Privacy Policy
Last updated: August 2026
This Privacy Policy explains how Cyberlab Security Limited collects, uses, and protects your personal data when you use the HackRisk platform. We are committed to transparency and your rights under UK GDPR.
1. Who We Are
The data controller for the HackRisk platform is Cyberlab Security Limited (Company No. 12392586), registered in England and Wales, with its registered office at Mereside, Alderley Park, Congleton Road, Macclesfield, SK10 4TG. We are registered with the Information Commissioner's Office (ICO). For all privacy enquiries, please contact [email protected].
2. What Data We Collect
We collect and process the following categories of data: (a) Account data - name, email address, job title, and organisation details provided when you create an account; (b) Technical data - IP addresses, browser type, device identifiers, and usage logs collected automatically when you use the Service; (c) Scan data - domain names, IP ranges, and related technical information you submit for monitoring; (d) Communication data - messages and correspondence you send to us via email or in-app; (e) Payment data - billing address and transaction records (payment card details are processed directly by our payment provider and are not stored by us).
3. How We Use Your Data
We use your data to: (a) provide, maintain, and improve the HackRisk platform; (b) process payments and manage your subscription; (c) send service notifications, security alerts, and account-related communications; (d) send marketing communications where you have given consent or where we have a legitimate interest in doing so (you may opt out at any time); (e) comply with legal obligations; (f) investigate and prevent fraud, abuse, or security incidents; (g) generate anonymised, aggregated statistical insights about platform usage. The legal bases for processing are contract performance, legitimate interests, legal obligation, and consent (where indicated).
4. Data Retention
We retain account data for as long as your subscription is active, plus a further 12 months to handle any post-termination queries. Scan data and reports are retained for the duration of your subscription and deleted within 90 days of account closure. We retain financial records for 7 years to comply with HMRC requirements. Accounts with no purchasing activity are retained for 2 years. You may request earlier deletion subject to our legal obligations.
5. Your Rights (GDPR / UK GDPR)
Under UK GDPR, you have the right to: access a copy of the personal data we hold about you; rectify inaccurate data; request erasure of your data in certain circumstances; restrict or object to processing; request data portability in a structured, commonly used format and receive your personal information in a portable format; withdraw consent where processing is consent-based; and lodge a complaint with the ICO (ico.org.uk). To exercise any of these rights, email [email protected]. We will respond within 30 days.
6. Cookies
We use the following categories of cookies: (a) Functional - strictly necessary for the service to work (e.g. keeping you signed in); (b) Preferences - store your preferences between visits; (c) Statistics - used anonymously to understand how the site is used; (d) Marketing - used to personalise advertising across websites. The essential cookies required for the platform to function (session management, authentication) are Functional cookies, and do not require consent. Subject to your consent, we also use Google Analytics to understand how visitors use the website, Microsoft Clarity to see how pages are used, the LinkedIn Insight Tag to measure our campaigns, Leadfeeder to identify the organisations visiting the site, and Refersion and PartnerStack to credit the partners who refer customers to us. Of those, Google Analytics, Microsoft Clarity and Leadfeeder fall into the Statistics category, and LinkedIn, Refersion and PartnerStack into the Marketing category. Google's tags are loaded with analytics and advertising storage denied until you accept, so declining is honoured rather than ignored: measurement continues without cookies. The others are not loaded at all unless you accept. You can change your mind at any time by clearing this site's data in your browser. Separately from cookies, this website stores a small amount of information in your own browser that is never sent to a third party: your cookie choice and your light or dark theme preference, so both are remembered, and, if you arrived from a campaign or a partner link, the details of that link for the duration of your visit so we can attribute the enquiry correctly. Third-party services embedded in the platform (such as interactive demos) may set their own cookies subject to their own privacy policies.
7. Third-Party Services
We share data with the following categories of third-party sub-processors: cloud hosting providers (data hosted in the UK/EEA); payment processors (Chargebee); email delivery providers (Postmark); analytics providers (Google Analytics, Microsoft Clarity and Leadfeeder); advertising and partner attribution providers (LinkedIn, Refersion and PartnerStack); and our customer relationship system (Pipedrive), which receives the details you submit through our enquiry and free report forms. We ensure all sub-processors provide adequate data protection guarantees. We do not sell personal data to third parties. Where data is transferred outside the UK/EEA, we rely on approved transfer mechanisms such as UK IDTA or Standard Contractual Clauses.
8. Contact the Data Controller
For any privacy-related questions, requests, or concerns, please contact our Data Protection lead, Sandra Lovell-Struthers, Head of Compliance, at [email protected]. For formal complaints, you may also contact the ICO at ico.org.uk or by calling 0303 123 1113.