Legal & Security
Policies, terms and responsible disclosure.
How we handle information on this website.
Last updated: 6 September 2026
Information we collect
Information you choose to provide through contact, enquiry, complaint, assessment or recruitment forms, such as your name, work email, organisation and message.
Basic technical information generated when you use the website, such as device, browser, IP address, pages visited and security logs, where enabled.
How we use information
To respond to enquiries, deliver requested services, manage relationships, improve the website and protect our systems.
To meet legal, regulatory, contractual and security obligations where they apply.
Sharing and retention
We do not sell personal information. Information may be shared with service providers or professional advisers where necessary to operate the website, deliver services or meet legal obligations.
We retain information only for as long as reasonably necessary for the purpose for which it was collected, subject to applicable legal and business requirements.
Security and your choices
We use reasonable administrative, technical and organisational measures designed to protect information from unauthorised access, loss or misuse.
You may contact Cyberoutcome to ask about personal information you have provided, request a correction, or raise a privacy concern. Requests are handled in line with applicable requirements.
The terms that apply when you use this website.
Last updated: 6 September 2026
Information we collect
You may use this website for lawful informational and business purposes. You must not attempt to disrupt the site, bypass security controls, introduce malicious code or use the site in a way that could harm Cyberoutcome, its clients or other users.
Information on the site
Website content is provided for general information. It does not constitute legal advice, regulatory certification, a security guarantee or a binding commitment unless expressly stated in a signed agreement.
Cybersecurity, technology and regulatory requirements change. We may update content without notice.
Intellectual property
Unless otherwise stated, the website design, copy, graphics, Cyberoutcome branding and original materials are owned by or licensed to Cyberoutcome. You may not reproduce or commercially reuse them without permission.
Third-party products and links
References to technology partners, standards or third-party websites do not transfer responsibility for those third-party products or services to Cyberoutcome. Third-party sites are governed by their own terms and policies.
Availability and liability
We aim to keep the website accurate, secure and available, but we do not promise uninterrupted access or that every item of content will always be complete or current.
To the extent permitted by applicable law, use of this website is at your own risk and Cyberoutcome is not responsible for indirect loss arising solely from reliance on website content.
Changes to these terms
We may update these Terms of Use from time to time. Continued use of the website after an update means the revised terms apply from the published update date.
Help us address security issues responsibly.
If you believe you have found a security weakness affecting a Cyberoutcome-owned website or service, please report it privately so it can be reviewed and addressed.
Please do
Provide enough detail for us to understand and reproduce the issue, including the affected page or service and the steps you followed.
Limit testing to what is necessary to demonstrate the issue.
Protect any information you encounter and report the issue privately.
Give us reasonable time to investigate and remediate before making details public.
Please do
Access, copy, alter or delete data that does not belong to you.
Use phishing, social engineering, credential attacks, denial-of-service testing or other activity that could disrupt users or systems.
Install malware, create persistence, move laterally through systems or exploit a vulnerability beyond what is needed to demonstrate it.
Demand payment, threaten disclosure or publish sensitive details before we have had an opportunity to investigate.
What happens after you report
We will route the report to the appropriate team, review the information provided and contact you if more detail is needed. Remediation timing will depend on severity, complexity and operational risk.
Help us address security issues responsibly.
If you believe you have found a security weakness affecting a Cyberoutcome-owned website or service, please report it privately so it can be reviewed and addressed.
1. Introduction
At Cyberoutcome Ltd, we are committed to protecting the privacy and security of all personal and sensitive data entrusted to us. This Data Privacy Policy outlines our approach to collecting, processing, storing, and securing data in compliance with global privacy regulations, including GDPR, ISO 27001, NIST, CCPA, and other applicable laws.
2. Scope
This policy applies to: All employees, contractors, and third-party vendors. Any personal, client, or business-sensitive information processed by our systems. Data collected from websites, applications, and customer interactions. Data protection across on-premises, cloud, and third party integrations.
