the EU.

Slack provides contractual safeguards including Standard Contractual Clauses and participates through Salesforce in applicable Data Privacy Framework arrangements.

DigitalOcean hosts this website in the EU. DigitalOcean, LLC is established in the United States and is certified under the EU-U.S. Data Privacy Framework, which its data processing agreement uses for any transfer outside the EEA.

Cloudflare's Data Processing Addendum incorporates the European Commission Standard Contractual Clauses and Cloudflare also maintains applicable Data Privacy Framework certifications.

Stripe's data-processing arrangements include relevant international-transfer mechanisms, including the EU-U.S. Data Privacy Framework and Standard Contractual Clauses where applicable.

X, LinkedIn, YouTube and Google Analytics are reached only after you have enabled the optional category they belong to, and each then processes data under its own published transfer arrangements. Our Cookie Policy identifies which category each of them belongs to.

The existence of a transfer mechanism does not prevent Cyberware from applying additional safeguards where required by applicable law.

You may contact us at [email protected] for additional information about the safeguards relevant to a particular transfer, or to obtain a copy of them.

XVII. LEGAL BASES FOR PROCESSING

For clarity, Cyberware's principal GDPR legal bases are:

• Contact enquiries: Article 6(1)(b), where related to steps toward a contract; otherwise Article 6(1)(f), legitimate business communications and administration.
• Career enquiries: Article 6(1)(b), steps requested before a potential employment contract; Article 6(1)(c), where a legal obligation applies; and Article 6(1)(f) for security and legal claims where necessary.
• Checkout and orders: Article 6(1)(b), performance of a contract or requested pre-contractual steps.
• Payment and accounting records: Article 6(1)(b) and Article 6(1)(c), with Article 6(1)(f) applying where necessary for fraud prevention or legal claims.
• Test credentials and target information: Article 6(1)(b), to provide the requested authorised service.
• Incomplete checkout administration: Article 6(1)(f), Cyberware's legitimate interest in administering initiated orders, diagnosing checkout problems and preventing fraud, provided that those interests are not overridden by your rights and interests.
• Server and security logs: Article 6(1)(f), website and information-security interests.
• Cloudflare security and delivery: Article 6(1)(f), availability, security and abuse prevention.
• Optional analytics and non-essential third-party content: Article 6(1)(a), consent, where consent is required.
• Marketing communications: Article 6(1)(a), consent, unless a different lawful direct-marketing basis is expressly permitted by applicable law and disclosed to you.
• Client case studies, customer stories and testimonials: Article 6(1)(a), the consent of each person named, quoted or shown; Article 6(1)(c), for keeping the record of consent and withdrawal; and Article 6(1)(f), for the Approver's and signatory's contact details, to administer the release.
• Consent records: Article 6(1)(c) and, where appropriate, Article 6(1)(f), for demonstrating and administering compliance.

Cyberware does not rely on the GDPR public-task basis for ordinary processing described in this Privacy Policy.

Where Cyberware relies on legitimate interests, we assess whether the processing is necessary and whether your interests, rights or freedoms override those interests.

XVIII. RETENTION

Cyberware retains personal data only for as long as necessary for the relevant purpose, including applicable legal, accounting, security and dispute-resolution requirements.

Our principal retention periods are:

• Contact enquiries: normally up to 24 months from the last substantive interaction.
• Unsuccessful recruitment information: maximum six months following completion of the relevant recruitment procedure unless you consent to longer storage or another law requires it.
• Abandoned checkout information: normally up to 90 days.
• Temporary in-memory checkout data: no longer than 24 hours after forwarding for internal processing.
• Completed order and customer-administration information: normally for the duration of the relationship and up to five years afterward where reasonably required for contractual administration or legal claims, subject to any longer mandatory statutory record-keeping requirement.
• Test credentials: no later than 30 days after completion of the relevant engagement unless a shorter period is agreed.
• Ordinary server logs: normally up to 30 days, with relevant security evidence retained longer where necessary to investigate an incident or legal matter.
• Google Analytics user-level and event-level data: no more than 2 months under Cyberware's Analytics configuration.
• Marketing data: until consent is withdrawn, followed by retention of only the minimum suppression information necessary to honour the withdrawal.
• Client case studies, customer stories and testimonials: published only while the consent is in date and not withdrawn; returned questionnaires and interview notes deleted within 7 days after the final text is approved; photographs deleted on withdrawal or expiry; the record of consent and withdrawal kept while material relying on it is published, then for 3 years.
• Cookie-consent evidence: normally up to five years from the relevant consent decision or withdrawal.
• The cw_consent cookie in your browser: a maximum of 180 days.

