CyfroSec

Legal

Privacy Policy

Last updated: 7 September 2026

1. Who we are

CYFROSEC PROSTA SPÓŁKA AKCYJNA, with its registered office at ul. Józefa Marcika 6, 30-443 Kraków, Poland, entered in the Register of Entrepreneurs of the National Court Register maintained by the District Court for Kraków-Śródmieście in Kraków, 11th Commercial Division of the National Court Register under KRS 0001250469, NIP 6793369771 (“CyfroSec”, “we”, “us” or “our”), is the controller of personal data processed for the purposes described in this Privacy Policy.

You may contact us about privacy matters at privacy@cyfrosec.com or by post at our registered office address.

This Privacy Policy applies when you visit cyfrosec.com or another CyfroSec controlled website, request a demonstration, contact us, subscribe to communications, create or administer an account, use the CyfroSec platform as an authorised user, participate in a free trial, communicate with support, or otherwise interact with CyfroSec in a context in which CyfroSec determines the purposes and means of processing.

2. When CyfroSec is a controller and when it is a processor

CyfroSec acts as an independent controller for personal data relating to website visitors, prospects, business contacts, account administration, billing, service communications, security, fraud prevention, support administration, legal compliance and CyfroSec’s own marketing.

Where CyfroSec processes repositories, source code, scan evidence, asset information, documents, prompts, messages, credentials, findings or other Customer Data on behalf of a business customer, CyfroSec ordinarily acts as a processor and the customer acts as controller. That processing is governed by the customer agreement and, where applicable, the CyfroSec Data Processing Addendum. Individuals whose information is contained in Customer Data should normally direct their request to the relevant customer. CyfroSec will assist the customer as required by applicable data-protection law.

3. Personal data we process

Depending on your interaction with CyfroSec, we may process:

  • identity and business contact information, including name, business email address, telephone number, job title, employer and country;
  • account information, including organisation, account group, role, permissions, authentication events and account-administration records;
  • commercial and billing information, including selected services, subscription information, invoices, payment status, billing contacts and transaction references;
  • communications, including contact-form submissions, demo requests, support requests, emails, meeting notes, feedback and survey responses;
  • technical and usage information, including IP address, browser and device information, operating system, language, time zone, referral source, timestamps, pages or functions used, login events, audit logs, error records and security events;
  • consent and preference information, including marketing choices and cookie consent records;
  • information relating to suspected misuse, fraud, unauthorised access, security incidents, sanctions compliance and legal claims;
  • information received from your employer, colleagues, business partners, events, professional networking services or publicly available professional sources; and
  • any other information that you choose to provide to us.

Customer Data processed through CyfroSec services may include security and technical information that incidentally contains personal data. Customers must not intentionally submit special category personal data, credentials or unrelated personal data unless this has been expressly agreed and appropriate safeguards have been implemented.

4. Purposes and legal bases

We process personal data for the following purposes and legal bases:

Operating and securing the website: We process connection information, server logs, device information and security events to deliver the website, prevent misuse, diagnose failures and protect the confidentiality, integrity and availability of our systems. The legal basis is our legitimate interest in operating and securing our website and services and, where applicable, compliance with a legal obligation.

Responding to enquiries and demo requests: We process the information you provide to respond to your request, organise a demonstration and take steps toward a possible business relationship. The legal basis is taking steps at your request before entering into a contract where you are the prospective contracting party, or our legitimate interest in communicating and conducting business with your organisation.

Creating and administering accounts: We process identity, contact, role, organisation, authentication and account information to create accounts, control access and administer subscriptions. The legal basis is performance of a contract where you are a party, or our legitimate interest in providing services to and managing our relationship with your organisation.

Providing the services and support: We process account, usage and support information to provide selected functionality, maintain the service, respond to support requests, investigate incidents and communicate operational information. The legal basis is performance of a contract where you are a party, or our legitimate interest in performing our contract with your organisation and supporting authorised users.

