1.1. Use of the Website is subject to the terms detailed in this Privacy Policy. Please read the Privacy Policy carefully, as browsing the Website and performing actions therein constitutes your consent to the terms contained in this Privacy Policy.

1.2. In the event of inconsistency between any terms of this Privacy Policy and any translation into another language, the English version will control and prevail on any question of interpretation or otherwise.

1.3. The terms of this Privacy Policy apply to the use of the Website, and the content contained therein, via any computer or other communication device (such as a mobile phone, tablet computers, etc.). They also apply to the use of the system and the Website, whether through the internet network or through any other network or communication means.

2.1. We process your personal information for specific purposes and based on defined legal grounds. Below are a breakdown of the purposes and the corresponding legal basis:

International Data Transfer: The Website operates globally. Your information may be transferred to, stored, and processed in countries other than your own (including servers in the US/EU). We ensure adequate protection in accordance with legal requirements. You can receive a list of our Sub-processors by contacting us.

3.1. Each time you use the Site, we may automatically collect certain types of information. Some examples of automatic information we may collect are as follows:

3.1.1. We may record your internet service provider’s address, your internet protocol or IP address and the type of handheld or mobile device.

3.1.2. We may collect a record of your activity or your “clickstream” while visiting the Site.

3.1.3. We may use “cookies” of different types to recognize your computer or mobile device. A cookie is a small text file that a website, online application, or e-mail may save to your internet browser and/or your computer’s hard drive for use in subsequent visits to sites.

3.1.4. We may collect any information you enter, share or that can be obtained from your use of the Site. However, as stated above, we do not store raw credentials (passwords) entered during phishing simulations.

3.1.5. We may share your information with third parties, including our service providers (e.g., hosting, payment processors). However, please note that we do not store full credit card numbers or sensitive financial data directly on our servers.

3.1.6. Service providers may access your information to develop, host, and maintain the Site, or to aggregate anonymous data for service improvement and marketing. They act on our behalf, are granted access only as necessary, and may use cookies.

4.1. Some examples of things service providers may do that may involve your personal information are:

4.1.1. Develop, host or maintain the Site on our behalf;

4.1.2. Aggregate customer information and/or improve customer service. We may then share such aggregated (anonymous) information with prospective marketing partners and advertisers.

4.1.3. These service providers are granted access to some or all of your personal information as necessary and may use cookies (as defined above) or other automatic collection technology on our behalf.

5.1. As Clients, you act as the Data Controller regarding your employees and End-Users’ data (“End-Users”). You use our services to execute Cybersecurity Awareness Training and Phishing Simulations for your business needs. Your End-Users’ data is processed to track training progress, simulation results, and risk scores.

5.2. In the context of phishing simulations, End-Users may be presented with landing pages that mimic real-world attacks. We do NOT retain raw credentials (e.g., passwords or usernames) entered by End-Users on these simulation pages. Such inputs are used solely to trigger a ‘compromised’ event status and are not stored in our databases.

5.3. You (the Client) retain full ownership and control of all End-User Data. This information is stored by us solely as a Data Processor on your behalf, to provide the Service. We do not share your End-Users’ personal information with any third parties (except essential sub-processors like hosting or cloud providers needed to deliver the service) and make no independent commercial use of your End-Users’ personal information. We make it a top priority to ensure the highest standards of privacy and data protection on our Website.

5.4. For more information on the laws that govern the use of personal information and data protection and the steps we have taken to comply and ensure your End-Users’ data safety, please contact us at [email protected].

6.1. Information entered by or about your End-User typically includes: Full name, business e-mail address, department, job title, and location. Additionally, behavioral data concerning the End-Users’ interactions with the simulations (e.g., “clicked link”, “entered credentials”, “training completed”) is collected to generate the risk score and training reports.

6.2. We utilize automated processing to calculate your ‘Human Risk Score’ based on your interactions with simulated phishing scenarios (e.g., opening emails, clicking links, entering credentials, or reporting threats). Recent actions are weighted more heavily to reflect current awareness. This score helps your employer assess risk and may result in the automated assignment of remedial training. We do not use this process to make decisions that produce legal effects concerning you (such as automated termination of employment) without human intervention.

7.1. The simulations and training programs on our platform are designed by you (our Client) or selected from our automated content library. Information entered by or about your End-User is collected exclusively for your business use (specifically for training, risk assessment, and generating security scores) and to provide the Service. Our system does not use the personal data entered by your End-User for its own independent commercial purposes.

8.1. Database Owner: For the purposes of the Law, CYWARENESS LTD Company Number 516180866, located at Ra’anana Israel, which operates the Site, is the “Controller” of the Database.

8.2. Obligation to Provide Information and its Consequences: You are not under any legal obligation to provide us with Personal Information. Providing this information is voluntary or based on your employment agreement. Consequences of Refusal: However, please be aware that refusal to provide the requested information (such as name and work email) will prevent us from creating a user account for you, thereby blocking your access to the Platform and preventing you from completing the mandatory security training assigned by your Employer.

9.1. Yes. We engages trusted third-party service providers (sub-processors) to support the delivery of our Services (e.g., cloud infrastructure providers, security and logging services, and email delivery providers for phishing simulations). These Sub-processors process data solely in accordance with our instructions and are contractually bound to maintain strict confidentiality and security standards equivalent to those we provide to you. We do not sell or lease your End-Users’ information to any third parties for their independent commercial use.

10.1. When a Client enables the Google Workspace integration and an authorized administrator grants the necessary permissions, we access Google Workspace directory information through Google APIs using read-only permissions for Users, Groups, and Organizational Units.

