Privacy Policy
This policy explains what personal data CyberWhy collects when you use this website or contact us, why we collect it, how we protect it and what rights you have. We keep it plain and specific.
Who we are
CyberWhy ("CyberWhy", "we", "us") is an international cybersecurity provider. We operate this website and decide how and why the personal data described in this policy is used, which makes us the controller of that data.
Address: Dubai Silicon Valley, Dubai, United Arab Emirates.
Email for all privacy questions and requests: info@cyberwhy.com (please use "Privacy request" as the subject).
Laws that apply
We handle personal data in line with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "UAE PDPL"), together with the executive regulations, guidance and other UAE laws that apply to us. Where a different data protection law applies to specific processing, for example the DIFC Data Protection Law, the ADGM Data Protection Regulations or, for visitors in the European Economic Area or the United Kingdom, the GDPR, we respect the rights and obligations it gives to the extent that it applies.
What we collect
Information you give us
- Contact form and email: your name, business email address, organization, the service you are interested in, and the message you write. If you email us, we receive your email address, your name if shown, and what you send.
- Conversations with us: details you share when we discuss a possible engagement, such as your business context, systems and concerns.
Information collected automatically
- Technical data: when you visit, our servers and the providers that deliver this website may process your IP address, browser and device type, pages requested, and the date and time, in order to deliver the site, keep it secure and find faults.
- Contact form protection: to limit abuse, the server that receives the contact form briefly keeps a hashed (not readable) form of your IP address in memory to count how many messages come from one source. It is not stored on disk and is not part of the email we receive.
- Preference stored in your browser: if you choose the simple page view, your browser stores that choice locally on your device so that it is remembered. It is not sent to us.
We do not ask for, and you should not send us, passwords, access credentials, logs, evidence or other sensitive technical data through the website form. If you need to share material like that, tell us in general terms what you have and we will agree a secure way to receive it. We do not knowingly collect special categories of personal data through this website.
Why we use your data and on what basis
We use personal data only for specific, stated purposes:
- To respond to your enquiry and discuss how we can help. Basis: your consent, which you give when you submit the form, and our steps taken at your request before entering into a contract.
- To prepare, agree and deliver services, including scoping, proposals, contracts, invoicing and communication during an engagement. Basis: performance of, or steps to enter into, a contract with you or your organization.
- To run and secure this website, prevent abuse and fix errors. Basis: our obligation to keep systems secure and, where the GDPR applies, our legitimate interest in doing so.
- To meet legal, regulatory and accounting obligations and to establish, exercise or defend legal claims. Basis: legal obligation and, where permitted, our legitimate interests.
- To send you information you asked for. We do not send marketing messages unless you have asked for them or have given consent, and you can withdraw consent at any time.
We do not sell personal data. We do not make decisions about you that have legal or similarly significant effects based solely on automated processing.
Transfers outside the UAE
CyberWhy works internationally, and some of our service providers may store or process data outside the United Arab Emirates. Where personal data leaves the UAE, we do so only as the UAE PDPL permits, for example to a country that the law recognizes as providing an adequate level of protection, or under contractual or other safeguards, or with your consent where required. Where the GDPR applies, we use appropriate safeguards for transfers outside the European Economic Area or the United Kingdom.
How long we keep data
We keep personal data only for as long as it is needed for the purpose it was collected for, and as long as the law requires or allows afterward.
- Enquiries that do not lead to an engagement are kept for as long as needed to respond and to handle follow-up questions, and then deleted or anonymized.
- Information about engagements and contracts is kept for the duration of the engagement and afterward for the periods that UAE commercial, tax and accounting law and the limitation periods for legal claims require.
- Technical logs are kept for a limited period for security and troubleshooting.
How we protect data
Security is our business and we apply it to our own handling of data. We use appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration and disclosure, including access controls, encryption in transit, and confidentiality obligations for people who handle it. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach affects your personal data in a way that the law requires us to report, we will notify the competent authority and the affected individuals as the law requires.
Data we handle when providing security services
When we deliver a service such as a penetration test, vulnerability assessment, incident response or consulting, we may get access to systems and data that belong to you, which can include personal data. In that case we handle it only for the purpose of the engagement, on your instructions and under the confidentiality and data protection terms of the agreement for that engagement. We limit access to the people who need it, and we return or delete it as agreed at the end of the work. For that data, you remain responsible for having the right to authorize our work.
Your rights
Subject to the conditions and exceptions in the applicable law, you have the right to:
- ask whether we process your personal data and obtain information about how we use it;
- receive a copy of the personal data you gave us, and ask for it to be transferred to another controller where that right applies;
- ask us to correct inaccurate data or complete incomplete data;
- ask us to erase your data, restrict our processing, or stop processing it, including processing for direct marketing;
- object to processing based on automated means where the law gives you that right;
- withdraw your consent at any time. Withdrawal does not affect processing that happened before it.
To use any of these rights, email info@cyberwhy.com. We may need to verify your identity first. We will respond within the time that the applicable law requires. If you are not satisfied with our response, you can contact the UAE Data Office, or, if you are in the DIFC, ADGM, EEA or UK, the competent supervisory authority there.
Children
This website is for businesses and professionals. It is not directed at children, and we do not knowingly collect personal data from anyone under 18.
Links to other websites
This website may link to other websites. We are not responsible for their content or privacy practices, so please read their policies.
Changes to this policy
We may update this policy, for example when our practices or the law change. We will publish the updated version on this page with a new "last updated" date. If the change is significant, we will take additional steps to inform you where the law requires it.
Contact
Questions or requests about this policy or your personal data: info@cyberwhy.com, CyberWhy, Dubai Silicon Valley, Dubai, United Arab Emirates.