3. Data Collection & Processing
3.1 Data We Collect
We collect only necessary information for business and cybersecurity
operations, including:
- Personal Information: Name, email, phone number, job title, IP address.
- Business Information: Company name, industry, and contractual details.
- Technical Data: Log files, cookies, analytics, and security audit logs.
- Client Data: As part of security assessments, pentests, and managed security services.
3.2 How We Use Data
We process data for: Providing cybersecurity services (threat detection, risk assessments, managed security). Improving security monitoring, incident response, and network protection. Regulatory compliance with industry security standards.
Internal security analysis, research, and anonymized threat intelligence sharing.
3.3 Legal Basis for Processing
We process personal data based on:
Consent: Users provide explicit permission (e.g., newsletters, service requests).
Legitimate Interest: Cybersecurity threat intelligence, security monitoring.
Contractual Obligation: Processing required for service agreements.
Legal Compliance: Adhering to data protection and security regulations.
4. Data Storage & Security
4.1 Data Protection Measures
To ensure data security, we implement:
Encryption: All sensitive data is encrypted at rest and in transit.
Access Controls: Role-based access (RBAC) and multi-factor authentication (MFA).
Access Controls: Role-based access (RBAC) and multi-factor authentication (MFA).
Zero Trust Security Model: Least privilege access principles applied.
Regular Audits: Security assessments and compliance checks.
Incident Response: 24/7 monitoring for data breaches and unauthorized
access.
4.2 Data Retention & Deletion
- We retain data only as long as necessary for business and regulatory requirements.
- Users may request data deletion as per legal guidelines.
- Secure disposal methods (data wiping, cryptographic erasure) are used to prevent data leaks.
5. Data Sharing & Third-Party Transfers
5.1 When We Share Data
We never sell or trade personal data. However, we may share data with: Law enforcement & regulators (if legally required). Service providers (e.g., cloud security vendors, data centers) under strict data protection agreements. Clients for cybersecurity assessments, security monitoring, and compliance reporting.
5.2 Cross-Border Data Transfers
If transferring data internationally, we ensure: Compliance with GDPR (Standard Contractual Clauses – SCCs). Data transfer protections via secure, encrypted channels. Regular assessments of third-party compliance and security.
6. User Rights & Privacy Controls
As per GDPR, CCPA, and other privacy laws, users have the right to:
Access & Correction: Request a copy of stored personal data.
Data Portability: Receive personal data in a structured format.
Restrict Processing: Limit how data is used in certain cases.
Erasure (“Right to be Forgotten”): Request deletion of personal data, subject to legal retention policies.
Withdraw Consent: Opt-out of marketing, analytics, and non-essential data processing.
7. Cookies & Tracking Technologies
We use cookies and analytics tools for:
- Website performance optimization.
- Security monitoring (e.g., detecting suspicious activities).
- User experience improvements.
- Users can manage cookie preferences via browser settings or our website’s cookie consent tool.
8. Data Breach Response
8.1 Incident Handling
In case of a data breach, we: Investigate – Identify affected systems, root cause, and impact. Contain – Secure compromised systems and prevent further exposure.
Notify – Inform affected users and regulatory bodies within 72 hours (as per GDPR).
Remediate – Apply security patches, enforce stronger security controls, and update policies.
9. Compliance & Regulatory Framework
We align with global security and privacy regulations, including:
- ISO 27001 – Information Security Management System (ISMS).
- NIST 800-53 – Cybersecurity controls for secure operations.
- GDPR – Data privacy and protection for EU users.
- CCPA – Consumer data rights for California residents.
- PCI DSS – Financial transaction security compliance.
10. Policy Updates & Contact Information
10.1 Updates to This Policy
We review and update this policy annually or in response to:
- Regulatory changes.
- New security threats.
- Business process updates.
- Users will be notified of significant changes via email or website announcements.
Final Notes
This Data Privacy Policy reflects Cyberoutcome Ltd’s commitment to securing data and ensuring compliance with international privacy laws. We continuously monitor security practices to maintain the highest standards of data protection and cybersecurity
