When you use Qyli Cyber to train your team or to run simulated phishing tests, you decide whose personal data is processed and why. You are the controller of that data and Qyli Cyber Ltd is your processor. This page is our data processing agreement. It forms part of our Terms of Service and applies from the moment you create an account. If you would like a signed copy for your records, email us — a signed copy won't change these terms.
It covers the personal data of the people you add, invite or test ("Customer Personal Data"). For your own account details we are a controller in our own right — see our Privacy Policy. The people whose data this covers can read what is recorded about them in our participant notice.
1. What we process, and for whom
| Subject matter | Providing cyber awareness training and simulated phishing tests to the people you choose. |
|---|---|
| Nature and purpose | Storing and delivering training; recording how each person does; sending training and simulation emails; showing results to your administrators; for escape rooms, if you enable it, building a read of where to sharpen from each person's skill observations and, if the person agrees, showing it to them and to your administrators and suggesting follow-up training from it for your administrators to offer, and showing your administrators a group picture of five or more people who have agreed; and, if you ask for it, producing aggregate analysis of a training cohort. |
| Duration | For as long as your account is open, plus the deletion periods in section 4. |
| Data subjects | The staff, pupils or other members you add or send a simulation to. |
| Categories of personal data |
|
| Not recorded | Passwords, or anything typed into a simulation (its landing page has no form). Our application does not store the IP address, browser or device details of people who open or click a simulation. (Our hosting provider necessarily handles IP addresses to deliver web traffic — see the sub-processor list.) |
| Special category data | None intended. Please don't put special category or criminal-offence data into the service. |
2. What we will do
As your processor, we will:
- process Customer Personal Data only on your documented instructions — these terms, your use and configuration of the service, and any further instruction you give in writing — and tell you if we think an instruction would breach data protection law;
- make sure everyone we authorise to process it is bound by confidentiality;
- apply appropriate technical and organisational security measures (section 5);
- use only the sub-processors described in section 3;
- help you respond to people exercising their rights. You can erase a person's data or delete a campaign yourself from your account. If someone contacts us directly about data you control, we will refer them to you and will not respond in substance without your instruction, unless the law requires us to. Each person's choice about their skill read is recorded by us and not shown to you, so that a refusal stays private; we will provide it, on request, to help you answer a rights request made by that person;
- help you meet your obligations on security, breach notification, data protection impact assessments and prior consultation with the ICO, taking into account the nature of the processing and the information available to us;
- tell you without undue delay, and in any event within 48 hours of becoming aware, of a personal data breach affecting Customer Personal Data, with the information we then have, and keep you updated as we learn more;
- delete or return Customer Personal Data when the service ends (section 4); and
- make available the information needed to show we have complied with this page, and allow audits (section 6).
3. Sub-processors
You give us general authorisation to use the sub-processors below.
| Sub-processor | What it does for you | Location |
|---|---|---|
| Supabase | Database and sign-in: stores all Customer Personal Data. | London, United Kingdom |
| Cloudflare | Hosting and delivery of the website and app. It handles visitors' IP addresses to deliver traffic and protect against attack. | Global network |
| Resend | Sends sign-in, invitation and training emails from qylicyber.com. | United States, under the UK International Data Transfer Agreement / Standard Contractual Clauses |
| Postal (mail server operated by Qyli) | Sends simulated phishing emails from a separate domain, and receives forwarded reports. Keeps a delivery log (recipient address, subject, delivery status) for a limited period. | United Kingdom, on the Contabo server below |
| Contabo | Hosts the server that runs our Postal mail software, including its delivery log. | United Kingdom |
| Stripe | Takes payment. Receives your billing contact only — never the data of the people you train. | United States / EEA |
| Anthropic | AI. (a) In Ask Qyli, the text a user types and the conversation so far are sent to generate a reply, along with your organisation's name (on an individual account, just "the account holder"). (b) For the AI Cyber Analyst, we send aggregate statistics about a training cohort — counts, averages, and results for departments of five or more people — and never the names, email addresses or individual results of your people, nor your organisation's name. Under our agreement with Anthropic, content we send is not used to train its models. We never send skill observations, or the reads built from them, to Anthropic. | United States |
We will email your account's owner at least 30 days before adding or replacing a sub-processor. If you object on reasonable data protection grounds within that time and we cannot resolve it, you may stop using the part of the service affected and we will delete your data as set out in section 4. We have a written contract with each sub-processor imposing data protection obligations equivalent to these, and we remain responsible to you for their performance.