10.2. The integration accesses the following information: employee details (full name, work email address, preferred language, phone number, country, region, office location, and account status) and organizational structure data (organizational units, groups, and employee memberships). We expressly do not access email content, files, calendars, or passwords.

10.3. We use this information solely to provide the integration’s user-facing functionality, including synchronizing employee records, organizing users into relevant groups or organizational units, and supporting the assignment and administration of cybersecurity awareness training and phishing simulations. The requested permissions do not authorize us to modify Google Workspace directory records or access email message content or files.

10.4. For personal data processed through this integration on the Client’s behalf, the Client acts as the Data Controller and we act as its Data Processor.

10.5. We store the directory details mentioned above to enable the administrator to select which employees to include in the service. For those selected employees, we retain their name, email address, group or department membership, phone number, language, and location. We also securely store synchronization logs and the API access token used to connect to the directory. This data is protected using appropriate technical and organizational safeguards, including encryption in transit and at rest, and access controls restricting access to authorized personnel.

10.6. Google Workspace information is retained for as long as the Client’s account and the integration remain active, with data actively refreshed or removed on our end based on ongoing synchronizations with the Client’s Google directory. Following a deletion request or termination of the service, the directory data and associated platform-managed user records are deleted or fully anonymized within 30 days, subject to applicable legal retention requirements. Backup copies are retained within our scheduled database snapshots and are fully removed within 12 months of being deleted from the live system.

10.7. Our use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

10.8. We use Google user data only to provide or improve user-facing features that are visible and prominent in the application. We do not sell this data or use or transfer it for advertising, marketing, creditworthiness assessments, or lending purposes. These restrictions also apply to aggregated, anonymized, and derived data.

10.9. Transfers are limited to those permitted under Google’s Limited Use requirements, including necessary service delivery with user consent, security purposes, compliance with applicable law, or a merger, acquisition, or sale of assets with explicit prior user consent. Service providers processing this information on our behalf are subject to contractual confidentiality, security, and use restrictions.

10.10. Human access is permitted only in the circumstances allowed by Google’s Limited Use requirements.

10.11. These restrictions prevail over any broader provisions in this Privacy Policy concerning marketing, advertising, aggregated information, or third-party sharing.

10.12. An authorized administrator may revoke the integration’s access through Google Workspace administrative controls. Revocation stops further access but does not automatically delete information previously synchronized. Clients may request deletion by contacting [email protected].

10.13. We will keep these disclosures current and notify affected users and obtain the required consent before using Google user data for a new purpose.

11.1. You have the right to request information regarding the collection of your personal information by the Site, or access to or deletion of your personal information.

11.2. If you are a Client (our direct customer), please contact us using the contact information provided below.

11.3. If you are an End-User (Employee or simulation participant), please contact the Client (your Employer) directly to exercise your rights. Since we act as a Data Processor on their behalf, we cannot process your request directly.

11.4. We retain Personal Data associated with a Client account for as long as necessary to provide the Services and fulfill the purposes outlined in this Policy. Upon termination of the engagement, data will be retained for a reasonable period to allow for data export or retrieval by the Client, or as required to comply with our legal obligations, resolve disputes, and enforce our agreements. After this period, data will be permanently deleted or anonymized.

11.5. Right to Data Portability: Where applicable under the GDPR, you have the right to request a copy of your personal data in a structured, commonly used, and machine-readable format.

12.1. Unlike transactional messages essential for the Service, we will send you marketing advertisements, newsletters, and promotional offers only if you have explicitly opted-in to receive such communications (e.g., by actively checking a consent box on our forms). You are not required to provide this consent to use the Service.

12.2. A user who has provided such details will be subject to the mailing instructions detailed in our Terms and Conditions.

12.3. It is prohibited to leave details of another person on the Site without their consent and / or without their presence in front of the screen while leaving the details and without explaining all the Terms and Conditions to them.

12.4. It is clarified that there is no legal obligation to provide details on the Site however without their submission it will not be possible to receive marketing content and updates from the Site.

12.5. The Site will not use the information provided except for in accordance with the Site’s privacy policy which is an integral part of this Terms and Conditions.

12.6. Leaving details on the Site and consent to receive marketing content includes, among other things, receiving marketing content, promotions, updates and discounts offered to registered users.

12.7. It is clarified that the user has the option to remove himself from the Site’s marketing mailing list at any time by clicking on the button “Unsubscribe” that appears at the bottom of any e-mail sent by the Site, or by emailing the Site stating that they wish to be removed from the mailing list. Please note that opting out of marketing emails does not apply to transactional or service-related emails (e.g., billing, system alerts) which are essential for the use of the Service.

12.8. Mailing information should not be construed as a promise of any outcome and / or warranty for the service offered therein.

12.9. Mailing as a whole, including all the information contained therein, is offered as is, and will be as accurate and correct as possible, however, the information may not be complete and technical or other errors in the information could happen.

12.10. The user confirms that he will not have any claim in connection with mailing advertisements and / or advertisements displayed on the Website, including their location on the Website. It is clarified that with regard to advertisements displayed under the auspices of a third party, the Site has no interference in the selection of the advertisements displayed, the truth of their content and the order in which they appear.

13.1. We reserve the right to modify or update this policy from time to time. The updated version will be published on the Website.

For any question or request regarding this Privacy Policy, please contact us by Email: [email protected]

All rights in this document above reserved to Daniel Bahry Law Firm.

Last updated: October 2026