Billing, accounting and compliance: We process commercial, billing and transaction information to issue invoices, collect payments, maintain accounting records, comply with tax and corporate obligations and establish, exercise or defend legal claims. The legal basis is compliance with legal obligations and our legitimate interest in managing payments and legal claims.

Service security, abuse prevention and audit: We process account activity, audit logs, identifiers and security information to prevent unauthorised access, investigate suspected misuse, enforce contractual restrictions and preserve evidence. The legal basis is our legitimate interest in protecting CyfroSec, our customers, users and third parties and, where applicable, compliance with legal obligations.

Improving our services: We may use aggregated or de-identified technical and usage information to understand performance and improve functionality. Where information remains personal data, the legal basis is our legitimate interest in improving reliable and secure services. Non-essential analytics collected through cookies or similar technologies is processed only after any consent required by law has been obtained.

Marketing and business communications: We may send product information, event invitations and other business communications where you have consented or where applicable law otherwise permits the communication. You may withdraw consent or object to direct marketing at any time by using the unsubscribe mechanism or contacting privacy@cyfrosec.com. We will not continue direct marketing after a valid objection.

Complying with law and responding to authorities: We may process and disclose information where necessary to comply with binding law, court orders, regulatory requirements, sanctions obligations or lawful requests from competent authorities. The legal basis is compliance with a legal obligation or our legitimate interest in protecting legal rights where the request is not based on a legal obligation.

5. Whether you must provide personal data

Providing information marked as required in an account, order, support or contact process is necessary to complete the relevant request or provide the relevant service. If you do not provide required information, we may be unable to create an account, respond to a request, enter into a contract, provide support or supply the service. Optional information is voluntary.

6. Sources of personal data

We normally obtain personal data directly from you. We may also receive business-contact and account information from your employer or organisation, an account administrator, a colleague, a reseller or business partner, an event organiser, a professional networking service or a publicly available professional source. Where a customer submits Customer Data to the service, the customer determines the source and is responsible for providing required notices and having a lawful basis for the processing.

7. Recipients and service providers

We may share personal data with:

  • cloud-hosting, website-hosting, content-delivery, infrastructure, authentication and security providers only when it is mandatory to be provided as per the agreement for delivering the services;
  • providers of AI functionality where the relevant CyfroSec feature is enabled;
  • analytics and consent-management providers where enabled in accordance with your choices;
  • email, collaboration, customer-support, communications and business-administration providers;
  • professional advisers, auditors, insurers and financial institutions;
  • resellers, implementation partners or contractors involved in providing an agreed service;
  • competent authorities, courts and law-enforcement bodies where disclosure is required or permitted by law; and
  • a prospective buyer, investor or successor in connection with a corporate transaction, subject to appropriate confidentiality and data-protection safeguards.

Providers acting as processors may process personal data only for the agreed purposes and under appropriate contractual obligations. The current list of material subprocessors used for Customer Personal Data is available at https://www.cyfrosec.com/subprocessors/.

8. International transfers

CyfroSec is established in Poland and uses European hosting for its primary customer-facing services as described in the applicable Order Form. Some providers or their subprocessors may process personal data outside the European Economic Area.

Where personal data is transferred outside the EEA, we use a lawful transfer mechanism, such as an adequacy decision, the European Commission’s Standard Contractual Clauses or another mechanism permitted by applicable law. Where appropriate, we assess the transfer and apply supplementary contractual, technical or organisational safeguards. Information about an applicable transfer mechanism may be requested from privacy@cyfrosec.com, subject to the protection of confidential or security-sensitive information.

9. Retention

We retain personal data only for as long as necessary for the relevant purpose, including:

  • website security logs: normally up to 90 days, unless a longer period is necessary to investigate an incident, prevent abuse or establish a legal claim;
  • contact and demo enquiries: for the duration of the enquiry and ordinarily up to 24 months after the last substantive interaction, unless a business relationship begins or a valid objection requires earlier suppression;
  • account and authorised-user information: for the duration of the account or subscription and thereafter for the period required to close the account, meet legal obligations and handle claims;
  • support records: for the duration of the customer relationship and thereafter for the period reasonably required for continuity, audit, dispute handling and legal claims;
  • billing, tax and accounting records: for the period required by applicable law;
  • marketing information: until consent is withdrawn, a valid objection is received or the information is no longer required for the communication purpose;
  • consent, objection and suppression records: for as long as reasonably necessary to demonstrate and respect the relevant choice and protect legal claims; and
  • security-incident, fraud and legal-claim information: for the duration of the investigation or proceeding and the applicable limitation or statutory retention period.