4. How long we keep it, and deletion
| Data | How long |
|---|---|
| Sign-in and sign-up link requests (email address and a one-way hash of the requester's network address, used to stop abuse) | 24 hours. |
| Simulated phishing results | Names and email addresses are replaced with an anonymous placeholder 12 months after the campaign is sent. The counts (sent, clicked, reported) stay, so your reports remain accurate. |
| Training records (including skill observations and follow-up suggestions), and the AI analysis of them | Identifiable for 12 months after the training's last activity, then anonymised. |
| Access records (see section 1) | 12 months, then deleted. If the person is erased sooner, the record keeps no link to them. |
| Ask Qyli conversations | While your account is open. |
| Account details | While your account is open, and for 30 days after it closes. Billing and tax records are kept for 6 years, as the law requires. |
| Free-access accounts | Not closed automatically: kept while the account is open, and it stays open until you ask us to close it or we close it. We delete the account and its data when you ask us to, or when it is closed, within 30 days. |
| Simulation delivery log (on our mail server) | A limited period. |
| Backups | None. We do not keep separate backups of the database. |
You can erase a person's data, or delete a campaign, yourself at any time from your account. For anything else, email us and we will act within 30 days. If you need a longer or shorter period than the defaults above, tell us in writing and we will apply it to your account. You can download your results at any time and keep them under your own retention rules.
When the service ends, we will delete Customer Personal Data — or, if you ask before then, return it in a common format — within 30 days, unless the law requires us to keep it.
5. Security
- All traffic uses HTTPS, and our database provider encrypts stored data.
- Each customer's data is separated in the database by row-level security; people taking training reach only their own record, through a personal link.
- Sign-in is by emailed link only. We do not store passwords.
- Privileged credentials are kept out of the code and the browser and are used only on the server.
- Network addresses used to limit abuse are stored only as a keyed one-way hash, and deleted after 24 hours.
- Access to production systems is limited to the people who need it.
- For escape rooms the skill reads of people who agreed are shown to administrators as a group picture; opening a person's individual skill read, listing people with their suggested follow-ups, sending a follow-up from a read, and every export of results are logged against the administrator who did it.
6. Audit
On 30 days' written notice, and no more than once a year unless there has been a personal data breach or a regulator requires it, you (or an independent auditor bound by confidentiality) may audit our compliance with this page, during business hours and without unreasonable disruption. We will first offer our written security summary and our sub-processors' current independent reports or certifications, and only if those don't answer your questions will an on-site or remote inspection be needed.
7. What you are responsible for
- A lawful basis. You must have a lawful basis for processing your people's data — including for testing them with simulated phishing — and do any assessment the law requires. Many customers rely on legitimate interests in keeping their people and systems secure and record their assessment. The individual skill read for escape rooms is the exception: showing a person's read to them and to your administrators, counting it in the group picture, and using it for follow-up training happen only with that person's consent, which the service asks for and records. Don't rely on another basis for it. (Their skill observations are still recorded as part of their training records. Someone who doesn't agree is left out of the group picture too.)
- Tell people first. Before anyone's results are recorded, you must have told them what is recorded, who can see it and how long it is kept. Our participant notice is written for this; we link to it from every training email, simulation reveal page and results screen. You may also need to update your own staff privacy notice, acceptable use policy or handbook. You confirm this each time you send a campaign.
- Test only people you are entitled to. Add only people who work for you or are enrolled with you, and send simulations only to their organisation addresses.
- Don't decide about a person from results alone. A result, a skill read or a follow-up suggestion shows how someone did in one exercise; none of them is a measure of a person's conduct or competence. You must not use them as the sole basis for a disciplinary, dismissal, pay or similar decision. We recommend using them to offer support and further training.
- Keep contact details accurate, and remove people who leave.
- Don't type your people's names or other personal data into free-text features such as Ask Qyli.
- Handle requests from individuals, using the tools we provide, and tell us if you need something they don't offer.
8. International transfers
Where a sub-processor processes Customer Personal Data outside the UK, we rely on UK adequacy regulations (including the UK–US data bridge for certified providers) or on appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
9. General
If this page and the Terms of Service conflict about personal data, this page prevails. We will email your account's owner at least 30 days before making a change that reduces the protection given here; other changes take effect when posted, under the date above. We record which version you accepted against your account. This page is governed by the laws of England and Wales.