Privacy Policy
1. Data controller
CyberSkjold ApS (CVR [pending registration]) is the data controller for personal data processed via cyberskjold.dk and, for platform administration purposes, for the accounts of company admins. Contact: [privacy@cyberskjold.dk].
2. What we collect
Website visitors: standard technical/log data. Signing up: company name, admin name, email, phone, address, and CVR number. Using the platform: employee names, work emails, course progress, quiz scores, and phishing-simulation interactions (all entered by the customer's own admin, not collected by us directly from individual employees).
3. Purpose and legal basis
We process this data to provide the subscription service (contract performance, Art. 6(1)(b) GDPR), to communicate with customers (legitimate interest, Art. 6(1)(f)), and to comply with legal obligations such as bookkeeping law (Art. 6(1)(c)). Employee training data is processed as a data processor on the customer's instructions — see the Data Processing Agreement.
4. Retention
Account and billing data is kept for the duration of the customer relationship plus the period required by the Danish Bookkeeping Act (currently 5 years). Employee training data is deleted or anonymised no later than 12 months after an employee is removed from the customer's account, unless the customer instructs otherwise.
5. Sharing
We do not sell personal data. Data may be shared with hosting/infrastructure sub-processors strictly to operate the service, under written data processing agreements, and only within the EU/EEA unless an adequate safeguard (e.g. EU Commission adequacy decision or Standard Contractual Clauses) applies.
6. Your rights
Under GDPR you have the right to access, correct, delete, restrict, and object to processing of your personal data, and to data portability where applicable. Requests can be sent to [privacy@cyberskjold.dk]. You may also lodge a complaint with the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk).
7. Cookies
The site uses only strictly necessary cookies (session/login). No marketing or analytics cookies are set without separate consent.