Where information becomes part of a legal dispute, investigation or mandatory regulatory record, it may be retained beyond these ordinary periods until the relevant matter or legal obligation has ended.

After the applicable retention period expires, personal data is deleted, anonymised or otherwise placed beyond ordinary use.

XIX. YOUR GDPR RIGHTS

Cyberware applies the GDPR's standard of protection to everyone whose personal data it processes, wherever they are, so the rights below are available to you even where the GDPR does not otherwise apply to you.

You may have the right to:

• obtain confirmation as to whether Cyberware processes personal data about you and obtain access to it;
• request correction of inaccurate personal data and completion of incomplete data;
• request deletion of your personal data where the legal conditions for erasure are satisfied;
• request restriction of processing in the circumstances provided by law;
• receive qualifying personal data in a structured, commonly used and machine-readable format and, where applicable, have it transmitted to another controller;
• object, on grounds relating to your particular situation, to processing based on legitimate interests;
• object at any time to processing of your personal data for direct marketing; and
• withdraw consent at any time where processing is based on consent.

Withdrawal of consent does not affect processing that was lawful before withdrawal.

Some rights are subject to legal conditions and exceptions and therefore do not apply in every circumstance.

To exercise your rights, contact:

[email protected]

We may request information reasonably necessary to verify your identity and locate the relevant records. We will not request more information than necessary for that purpose.

GDPR requests are normally answered without undue delay and no later than one month after receipt, subject to any extension permitted by law for complex or numerous requests.

XX. SUPERVISORY AUTHORITY

Because Cyberware is established in Bulgaria, you may lodge a complaint with the Bulgarian supervisory authority:

Commission for Personal Data Protection (CPDP / КЗЛД)

2 Prof. Tsvetan Lazarov Blvd.

Sofia 1592

Bulgaria

Email: [email protected]

You may also have the right to complain to another competent supervisory authority, particularly in the EU or EEA country of your habitual residence, place of work or place of the alleged infringement.

We encourage you to contact Cyberware first where appropriate so that we have an opportunity to address your concern.

XXI. AUTOMATED DECISION-MAKING AND PROFILING

Cyberware does not use personal data collected through this website to make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

Website analytics, security filtering, fraud-detection signals and technical automation are not used through this website to make such decisions about individuals.

If this changes, this Privacy Policy will be updated before such processing is introduced where required by law.

XXII. SECURITY

Cyberware uses technical and organisational measures appropriate to the nature of the personal data and the risks of processing.

Website-level measures include, as applicable:

• encryption of test-account credentials in the browser before transmission;
• encrypted HTTPS communications;
• access restrictions based on business need;
• endpoint validation and rate limiting;
• protection against common malicious requests and network attacks;
• restriction of sensitive information in production logs;
• security monitoring;
• separation of public and private cryptographic key material; and
• use of specialised security and infrastructure providers.

No method of internet transmission or electronic storage can be guaranteed to be completely secure.

Cyberware maintains procedures for responding to personal-data incidents and will notify competent supervisory authorities and affected individuals where notification is required by applicable data-protection law.

XXIII. CHILDREN

Cyberware's website and services are designed for businesses and professional users and are not directed to children.

Cyberware does not knowingly solicit personal data from children through this website.

If we learn that personal data relating to a child has been submitted in circumstances where processing is not lawful or necessary, we will take reasonable steps to delete it.

Parents, guardians or other authorised persons who believe that a child's personal data has been submitted to Cyberware may contact [email protected].

XXIV. INFORMATION ABOUT OTHER PEOPLE

If you provide Cyberware with personal data relating to another individual, you are responsible for ensuring that you have authority or another lawful basis to provide that information and, where required, that the individual has received the necessary privacy information.

This is particularly important when customers submit employee, customer, test-account or technical-system information in connection with a Cyberware security assessment.

XXV. SALE, SHARING AND TARGETED ADVERTISING

Cyberware does not sell personal information for money.

Cyberware does not operate a data-broker business.

Cyberware does not intentionally use website personal information to build advertising profiles for cross-context behavioural advertising.

