Privacy Notice.

The short version

• We collect what you type into our forms, and basic technical details.
• We use it to reply to you, to deliver what you ask for, and to keep things secure.
• We don’t sell it, we don’t share it for advertising, and we don’t track you across websites.
• No advertising cookies and no trackers from other companies. We count visits ourselves, without cookies.
• You can ask to see, correct or delete what we hold about you.

Who we are

Cyber Way US LLC (“Cyber Way”, “we”, “us”) is a cybersecurity firm registered in California. This notice covers this website, the forms on it, and the Leadership Second Opinion.

Work we do for clients is covered by our agreement with them, and our client portal has its own notice.

What you give us

When you fill in a form, we collect what you enter:

• your name, role, work email and organization;
• for the Leadership Second Opinion, also your organization’s website, when would suit you, and who introduced us;
• for an emergency report, also a second email, a phone number, whether you have a retainer with us, and what you’re seeing;
• anything else you choose to write in a message.

Please don’t send passwords, government ID numbers, or health or financial details through our forms.

What we collect automatically

Like any website, our servers record basic technical details to deliver the site and keep it secure: your IP address, browser and device type, the pages you request, and when.

We use only the cookies the website needs to work and to keep its forms secure. We don’t use advertising cookies, and we don’t load trackers from other companies. No other company collects information about what you do on this website, or follows you from it to other websites. Our fonts are hosted by us, so your browser doesn’t contact anyone else to show this website.

We measure how the website is used ourselves, without cookies: which pages are viewed, the website or campaign that brought visitors here, and whether they use a phone or a computer. To count visitors without knowing who they are, we turn your IP address and browser type into a code that changes every day and can’t be traced back to you, and we delete it within two days. What we keep is only totals, such as how many people visited a page.

To stop bulk spam, your browser quietly does a small calculation when a form opens, instead of a puzzle or a service like Google’s reCAPTCHA. It collects nothing about you, and no other company is involved. When you send a form, we also check that the email address’s domain can receive mail, by looking up that domain only.

When you send a form, we record which page you sent it from and the website that brought you there, so we know how people find us. We do this on our own servers, without cookies.

The Leadership Second Opinion

When you ask for a Second Opinion and accept its terms, we look at your organization’s domains from the outside. That can include:

• information anyone on the internet can already see about those domains, such as their public records, certificates, websites and services;
• the work accounts on those domains that appear in known breaches. We check only your organization’s own domains, never anyone’s personal email. For each account, the results show only the account itself, such as name@yourcompany.com: never its password, where it leaked, or when.

We never collect, view or keep passwords, password hashes or government ID numbers. If a source returns them, we discard them.

Anything you share with us during the Second Opinion, including your self-assessment answers, is used only for your Second Opinion. We act as your service provider, and the results go only to you and the people you choose.

How we use information

• to reply to you and arrange a conversation;
• to deliver the Leadership Second Opinion and any work you ask us for;
• to respond to an emergency report;
• to keep this website and our systems secure, and to fix problems;
• to meet our legal obligations and protect our rights.

We don’t make automated decisions about you that have legal or similarly significant effects.

Who we share it with

Only with people who help us do the work, and only what they need:

• our own team;
• service providers that work for us under contract, such as our website host, our email provider and the breach intelligence sources we check for the Second Opinion;
• professional advisers, such as our lawyers and accountants;
• authorities, when the law requires it or to protect someone’s safety or rights;
• a buyer or successor, if our business is ever sold or reorganized, under the same protections.

We don’t sell personal information, we don’t share it for cross-context behavioral advertising, and we don’t give it to anyone for their own marketing.

How long we keep it

• Messages and requests that don’t lead to work with us: up to two years after we were last in touch.
• Emergency reports: up to three years, as a record of what was reported and how we responded.
• Leadership Second Opinion results: until ninety days after the follow-up, or sooner if you ask. The record that you accepted its terms: up to three years.
• Server and security logs: up to ninety days, unless we need them longer to look into a security issue.

If you become a client, your agreement with us governs from then on. We keep information longer only when the law requires it.

How we protect it

We use reasonable technical and organizational measures to protect information, including encryption in transit and access limited to the people who need it. No system is perfectly secure, and we’ll tell you if a problem affects your information, as the law requires.

Your choices and rights

Wherever you live, you can ask us to:

• tell you what personal information we hold about you, where it came from, and how we use and share it;
• give you a copy of it;
• correct it;
• delete it.

Write to info@cyberwayus.com with “Privacy request” in the subject, or use our contact form and choose “A privacy request”. We’ll confirm who you are before acting, and we respond within 45 days. If we need more time, we’ll tell you why, as the law allows. Someone you authorize can ask on your behalf. We won’t treat you differently for asking.

Because we don’t sell or share personal information or track you across websites, there’s nothing to opt out of. We still honor Global Privacy Control and Do Not Track signals.

California residents

We give everyone the rights California privacy law describes. In that law’s terms, in the past twelve months we collected:

• identifiers, such as your name, work email, phone number and IP address;
• professional information, such as your role and organization;
• internet activity on this website, such as the pages you requested and the website that brought you to a form;
• anything else you chose to write to us.

We collected it from you, from your browser, and, for the Second Opinion, from public and breach intelligence sources about your organization’s domains. We use and disclose it only for the purposes and to the people listed above. We haven’t sold or shared personal information, and we don’t collect sensitive personal information on purpose. If you include some in a message, we use it only to reply to you.

Children

This website is for organizations and their leaders. It isn’t directed at children under 16, and we don’t knowingly collect their information.

If you’re outside the United States

We’re based in the United States and process information here. If you’re in the European Union, the United Kingdom or another place with similar laws, we rely on our legitimate interest in replying to you and keeping our website secure, and on taking the steps you ask for before an agreement. You have the rights listed above, and the right to complain to your local data protection authority. Write to us first, and we’ll help.

Changes to this notice

If we change this notice, we’ll update it on this page with the new date, and we’ll say clearly here when a change is significant.

Contact

Cyber Way US LLC, a California limited liability company. info@cyberwayus.com.