GDPR Compliance and Data Privacy

Overview

Overview

This page explains how Cyberlord handles personal data under the General Data Protection Regulation (EU) 2016/679 and related laws. It covers what is collected, the legal basis for processing, where data is stored, how long it is kept, and how to exercise your rights. It is written for clients, prospective clients, and website visitors. Because security work involves access to live systems and credentials, it also covers sensitive material encountered during testing.

Who Is Responsible

Cyberlord is the data controller for the personal data described here, with an address in Vienna, Austria. Privacy questions go to privacy@cyberlords.io and data protection matters to the Data Protection Officer at dpo@cyberlords.io. Where Cyberlord processes data on a client's instruction during an engagement, the roles and obligations sit in the contract and the data processing agreement rather than on this page, so request the processing terms for your engagement if needed for a vendor review.

What Is Collected

Categories are contact information such as name, email, phone number, and job title; company information such as organisation name, address, and industry; technical data such as IP addresses and system logs, collected during testing only; and communication data such as emails, meeting notes, and service tickets. Testing may also surface authentication credentials where access is necessary, vulnerability information, and system configuration data. Special category data such as race, religion, or health is not intentionally collected and is deleted immediately if encountered.

Legal Bases and Sharing

Processing rests on contract performance where it is needed to deliver services, legitimate interests such as improving services and preventing fraud, consent for marketing, and legal obligation where the law requires it. Data may be shared with cloud service providers for hosting and storage, payment processors, and security tool vendors, all GDPR compliant and bound by data processing agreements. Disclosure also happens where a court order, legal process, or law enforcement request requires it or where it protects legal rights. Personal data is not sold and client findings are not shared without permission.

Security and Storage

Data is encrypted with TLS 1.3 in transit and AES-256 at rest, and backups are encrypted and access-controlled. Access follows role-based control, mandatory multi-factor authentication, and least privilege, with regular access reviews. Primary storage sits in EU data centres with encrypted backups in redundant locations. Nothing is stored outside the EU or EEA without explicit consent, and any required transfer relies on Standard Contractual Clauses or an adequacy decision.

Retention and Deletion

Retention follows the type of record. Testing data is kept 90 days after an engagement by default, reports for seven years for liability and compliance, contracts for ten years after termination, and financial records for seven years as the law requires. Retention may run longer where the law requires it, where a legal claim needs the data, or a client requests it for compliance purposes. At expiry, data is deleted to DoD 5220.22-M standard, the deletion is verified and documented, and backups are purged on their rotation schedule.

Your Rights and How to Use Them

You can request access to the personal data held about you, correction of inaccurate or incomplete records, erasure subject to legal retention requirements, restriction of processing, portability in a machine-readable format, and objection to processing based on legitimate interests or for marketing. Cyberlord does not use automated decision-making or profiling. Requests go to privacy@cyberlords.io under the subject GDPR Data Subject Request with your name, contact details, and the specific request; identity verification may be required and a response follows within 30 days, extendable to 60 for complex cases.

Breach, Cookies, and Complaints

A breach affecting personal data is notified to the supervisory authority within 72 hours, and to affected individuals without undue delay where there is high risk; every incident is documented and investigated. Cookies are limited to essential functionality and anonymised analytics, controllable through browser settings. Services are not directed at anyone under 16. Complaints may go to the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, telephone +43 1 52 152-0. Policy changes take effect 30 days after notification.