However, optional third-party technologies, embedded content or social-platform functionality can involve disclosures that may be treated as "sharing", "sale" or "targeted advertising" under certain U.S. state privacy laws depending on the provider's own use of the information.

For this reason, non-essential third-party technologies are controlled through Cyberware's Cookie Preferences mechanism where required.

You may reject the relevant optional categories or withdraw permission through Cookie Preferences.

If your browser sends a Global Privacy Control signal, Cyberware keeps the optional Experience and Measurement categories switched off for as long as the signal is present, wherever you are, even if you allow them in the cookie banner. Our Cookie Policy describes this in more detail.

Where you have enabled optional embedded content, you can withdraw it at any time through the Cookie Preferences control described in our Cookie Policy.

XXVI. UNITED STATES PRIVACY INFORMATION

This section applies only to the extent a U.S. state privacy law applies to Cyberware and gives you rights in relation to our processing.

Depending on the applicable law, you may have rights to:

• know or access personal information processed about you;
• obtain a copy of qualifying personal information;
• correct inaccurate personal information;
• delete qualifying personal information;
• opt out of sale, sharing, targeted advertising or certain qualifying profiling;
• limit certain uses of sensitive personal information;
• obtain information about categories or, where applicable, specific third parties receiving personal information;
• appeal certain denied privacy requests; and
• exercise your rights without unlawful discrimination.

Cyberware does not use website personal information for profiling in furtherance of decisions producing legal or similarly significant effects.

Do Not Track and tracking across websites

Cyberware does not track you across other companies' websites. The website does not respond to Do Not Track signals, because there is no common standard for them, but it honours Global Privacy Control as described in Section XXV and in our Cookie Policy.

If you allow the Experience or Measurement categories, Google (including YouTube), X and LinkedIn may collect information about your online activities over time and across different websites through their own technologies, under their own privacy policies. If you do not allow those categories, their technologies are not loaded.

Categories collected

During the preceding 12 months, depending on your interaction with Cyberware, we may have collected:

• identifiers and contact information;
• professional or employment-related information;
• commercial and transaction information;
• internet or electronic-network activity information;
• customer-submitted technical information;
• account credentials supplied for an authorised test; and
• other information you intentionally submit in communications.

The purposes and applicable retention periods are described elsewhere in this Privacy Policy.

Cyberware does not knowingly sell or share personal information of persons under 16.

Requests may be submitted to [email protected].

Cyberware may take reasonable measures to verify a request. Where applicable law permits an authorised agent to submit a request on your behalf, we may require evidence of the agent's authority and may verify your identity directly.

XXVII. CALIFORNIA NOTICE AT COLLECTION

If the California Consumer Privacy Act applies to Cyberware, this section serves as part of our Notice at Collection.

Cyberware may collect the following categories of personal information:

Identifiers: name, email address, telephone number, IP address and similar identifiers.

Purpose: communications, orders, account or service administration, payments, security and legal compliance.

Typical retention: according to the retention periods in Section XVIII.

Professional or employment-related information: company, job title, company domain and career information.

Purpose: business enquiries, orders and recruitment.

Typical retention: contact information up to 24 months; unsuccessful recruitment information no longer than six months unless longer retention is authorised.

Commercial information: selected Cyberware service, order details, transaction status and related purchase information.

Purpose: processing and administering orders and services.

Typical retention: normally through the commercial relationship and up to five years afterward where required for administration or legal claims, subject to statutory record-keeping requirements.

Internet or electronic-network activity: IP address, browser information, website requests, usage information, cookie or consent information and similar technical information.

Purpose: website operation, security, analytics where permitted, consent administration and fraud prevention.

Typical retention: ordinary server logs normally up to 30 days; Analytics data no more than 2 months; consent evidence normally up to five years.

Account-access credentials: encrypted credentials voluntarily supplied for an authorised test.

Purpose: performing the security service you requested.

Typical retention: no later than 30 days after completion of the relevant engagement unless a shorter period is agreed.

Other information you submit: free-text notes, target-system information and similar information you intentionally provide.

Purpose: responding to your request or providing the relevant service.

Retention depends on the context as described in Section XVIII.

Cyberware does not collect these categories for the purpose of selling personal information.

XXVIII. BRAZIL

Where Brazil's Lei Geral de Proteção de Dados Pessoais ("LGPD") applies, Cyberware will process personal data only where a lawful basis under the LGPD exists.

