Your employer, school or another organisation has asked you to take cyber awareness training, or has sent you a simulated phishing email, using Qyli Cyber. This page tells you what is recorded about you, who can see it, how long it is kept and what your rights are.
Your organisation decides why this is done and is responsible for it. Qyli Cyber Ltd provides the service and handles your data on the organisation's behalf, under our Data Processing Agreement.
What is recorded
In training
- Your name and work email address.
- Which training you were given, and when you started and finished it.
- Your score and how long it took.
- The answers, choices and actions you made in each exercise, including the wrong ones.
- In an escape room, which security skills you showed in each room and where you slipped (for example, a warning sign you didn't act on). Your read of where to sharpen is built from these.
- If you are asked whether your read may be shown and used, your answer and when you gave it.
In a simulated phishing test
- That the email was sent to you.
- Whether the tiny tracking image in it loaded — which usually means it was opened.
- Whether you clicked the link, and when. Your click is recorded against your name.
- Whether you reported the email, and when.
- That you were offered follow-up training, if you clicked.
What is not recorded
- Passwords, or anything you type. The page you reach after clicking a simulated link has no form.
- Your IP address, browser or device details. Our application does not store them. (Every website, ours included, has to see your IP address to send you a page, and our hosting provider does that; it is not stored against your results.) If you play an escape room, a cookie in your browser holds a random key that keeps your results private to you: see our Cookie Policy.
- The content of an email you forward to report it. We record only that you reported it, and when.
Who can see it
- You. When you finish an escape room, we email you a private link to your results. If your organisation uses skill reads, at the end of an escape room you can choose to see your own read of where you were sharp and where to sharpen. If you agree, your organisation's administrators can open it too, and may use it to send you follow-up training; if you don't, it isn't shown to you or to them. You can stop it being shown or used at any time from that escape room's results page. If you agree, your read also counts, without your name, towards a group picture your administrators see, of five or more people who have agreed; if you don't, it isn't counted there either.
- Your organisation's administrators. They see individual results against your name, including whether you clicked or reported a simulated email. For escape rooms, the skill reads of people who agreed are shown to them as a group picture; when an administrator opens your individual skill read, lists you with your suggested follow-up, sends you a follow-up from it, or exports results, that is logged.
- Qyli Cyber staff, only as needed to run and support the service.
- Not other organisations that use Qyli Cyber, and not your colleagues, unless your organisation chooses to show them.
We do not sell your data or use it for advertising. We do not use it to improve our product, or to train AI models, in any form that identifies you. If your organisation uses our AI analysis feature, the AI receives only anonymous, group-level statistics — never your name, email address or individual results.
What it is for
To help your organisation see where support and training would help. A result shows how you did in one exercise; it is not a judgement of you. Our terms require organisations not to use a result as the sole basis for a disciplinary or similar decision about you.
For escape rooms, if you agree, your read is used to suggest follow-up training aimed at where to sharpen; an administrator decides whether to send it, and it usually arrives as an email inviting you to another exercise. Our terms require organisations not to use your read or a follow-up suggestion as the sole basis for a disciplinary or similar decision about you either.
How long it is kept
- Training records, including skill observations: your name and email are removed 12 months after the training's last activity.
- Simulated phishing results: your name and email are removed 12 months after the campaign was sent. Only anonymous totals remain.
- The mail server that sends simulated emails keeps a delivery log (your address, the subject and whether it was delivered) for a limited period.
- The record of an administrator opening your skill read, listing you with your suggested follow-up, sending you a follow-up from it or exporting results: 12 months, then deleted.
- Your organisation can delete your data sooner, at any time.
Your rights
You can ask your organisation for a copy of what is recorded about you, to correct it, to erase it, and to object to it being recorded. They can erase your data from Qyli Cyber themselves. If you would rather write to us, email [email protected] and we will pass your request to your organisation promptly; we won't act on it ourselves without their instruction unless the law requires. You can also complain to the Information Commissioner's Office at ico.org.uk.
You can stop your escape-room read being shown or used to choose follow-up training at any time, yourself: open your results from the private link we email you when you finish that escape room (you can have it sent again from the escape room's page) and choose Stop using my read. Anything already sent stays sent.
If you want to know why your organisation is doing this, ask them. For how Qyli Cyber handles data more generally, see our Privacy Policy.