Privacy Notice

Cyber Heroez CIC is the data controller responsible for your personal data. We are a Community Interest Company registered in England and Wales, providing cybersecurity education and awareness programmes.

If you have any questions about how we handle your data, please contact us at: hello@cyberheroez.co.uk

We collect personal data in the following ways:

Contact Form: When you send us a message, we collect your name, email address, and the content of your message.

Newsletter Signup: When you subscribe to our newsletter, we collect your email address.

Admin Access: Our administrative dashboard is protected by email and password authentication. We collect and store admin user credentials (email address and encrypted password) to enable authorised access.

We do not collect any sensitive personal data through these websites. If you are a teacher or parent making an enquiry on behalf of a school or young person, we will treat the information you provide as relating to you as the responsible adult.

The Hero Skool learning platform is different, and is covered separately. Pupils sign in to app.heroskool.co.uk and the platform records their learning — lessons completed, quiz answers, code they write, work they submit, and the grades and feedback their teachers give. That is personal data collected directly from young people, through their school. A dedicated privacy notice for the platform is being prepared with our advisers; until it is published, schools and parents can ask us anything about it at hello@cyberheroez.co.uk.

We use the personal data we collect for the following purposes:

- Responding to enquiries: To reply to messages submitted via our contact form. - Sending updates: To send newsletters and programme updates to subscribers who have given consent. - Admin authentication: To verify the identity of authorised administrators accessing our CMS. - Improving our services: To understand how our website is used and improve our content and user experience (using anonymised data only).

We process your personal data on the following lawful bases under UK GDPR:

- Legitimate interests: We process contact form submissions to respond to your enquiry, which we believe is in both your and our legitimate interest. - Consent: We process your email address for newsletter communications only with your explicit consent. You may withdraw this consent at any time by unsubscribing. - Contractual necessity: We process admin account details to provide access to our content management system.

Your personal data is stored securely using Supabase, a cloud database provider that operates within the European Economic Area (EEA). Data is encrypted at rest and in transit using industry-standard TLS encryption.

Access to your personal data is restricted to authorised Cyber Heroez staff only. We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, or destruction.

We retain your personal data only for as long as is necessary for the purposes for which it was collected:

- Contact form submissions: Retained for up to 24 months to allow us to follow up on enquiries and maintain records of communications. - Newsletter subscriptions: Retained until you unsubscribe. We will remove your data promptly upon unsubscription. - Admin accounts: Retained for as long as the individual holds an active administrative role with Cyber Heroez CIC.

After these periods, your data will be securely deleted or anonymised.

This notice covers three websites: cyberheroez.co.uk, heroskool.co.uk, and the Hero Skool learning platform at app.heroskool.co.uk.

We do not use analytics of any kind on any of them. No Google Analytics, no Meta Pixel, no page-view measurement, and nothing that tracks you across other websites or builds a profile of you.

Cookies. cyberheroez.co.uk sets one cookie, an authentication session cookie created when an authorised administrator signs into our content management system; it is never set for general visitors. app.heroskool.co.uk sets a session cookie when a user signs in, which is strictly necessary to keep them signed in. heroskool.co.uk sets no cookies at all.

Both cookies are strictly necessary for a service you have asked for, so no cookie consent banner is required and you will not see one.

We do not sell, rent, or share your personal data with third parties for marketing purposes.

We use the following processors, each of which processes data on our behalf under a Data Processing Agreement and in compliance with UK GDPR:

- Supabase — stores and manages data submitted through our websites. - Vercel Inc. — hosts our websites. Vercel is based in the United States, and transfers are covered by the safeguards in its Data Processing Agreement.

We may disclose your data if required to do so by law or in response to a valid request from a law enforcement authority.

Cyber Heroez CIC works extensively with schools and young people.

These websites — cyberheroez.co.uk and heroskool.co.uk — do not collect personal data from children. All enquiries about school programmes should be made by a teacher, parent or guardian, and we treat that information as relating to the responsible adult.

The Hero Skool learning platform at app.heroskool.co.uk does. Pupils are given accounts by their school and their work is recorded so their teachers can support them. Pupil accounts deliberately require no email address, and pupils are never shown the class grade grid.

Where a school provides the platform to its pupils, the school decides what is taught and who has access. If you are a parent or carer and want to know what we hold about your child, or want it corrected or removed, contact your child's school in the first instance — they can raise it with us directly. You can also contact us at hello@cyberheroez.co.uk.

A dedicated privacy notice for the learning platform, setting out the lawful basis, retention periods and the respective roles of the school and Cyber Heroez CIC, is being prepared with our advisers.

Under UK GDPR, you have the following rights regarding your personal data:

- Right of access: You can request a copy of the personal data we hold about you. - Right to rectification: You can ask us to correct inaccurate or incomplete data. - Right to erasure: You can ask us to delete your personal data where there is no legitimate reason for us to continue processing it. - Right to restrict processing: You can ask us to limit how we use your data in certain circumstances. - Right to data portability: You can request your data in a machine-readable format. - Right to object: You can object to our processing of your data where we rely on legitimate interests. - Right to withdraw consent: Where processing is based on consent, you can withdraw it at any time.

To exercise any of these rights, please contact us at hello@cyberheroez.co.uk. We will respond within one month of receiving your request.

We may update this Privacy Notice from time to time to reflect changes in our practices or applicable law. Any changes will be posted on this page with an updated 'Last Updated' date. We encourage you to review this notice periodically.

If you have any questions or concerns about how we handle your personal data, please contact us:

Cyber Heroez CIC Email: hello@cyberheroez.co.uk

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection regulator:

Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF www.ico.org.uk | 0303 123 1113