[ PRIVACY POLICY ]

§1. Data Controller

The controller of personal data of the KS-CYBER OPS platform users (ops.ks-cyber.pl) and of visitors to the ks-cyber.pl website is:

For data protection inquiries, please contact: kontakt@ks-cyber.pl

Two Processing Regimes

The platform operates under two distinct data processing regimes:

1. Direct users (account owners, persons placing orders) — KS-CYBER acts as the Data Controller.
2. Employees of client organizations (persons invited to the platform by their employer) — the employer (client organization) is the Data Controller of its employees' data; KS-CYBER acts as the Data Processor under a Data Processing Agreement (Art. 28 GDPR).

§2. Data We Collect

2.1. Account Data

• Email address (login)
• First and last name (optional)
• Password (stored as an Argon2id hash — never in plain text)
• FIDO2/WebAuthn keys (public key cryptographic data)

2.2. Organization Data

• Company name, billing details (Tax ID, address)
• Subscription plan, activation/expiration dates

2.3. Training Results

• Phishing simulation and test results (scores, duration, answers)
• Date and time of training completion
• Behavioral events during exams: tab switch count (tab_switches), paste events (paste_events)
• Completion certificates

2.4. Technical Data and Logs

• IP address (login, physical access tokens)
• Browser User-Agent
• Session logs (login/logout times)
• Application error logs

2.5. Payment Data

Payment card details are NOT stored by KS-CYBER. Payments are processed by Stripe Inc. KS-CYBER only stores Stripe payment session identifiers (session_id) and payment status.

§3. Purposes and Legal Bases for Processing

§4. Data Recipients / Sub-processors

KS-CYBER does not sell personal data to third parties.

§5. Transfers Outside the EEA

Employee data and training results are processed exclusively on AWS servers in the eu-central-1 (Frankfurt) region — this data does not leave the European Economic Area.

For Stripe payments, transactional data may be transferred to the USA under the Data Privacy Framework (DPF) or Standard Contractual Clauses (SCCs) in accordance with Art. 46 GDPR.

Analytics and advertising data (Google Analytics 4, Google Signals, Google Ads) are transferred on the same basis — the scope, purpose and how to withdraw consent are described in §8a.

§6. Retention Periods

§7. Data Subject Rights

Every person whose data we process has the right to:

• Access their data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (“right to be forgotten”) (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability in JSON/CSV format (Art. 20 GDPR)
• Objection to processing based on legitimate interest (Art. 21 GDPR)
• Withdrawal of consent at any time (without affecting the lawfulness of prior processing)

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, or with your local supervisory authority.

§8. Cookies

Essential cookies (ops_sid, ops_csrf, ks_cookie_consent) are required for the service to function and cannot be refused. Analytics cookies are set only after you give consent — both on the ks-cyber.pl website and on the ops.ks-cyber.pl platform.

Where analytics actually runs on the platform. Inside the application, once you are logged in, we do not measure your behaviour — browsing courses, results and work in the panel are not sent to Google Analytics. Analytics covers public pages and the purchase path only: the home page, the partner programme, the trial form, the order form and the confirmation pages. On the last two we record the mere fact of a trial sign-up or a purchase — also when you happen to be logged in — because otherwise we could not tell which advertisement brought you to us.

You can withdraw consent at any time by deleting cookies in your browser settings or by clicking „Cookie settings” in the footer — the banner will then appear again.

Measurement without cookies. Regardless of your cookie decision, the website uses Cloudflare Web Analytics — a tool that sets no cookies and does not profile visitors, counting only aggregated page views and basic technical request parameters (including the IP address, processed by Cloudflare as a processor).

§8a. Google Analytics, Google Signals and advertising

With your consent to analytics cookies we use Google Analytics 4 (measurement ID G-8H8M7VH2P3), provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We measure traffic on the ks-cyber.pl website and on the public pages of the ops.ks-cyber.pl platform. Both domains are ours and share one measurement property, so moving from the website to the platform counts as a single visit rather than two.

Google Signals. We have enabled Google Signals in Google Analytics. This means Google may associate data about your visit with information from your Google account — but only when all of the following are true at once: you are signed in to a Google account, that account has ads personalisation switched on, and you have given us consent to analytics cookies. If any one of these is missing, no association takes place.

Why we do it: it lets us see whether the same person returns from another device, gives us aggregated data on the age, gender and interests of our visitors (in aggregate form only — we never see this about an individual), and lets us build audience lists for advertising campaigns. We do not use this data to make decisions with legal effects concerning you, and we do not profile you within the meaning of Art. 22 GDPR.

Google Ads. Our Google Analytics property is linked to Google Ads account no. 829-699-5035, with ads personalisation enabled on that link. In practice this means Google Ads receives: the fact that you performed an action we measure as a conversion (starting a trial, placing an order, applying to the partner programme, submitting a form), and your membership of audience lists used for remarketing. We do not send Google your name, e-mail address or phone number — the transfer of hashed customer data (user-provided data) is deliberately switched off.

Legal basis. Art. 6(1)(a) GDPR — your consent, given in the cookie banner. Without consent Google scripts are not loaded at all. You may withdraw consent at any time (see §8); withdrawal does not affect the lawfulness of processing carried out beforehand.

How you control this on Google's side. Independently of our banner you have Google's own tools, which we do not control and which you do not need to arrange with us:

• myaccount.google.com/data-and-privacy — Google account privacy settings, including turning off ads personalisation (which takes you out of Google Signals);
• myactivity.google.com — review and delete activity linked to your Google account;
• tools.google.com/dlpage/gaoptout — a browser add-on that blocks Google Analytics on every site.

Transfers outside the EEA. Google Ireland Limited may transfer data to Google LLC in the United States. The basis is the European Commission adequacy decision (EU–US Data Privacy Framework), supplemented by Standard Contractual Clauses (Art. 46 GDPR). Google LLC appears on the list of DPF-certified entities.

Retention. Event data in Google Analytics is retained for 14 months and then deleted automatically. Analytics cookies (_ga, _ga_*) expire 2 years after your last visit.

§9. Security

KS-CYBER implements the following technical and organizational measures to protect data:

• Data transmission encryption (TLS 1.2+)
• Password hashing using Argon2id (with PBKDF2-SHA256 fallback)
• Multi-factor authentication (TOTP, FIDO2/WebAuthn)
• Database access control (AWS RDS, private VPC network)
• Automated database backups (AWS automated backups)
• System access audit logs
• IP allowlisting for physical access tokens
• Regular code security reviews

§10. Changes to This Policy

KS-CYBER reserves the right to amend this Privacy Policy. We will notify you of material changes via email to the address registered in the system, or through a notice displayed after login.

The date of the last update is shown at the top of this document.

§11. Contact