1. Who we are
The Zyber Security ("ZyberSecurity", "we", "us") operates the website at https://thezybersecurity.com and provides the offensive-security and compliance services described elsewhere on this site. For the personal data described in this policy we act as: Data Controller under GDPR; Business under CCPA/CPRA; Data Fiduciary under India's DPDP Act 2023.
General contact: contact@thezybersecurity.com. Privacy contact / DPO: privacy@thezybersecurity.com. Grievance officer (India, DPDP): grievance@thezybersecurity.com.
2. What data we collect
- Contact data — name, business email, organization, role, message content — provided by you via the contact form.
- Engagement data — client scoping details, statements of work, engagement artifacts. Handled under a separate MSA / DPA.
- Technical data — IP address, user agent, coarse geolocation derived from IP, referrer, requested URL, timestamps. Collected in server logs for security and troubleshooting.
- Analytics data — aggregate page views, referrers, country, device type, browser and page-speed measurements, collected with Vercel Web Analytics and Vercel Speed Insights. Neither sets cookies or stores identifiers on your device; visitors are not tracked across sites or days. If your browser sends the Global Privacy Control signal, no analytics are recorded. No ad-network cookies are ever set.
- Bot-protection data — when you use the contact form, Cloudflare Turnstile processes technical signals (such as IP address and browser characteristics) to tell people from automated abuse.
- Cookies — see our Cookie Policy.
We do not intentionally collect data of children under the applicable age of digital consent (13 in the US, 16 in most of the EU, 18 in India under DPDP).
3. Why we use it — legal bases
| Purpose | Data used | GDPR basis | CCPA purpose | DPDP basis |
|---|---|---|---|---|
| Respond to inquiries | Contact data | Legitimate interest / Contract steps | Business purpose | Legitimate use / consent |
| Deliver services | Engagement data | Contract | Business purpose | Contract / consent |
| Site security & abuse prevention | Technical data | Legitimate interest | Security | Legitimate use |
| Cookieless, aggregate analytics | Aggregate technical data | Legitimate interest | Analytics | Legitimate use |
| Contact-form bot protection | Technical data | Legitimate interest | Security | Legitimate use |
| Legal compliance | All above | Legal obligation | Legal compliance | Legal obligation |
4. Who we share it with
- Sub-processors listed in our current DPA (updated periodically) — cloud hosting, email delivery, calendar scheduling, and error monitoring. Every sub-processor is bound by SCCs where personal data leaves its home region.
- Professional advisers (legal, accounting, insurers) under duties of confidentiality.
- Public authorities when required by law and only to the minimum extent required.
We do not sell your personal information, and we do not share it for cross-context behavioral advertising as those terms are defined by CCPA/CPRA. See Section 9 (Do Not Sell or Share).
5. International transfers
Personal data may be processed in the EU/UK, US, and India. For EU→non-adequate-country transfers we rely on the EU Standard Contractual Clauses (SCC 2021/914) plus supplementary measures. For UK transfers we rely on the UK IDTA. For India-outbound transfers we rely on DPDP Act 2023 Section 16 mechanisms and contract-based safeguards.
6. How long we keep it
- Contact-form inquiries: 24 months from last interaction, unless you become a client.
- Server logs: 90 days (rolling).
- Client engagement data: per contract, typically 7 years for tax and audit obligations.
- Analytics: aggregate only; no personal identifiers retained beyond 14 months.
7. Your rights
Under GDPR / UK GDPR you have the right to access, rectify, erase, restrict, port, and object; and to withdraw consent where processing is consent-based. You may lodge a complaint with your supervisory authority.
Under CCPA/CPRA (California residents) you have the right to know, delete, correct, opt-out of sale/sharing (we do not sell), limit the use of Sensitive Personal Information, and non-discrimination for exercising rights.
Under DPDP Act 2023 (India) you have the right to obtain a summary of your data, correction, completion, updating, erasure, and grievance redressal.
To exercise any right, email privacy@thezybersecurity.com. We respond within 30 days (GDPR / DPDP) or 45 days (CCPA), with one extension permitted where legally allowed.
8. Do Not Sell or Share (California)
The Zyber Security does not sell your personal information and does not share it for cross-context behavioral advertising. If you are a California resident and want to confirm this or exercise related rights, contact privacy@thezybersecurity.com with "Do Not Sell / Share" in the subject line. We also honor the Global Privacy Control (GPC) signal automatically.
9. Grievance officer (India, DPDP)
Grievance officer: grievance@thezybersecurity.com. We acknowledge receipt within 3 business days and provide substantive response within the statutory 30-day window.
10. Security
We apply reasonable security practices and procedures aligned to the ISO/IEC 27001:2022 framework and India's Reasonable Security Practices Rules 2011. Personal data in transit is TLS-encrypted; at rest is AES-256 encrypted; access is least-privilege and MFA-gated.
11. Changes to this policy
We may update this policy from time to time. When we do, we update the "Last updated" date above and — for material changes — provide reasonable advance notice by email to clients and prominent notice on this page.
12. Contact
Questions? Email privacy@thezybersecurity.com.