Privacy Notice

Cyber Heroez CIC is the data controller responsible for your personal data. We are a Community Interest Company registered in England and Wales, providing cybersecurity education and awareness programmes.

If you have any questions about how we handle your data, please contact us at: hello@cyberheroez.co.uk

We collect personal data in the following ways:

Contact Form: When you send us a message, we collect your name, email address, and the content of your message.

Newsletter Signup: When you subscribe to our newsletter, we collect your email address.

Admin Access: Our administrative dashboard is protected by email and password authentication. We collect and store admin user credentials (email address and encrypted password) to enable authorised access.

We do not collect any sensitive personal data, and we do not collect personal data from children directly. If you are a teacher or parent making an enquiry on behalf of a school or young person, we will treat the information you provide as relating to you as the responsible adult.

We use the personal data we collect for the following purposes:

- Responding to enquiries: To reply to messages submitted via our contact form. - Sending updates: To send newsletters and programme updates to subscribers who have given consent. - Admin authentication: To verify the identity of authorised administrators accessing our CMS. - Improving our services: To understand how our website is used and improve our content and user experience (using anonymised data only).

We process your personal data on the following lawful bases under UK GDPR:

- Legitimate interests: We process contact form submissions to respond to your enquiry, which we believe is in both your and our legitimate interest. - Consent: We process your email address for newsletter communications only with your explicit consent. You may withdraw this consent at any time by unsubscribing. - Contractual necessity: We process admin account details to provide access to our content management system.

Your personal data is stored securely using Supabase, a cloud database provider that operates within the European Economic Area (EEA). Data is encrypted at rest and in transit using industry-standard TLS encryption.

Access to your personal data is restricted to authorised Cyber Heroez staff only. We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, or destruction.

We retain your personal data only for as long as is necessary for the purposes for which it was collected:

- Contact form submissions: Retained for up to 24 months to allow us to follow up on enquiries and maintain records of communications. - Newsletter subscriptions: Retained until you unsubscribe. We will remove your data promptly upon unsubscription. - Admin accounts: Retained for as long as the individual holds an active administrative role with Cyber Heroez CIC.

After these periods, your data will be securely deleted or anonymised.

This website uses only one cookie: an authentication session cookie set when an authorised administrator logs into our content management system. This cookie is strictly necessary for the admin function and is not set for general website visitors.

We do not use any tracking, analytics, advertising, or marketing cookies. We do not use Google Analytics, Meta Pixel, or any similar third-party tracking technology. You will not see a cookie consent banner on this website because there is nothing to consent to as a public visitor.

We do not sell, rent, or share your personal data with third parties for marketing purposes.

We use Supabase as our data processor to store and manage data submitted through our website. Supabase processes data on our behalf under a Data Processing Agreement and in compliance with UK GDPR.

We may disclose your data if required to do so by law or in response to a valid request from a law enforcement authority.

Cyber Heroez CIC works extensively with schools and young people, but we do not collect personal data directly from children through this website. All enquiries related to school programmes should be made by a teacher, parent, or guardian.

If you believe we have inadvertently collected data from a child, please contact us immediately at hello@cyberheroez.co.uk and we will take prompt steps to delete it.

Under UK GDPR, you have the following rights regarding your personal data:

- Right of access: You can request a copy of the personal data we hold about you. - Right to rectification: You can ask us to correct inaccurate or incomplete data. - Right to erasure: You can ask us to delete your personal data where there is no legitimate reason for us to continue processing it. - Right to restrict processing: You can ask us to limit how we use your data in certain circumstances. - Right to data portability: You can request your data in a machine-readable format. - Right to object: You can object to our processing of your data where we rely on legitimate interests. - Right to withdraw consent: Where processing is based on consent, you can withdraw it at any time.

To exercise any of these rights, please contact us at hello@cyberheroez.co.uk. We will respond within one month of receiving your request.

We may update this Privacy Notice from time to time to reflect changes in our practices or applicable law. Any changes will be posted on this page with an updated 'Last Updated' date. We encourage you to review this notice periodically.

If you have any questions or concerns about how we handle your personal data, please contact us:

Cyber Heroez CIC Email: hello@cyberheroez.co.uk

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection regulator:

Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF www.ico.org.uk | 0303 123 1113