Privacy Policy
Last updated: [date]
1. Controller
Cibera Security ([legal entity name and address]) is the controller for personal data about Cibera OSINT customers and their users. [Data protection officer or privacy contact.]
2. Customer and user data
We process account data (username, email address, organization and role), authentication and audit records, subscription and billing records, and the content your organization creates, such as watchlists, investigations and notification settings. Payment card details are handled by our payment provider and are not stored by Cibera OSINT.
When you request security services on our website or in the console, we process your name, email address, company, optional phone number and the description you provide, to answer your request and prepare a proposal. [Retention period for service requests that do not lead to a contract.]
3. Intelligence data about third parties
Cibera OSINT collects threat intelligence that can contain personal data, such as public social media handles or names in ransomware disclosure claims. We collect only what is needed for security purposes: we do not collect attachments, profile details or contact information from social media. [Lawful basis, legitimate interest assessment and data protection impact assessment summary.] [How people whose data appears in intelligence can exercise their rights.]
4. Purposes and lawful bases
[Table of purposes, lawful bases and retention periods for each category of data.]
5. Recipients and processors
[Hosting provider, email provider, payment provider and any other processors, with their locations and transfer mechanisms where data leaves the European Economic Area.]
6. Retention
Retention depends on the data and your plan. Social media records are deleted after the period configured for their source unless they are referenced by an alert or investigation. [Retention for accounts, billing records and audit logs.]
7. Your rights
You can request access, correction, deletion, restriction, portability and object to processing. [How to make a request and the right to complain to the supervisory authority.]
8. Security
[Summary of technical and organizational measures and breach notification.]