Depending on the processing, relevant bases may include:

• consent;
• performance of a contract or preliminary procedures related to a contract at the data subject's request;
• compliance with a legal or regulatory obligation;
• the regular exercise of rights in judicial, administrative or arbitration proceedings; and
• legitimate interests, subject to the safeguards and balancing requirements of the LGPD.

Where applicable, Brazilian data subjects may request:

• confirmation of processing;
• access;
• correction;
• anonymisation, blocking or deletion in circumstances provided by law;
• portability where applicable;
• information regarding sharing;
• information concerning consent;
• withdrawal of consent;
• review of qualifying automated decisions; and
• other rights provided by the LGPD.

Requests may be submitted through [email protected], which serves as Cyberware's privacy communication channel.

Where personal data subject to the LGPD is transferred internationally, Cyberware uses a mechanism permitted by the LGPD and applicable ANPD rules, including an adequacy mechanism, approved contractual safeguards, standard contractual clauses or another legally recognised transfer basis, as applicable.

Nothing in this section limits rights granted by mandatory Brazilian law.

XXIX. SWITZERLAND

Where the Swiss Federal Act on Data Protection applies, Cyberware processes personal data in accordance with the principles and obligations applicable under that law.

You may have rights including access, correction, deletion or destruction in appropriate circumstances, restriction or objection in appropriate circumstances, and data portability where the statutory requirements are satisfied.

Requests may be submitted to [email protected].

Cyberware will maintain appropriate safeguards for transfers of Swiss personal data abroad where required by Swiss law.

If Cyberware's Swiss processing reaches the conditions under which appointment of a Swiss representative becomes legally mandatory, Cyberware will appoint and publish the details of that representative.

XXX. UNITED KINGDOM

Where the UK GDPR applies to a particular Cyberware activity, individuals in the United Kingdom have substantially equivalent core rights to those described in Section XIX, subject to the UK GDPR and Data Protection Act 2018 as amended.

Cyberware will use a lawful UK international-transfer mechanism where one is required.

If Cyberware becomes subject to the UK GDPR in circumstances that legally require appointment of a representative in the United Kingdom, Cyberware will appoint that representative and publish its contact details as required by law.

UK privacy requests may be submitted to [email protected].

XXXI. CHANGES TO THIS POLICY

Cyberware may update this Privacy Policy when:

• our website or services change;
• we introduce or remove a service provider;
• our processing purposes change;
• applicable laws or regulatory guidance change; or
• other operational or legal circumstances require an update.

The Last Updated date at the top identifies the latest revision.

Where a change materially affects processing based on your consent, Cyberware will request new consent where required by law.

Where Cyberware records a privacy-notice or consent version with a particular consent decision, a later revision of this Privacy Policy does not retroactively alter the consent you gave under the earlier version.

XXXII. LEGAL DISCLOSURES

Cyberware may process or disclose personal data where reasonably necessary to:

• comply with applicable law, court orders or legally valid requests from competent authorities;
• establish, exercise or defend legal claims;
• investigate suspected fraud, attacks, abuse or unlawful activity;
• protect the rights, systems, personnel, customers or property of Cyberware or another person; or
• complete a corporate transaction such as a merger, acquisition or restructuring, subject to applicable data-protection requirements.

Any disclosure will be limited to what is reasonably necessary and legally permitted.

XXXIII. DEFINITIONS

Personal Data / Personal Information means information relating to an identified or identifiable natural person, or the corresponding concept under applicable privacy law.

Processing means any operation performed on personal data, including collecting, recording, organising, storing, consulting, using, transmitting, restricting or deleting it.

Controller means the person or organisation that determines the purposes and means of processing.

Processor means a person or organisation that processes personal data on behalf of a controller.

Cookie means a small piece of data stored on or accessed from your browser or device.

Tracker means a cookie or another technology capable of storing, accessing, recognising or otherwise relating activity to a browser, device or user.

Sale, Sharing and Targeted Advertising have the meanings given to those terms under the applicable U.S. privacy law.

References to the GDPR mean Regulation (EU) 2016/679.

XXXIV. CONTACT

For questions regarding this Privacy Policy or Cyberware's use of your personal data, or to exercise a privacy right, contact:

Cyberware Ltd (formerly Bulhack Ltd)

16 Hadzhi Dimitar St.

2100 Elin Pelin, Sofia Region, Bulgaria

European Union

Privacy: [email protected]

General enquiries: [email protected]

Careers: [email protected]

Security reports: [email protected]