Privacy Policy

2.1 When you contact us

Through the form at /contact or by email: the name you provide, the work email address, the role and organisation you optionally name, and the content of your message. Submitted only when you click "Send".

2.2 When you subscribe to Insights

Your email address, plus an opt-in record (date, time, source page). Used only to deliver the digest you subscribed to. Unsubscribe in one click.

2.3 When you enrol in a training cohort

Name, contact details, employer or sponsoring institution, relevant qualifications, and cohort-specific data (attendance, graded submissions, certification status). Where a corporate or academic sponsor pays, sponsor contact data is also collected.

2.4 When you use a Cyberange product or engagement

For Virtual Labs, AttackWiz, and TAW: account identifiers, tenant identifiers, telemetry generated during your use of the product. For consulting engagements (Adaptive Red Team, DFIR, Threat Hunting), processing is governed by the engagement contract; this policy is supplemented by that contract for engagement-specific data.

2.5 Technical data we collect automatically

Server logs record the IP address from which a request originated, the user-agent string, the page requested, and the timestamp. Used for security monitoring, fraud and abuse prevention, and performance debugging. We do not link server-log IPs to identified visitors unless they have separately submitted personal data (e.g., via the contact form) and the linkage is required for security investigation.

2.6 Analytics

We use Plausible Analytics, a privacy-friendly analytics service. Plausible does not set cookies, does not collect personal data, does not track visitors across sites, and does not require a consent banner under GDPR or the ePrivacy Directive. The metrics it produces (page views, referrer, top pages, country of visitor at country-granularity) are aggregate and anonymous. See Plausible's data policy for full details.

2.7 What we don't collect

We do not collect special-category data (religion, ethnicity, health, biometric, sexual orientation) through this website. Children's data is not collected through the public site; for Cyberbay school deployments, all student-level data is handled under a separate agreement with the deploying school as Data Fiduciary.

7.1 Rights under the DPDP Act 2023

• · Right to access information — to know what personal data we hold and how it is processed (§11).
• · Right to correction and erasure — to ask us to correct inaccurate data or erase data that is no longer needed (§12).
• · Right to grievance redressal — to raise a grievance with our Grievance Officer (§13).
• · Right of nomination — to nominate another individual to exercise your rights in case of death or incapacity (§14).
• · Right to withdraw consent — at any time, with effect from the date of withdrawal (§6).

7.2 Rights under the GDPR

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you additionally have the following rights (GDPR Chapter III):

• · Right of access (Article 15).
• · Right to rectification (Article 16).
• · Right to erasure ("right to be forgotten", Article 17).
• · Right to restriction of processing (Article 18).
• · Right to data portability (Article 20).
• · Right to object to processing based on legitimate interest (Article 21).
• · Right not to be subject to a decision based solely on automated processing, including profiling (Article 22). Cyberange does not currently take any decisions about visitors based on solely automated processing.
• · Right to lodge a complaint with a supervisory authority in the EU/EEA Member State of your habitual residence (Article 77).

7.3 How to exercise your rights

Send the request to [email protected]. Include enough information to identify you and the data you are asking about; we may need to verify your identity before acting. There is no fee unless the request is manifestly unfounded or excessive, in which case we will explain why before charging.