CybaWay Privacy Policy

Last updated: 06 June 2025

1. Background

This Privacy Policy applies to our website cybaway.com and the CybaWay browser extension ("Our Services"). Please read this Privacy Policy carefully. By using Our Services, you accept the terms below.

2. Definitions and Interpretation

• Account: An account created in CybaWay to access our services.
• Cookie: A small text file placed on your computer or device by our Site or extension (see Section 15).
• Data Controller: CybaWay Ltd, 85 Great Portland Street, First Floor, London W1W 7LT, United Kingdom.

3. What Does This Policy Cover?

This Privacy Policy covers your use of cybaway.com and the CybaWay browser extension. If you follow links to other websites, please review their privacy policies. We do not control those third-party sites.

4. What Is Personal Data?

“Personal data” means any data that can identify you directly or indirectly, as explained by the UK Data Protection Act 2018 and the GDPR.

5. Your Rights

You have rights under applicable law, including:

• The right to be informed about how we collect and use your personal data.
• The right to access the personal data we hold about you.
• The right to correct inaccurate or incomplete data.
• The right to request erasure (“the right to be forgotten”).
• The right to restrict processing of your data.
• The right to object to our use of your data.
• The right to withdraw consent at any time.
• The right to data portability.
• The right to lodge a complaint with the Information Commissioner’s Office (ICO).

For any request or question, contact us at support@cybaway.com.

6. What Data Do We Collect and How?

Depending on your use, we collect and process these data:

Data Collected	How We Collect the Data
First name (for personalisation)	When you register or enable the extension
Email address (for account & service)	When you register or enable the extension
Account Identifier (unique ID)	Generated upon registration or installation to anonymise users
Technical data (browser type, extension version, operating system, extension identifier)	Automatically when you use the extension
Browsing activity (URLs, interactions, tab & history access)	Collected by extension to provide and personalise the gamified experience
Game progress, in-game choices, AI-profiled traits	Generated automatically as you use the extension
Analytics and usage data	Cookies and similar technologies on our site and within the extension

We do not intentionally collect any special category or sensitive personal data.

7. Browser Extension Permissions

The CybaWay extension for Chrome requests these permissions:

• "tabs": Access tab info for challenge delivery and progression.
• "storage" / "unlimitedStorage": Save user progress, in-game data, and settings.
• "scripting": Execute interactive scripts for gamification.
• "history": Tailor in-game challenges based on your browsing patterns.
• "webRequest": Analyse traffic for security challenge context (without capturing sensitive content).
• "idle": Optimise extension performance and engagement.
• "downloads": Enable relevant download-based challenges.
• "system.storage": Monitor available storage for saving user progress.
• "alarms": Manage game events and reminders.
• "host_permissions": Required to monitor and protect your surfing as part of gamification.

We only request permissions necessary to operate and improve CybaWay. We do not sell or disclose your browsing activity to third parties for advertising.

8. How Do We Use Your Personal Data?

• To enable and deliver CybaWay’s services, including personalised security challenges and progress tracking.
• To identify and contact you about your account or service updates.
• To personalise your experience (e.g., in-game names, avatars, leaderboards).
• To analyse your strengths and weaknesses for tailored AI content.
• To safeguard and improve the extension and site, and provide support.
• To comply with legal and regulatory requirements.

We use your first name solely for communication personalisation, and your email address for account-related communication and authentication. Where possible, a unique user ID anonymises your data.
You may opt-in to marketing or newsletters, with an unsubscribe option in each message.

9. Legal Basis for Processing

• Consent: Given when you enable the extension or opt into communications.
• Contractual necessity: Needed to deliver the CybaWay services you request.
• Legitimate interests: For personalisation and service improvement, unless overridden by your rights.
• Legal obligations: For compliance with applicable laws.

10. Data Security

• All data transfers are encrypted (TLS/HTTPS).
• Passwords and credentials are securely encrypted at rest.
• Wherever possible, we use anonymisation (e.g., unique user IDs).
• Regular security reviews, vulnerability scans, and audits.
• Staff are trained in data protection best practices and access data on a need-to-know basis only.
• You'll be notified without delay if any data breach affecting your privacy occurs.

11. Data Retention

We retain your data as long as necessary to:

• Deliver our services
• Maintain your account
• Fulfil legal and audit obligations
• Defend or establish legal claims

If you request deletion and no legal reason prevents it, your data will be securely erased without undue delay.

12. Data Storage & Transfers

We store your personal data within the United Kingdom and do not transfer your personal data outside the UK. If you use our service from abroad, your data is processed under UK law.

13. Sharing Your Personal Data

We do not sell or share your personal data for marketing. Your data may be disclosed only:

• To our service providers who help deliver our service, under strict non-disclosure terms;
• To a new owner in a merger or acquisition (we will notify you of such changes);
• If required by law, subpoena, or regulatory authority.

14. Your Data Control Choices

• Access or update your personal data by contacting us (support@cybaway.com).
• Request deletion of your account (right to be forgotten).
• Withdraw consent at any time.
• Object to or restrict certain uses.
• Export your data (data portability).

We respond to requests within one month.

15. Cookies and Analytics

CybaWay uses cookies and similar technologies only as required for service delivery, analytics, and personalisation. By using our site, you consent to standard cookie usage. You can manage cookies through your browser settings. For more, see our Cookie Policy.

16. Children’s Privacy

CybaWay is not designed for children under 13. Do not use our services or provide personal data if you are under 13 years old. If you believe your child has provided personal data, contact us immediately and we will promptly delete such information.

17. How to Contact Us

• Email: support@cybaway.com
• Postal Address: 85 Great Portland Street, First Floor, London W1W 7LT, United Kingdom

18. Changes to this Policy

We may update this Policy due to operational, legal, or regulatory reasons. Changes will be posted at cybaway.com. Please check back regularly.