Customer Data follows the lifecycle stated in the customer agreement and the Data Retention, Export, Switching and Deletion Notice. Paid-subscription Customer Data is ordinarily available for retrieval for 30 calendar days after termination or expiry and scheduled for permanent deletion from CyfroSec systems 90 calendar days after termination or expiry, subject to legal holds, mandatory retention and backup ageing. Data associated with a 14-day free trial is scheduled for deletion 120 calendar days after trial expiry unless the trial is converted to a paid subscription. Data removed from active systems may remain in protected backups for a maximum ordinary backup-ageing period of 90 days.

10. Cookies and similar technologies

We use cookies and similar technologies for authentication, security, consent management, preferences and, where enabled with consent, analytics or marketing. Non-essential technologies remain disabled until any required consent is obtained. Further information and the current cookie register are available at https://www.cyfrosec.com/cookies/. You may change your choices at any time using the “Cookie settings” control available on the website.

11. AI-assisted features

Certain CyfroSec services include AI-assisted functionality. AI-generated output may contain errors and is intended to support, not replace, appropriate human review and professional judgment. CyfroSec does not use Paid Subscription Customer Data to train or fine-tune its general-purpose or cross-customer models unless the customer gives separate, express and documented written authorisation.

Where an enabled generative-AI feature uses an external provider, limited information necessary to perform the request may be sent to that provider under contractual and data-protection safeguards. Additional information is available in the AI Transparency Notice at https://www.cyfrosec.com/ai-transparency/.

CyfroSec does not use personal data in its capacity as controller to make decisions based solely on automated processing that produce legal effects concerning an individual or similarly significantly affect an individual.

12. Your rights

Subject to the conditions and limitations of applicable law, you may have the right to:

  • request access to personal data concerning you and receive a copy;
  • request rectification of inaccurate or incomplete personal data;
  • request erasure of personal data;
  • request restriction of processing;
  • object to processing based on legitimate interests;
  • object at any time to processing for direct marketing;
  • receive personal data you provided to us in a structured, commonly used and machine-readable format and transmit it to another controller where the right to portability applies;
  • withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal; and
  • lodge a complaint with a competent supervisory authority.

To exercise a right, contact privacy@cyfrosec.com. We may request information reasonably necessary to verify your identity and authority. We will respond without undue delay and ordinarily within one month, subject to any extension permitted by law.

You may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland, or with another competent supervisory authority, particularly in the EU Member State of your habitual residence, place of work or the alleged infringement.

13. Security

We apply technical and organisational measures appropriate to the risks, including access controls, role-based permissions, encryption for relevant data in transit and at rest, logging, tenant and account-group separation, backup and recovery controls and security review processes. No method of transmission or storage is completely secure, and CyfroSec does not guarantee absolute security.

If you believe you have identified a security vulnerability, use the process at https://www.cyfrosec.com/security/vulnerability-disclosure/ or contact safety@cyfrosec.com.

14. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in our services, processing activities or applicable law. The current version and its effective date will be published on this page. Where a change materially affects an existing processing activity, we will provide additional notice where required by law.

15. Contact

CYFROSEC PROSTA SPÓŁKA AKCYJNA
ul. Józefa Marcika 6, 30-443 Kraków, Poland
Privacy email: privacy@cyfrosec.com
Website: https://www.cyfrosec.com/

CYFROSEC PROSTA SPÓŁKA AKCYJNA · ul. Józefa Marcika 6, 30-443 Kraków, Poland · KRS 0001250469 · NIP 6793369771 · Share capital PLN 100.00 · District Court for Kraków-Śródmieście in Kraków, 11th Commercial Division of the National Court Register