Legal
Privacy Policy
Last updated 12 October 2026.
This policy explains what personal data Greywell Cyber Ltd collects when you use greywellcyber.com, register for a free account or write to us, why, who else handles it, how long we keep it and what your rights are. It is the information the UK General Data Protection Regulation (UK GDPR) says we must give you.
Who We Are
The controller of your personal data is Greywell Cyber Ltd, a company registered in England and Wales with company number 16835578, registered office 124 City Road, London EC1V 2NX. We are registered with the Information Commissioner's Office (ICO) under reference ZC143139.
For anything about your personal data, write to our data protection contact at legal@greywellcyber.com, or by post to the registered office. A director of the company reads and answers that mailbox.
The Short Version
- The tools run in your browser. What you type into them is not sent to us, with one exception: the security headers checker sends the web address you give it to our server so the server can fetch that page. We do not keep the address or the result.
- We set no tracking or advertising cookies. We count visits with Cloudflare Web Analytics, which uses no cookies and stores nothing on your device. See the cookie policy.
- If you email us, we keep the email so we can reply and follow up.
- The networking quiz and our training need a free account. For that we keep your email address, your quiz progress and, when you pass an assessment, your certificate. We email you about your account only, unless you tick one or both of two separate boxes: one for new training, guides and certificates, one for our services.
- You can download everything your account holds, or delete it, at any time on your account page.
What We Collect, Why and on What Lawful Basis
| What | Why | Lawful Basis | How Long |
|---|---|---|---|
| Your name, email address and whatever you put in an email to us | To reply, and to discuss and deliver any work you ask about | Legitimate interests (answering people who write to us); contract, once we agree work together | Two years after our last exchange if no work follows; six years after the end of any contract, for tax and legal claims |
| Requests and complaints about your data, and our replies | To handle the request or complaint and show we did | Legal obligation | Two years after we close it |
| Security reports sent to security@greywellcyber.com | To investigate and fix the issue and credit you if you want | Legitimate interests (keeping our systems and visitors safe) | Two years after the issue is closed |
| Your member account: email address, when you registered and when you last signed in | To create your free account and sign you in with a code we email you | Contract (providing the account you asked for) | Until you delete your account, which you can do at any time on your account page |
| A security log kept by our sign in service: the time of each sign in or code request, the email address and the IP address it came from | To spot and stop attempts to break into accounts | Legitimate interests (keeping member accounts safe) | 90 days, including after you delete your account |
| Your quiz progress and sessions: which questions you have seen, your results, your scores | To save your progress across devices and choose questions that suit you | Contract (providing the training you signed up for) | Until you delete your account |
| Your course assessments: when you started and finished each one, your score and whether you passed | To mark the assessment on our server and decide whether a certificate can be issued | Contract (providing the training and certificate you asked for) | Until you delete your account |
| Your certificates of completion: the name you ask us to print, the course, the date and whether you have made each one public | To issue the certificate, and, only if you make it public, to confirm it is genuine to anyone who has its link | Contract (the certificate you asked for); the public check only with your choice, which you can undo on the certificate's page | Until you delete your account; a deleted certificate's link then shows nothing |
| Your two email choices (training news; our services), the version of the wording you saw for each and when you chose, and any earlier single choice you made | To email you about new training, guides and certificates, or about our services, only if you said yes to that one, and to show that you did. Every such email has a link to stop them | Consent, given separately for each, which you can withdraw at any time | Until you delete your account |
| Feedback you send from a tool, quiz or training page: what you wrote, the page, an email address if you give one, and your account if you are signed in | To fix what is wrong, improve the pages and, if you asked, reply to you | Legitimate interests (improving the site and its training) | 12 months, or until you delete your account if you sent it while signed in |
| Visit counts from Cloudflare Web Analytics: the page, the referring site, the country, the browser type and how fast the page loaded | To see which pages help people and which are slow or broken | Legitimate interests (understanding and improving the site) | Counted in aggregate by Cloudflare; no cookie, no stored identifier and no profile of you. We see totals, not people. You can switch it off on the cookie policy page |
| The bot check on the sign in form, the security headers checker and the feedback form | To stop automated abuse of the forms | Legitimate interests (keeping the site and its users safe) | Not kept by us. Cloudflare Turnstile reads signals from your browser for the check; see below |
| The web address you give the security headers checker | To fetch that page and show you its headers | Legitimate interests (providing the tool you asked to use) | Not kept: used for the request and then discarded |
| Technical data in each web request: IP address, browser type, the page asked for | To deliver the site and protect it from abuse | Legitimate interests (running and protecting the site) | Held by our hosting and database providers under their own short retention; we do not export or keep these logs |
| An encrypted backup copy of the member data above: accounts, progress, assessments, certificates, email choices and their record, and feedback | To restore the service if the database is lost or damaged | Legitimate interests (keeping your account and certificates recoverable) | Each nightly copy is deleted after 30 days, so something you delete leaves our backups within 30 days. A backup is restored only to recover the service, never to bring back an account its member deleted |
You do not have to give us any personal data to use the site or the tools. The quiz and training need an email address, because an account has to belong to someone. If you want us to reply, we need an address to reply to. We make no decisions about you by automated means that have legal or similarly significant effects; the quiz choosing your next question is not one.
Who Else Handles Your Data
We use four service providers, each acting as our processor under a written contract:
- Cloudflare, Inc. hosts this site, runs the security headers checker, the bot check and Web Analytics, stores our encrypted backups and protects the site from attack.
- GitHub, Inc. runs the nightly backup job. The member data passes through its servers only while the backup is made and encrypted; it keeps no readable copy, and the key that opens a backup is never given to GitHub or Cloudflare.
- Supabase, Inc. runs the database and the sign in service for member accounts. The database is hosted in London (Amazon Web Services, region eu-west-2).
- Google (Google Workspace) provides our email and sends your sign in code from no-reply@greywellcyber.com.
Cloudflare also uses the signals from the Turnstile bot check to improve its bot detection, and for that purpose it decides how the data is used, as a separate controller. Its Turnstile privacy addendum explains what it collects and why.
We do not sell your data or share it for advertising. We would disclose it to others only if the law required it, or to professional advisers bound by confidentiality.
Transfers Outside the UK
Member account data is stored in London. Cloudflare, GitHub, Google and Supabase may process data in the United States and elsewhere, for example for support, for the bot check, to make the nightly backup or to send the sign in email. Where they do, the transfer is covered by the UK Extension to the EU-US Data Privacy Framework or by the UK International Data Transfer Addendum in their data processing terms. You can ask us for details.
If You Are Under 18
Our training is open to everyone, so some members will be under 18. Your account works the same as anyone else's and nothing is switched on for you that you did not ask for: the marketing box starts unticked, nothing is shared, there is no advertising and we do not track you across other sites. If you are under 13, please ask a parent or carer before you register and leave the marketing box unticked; we will not send marketing email to anyone we know to be under 13.
Your Rights
You have the right to:
- ask for a copy of the personal data we hold about you
- ask us to correct it if it is wrong
- ask us to delete it
- ask us to restrict how we use it
- object to our using it on the basis of legitimate interests
- ask for data you gave us in a portable form, where we rely on contract or consent
- withdraw your consent to marketing email at any time, without affecting what came before
Members can download a copy of their account data and delete their account themselves on the account page. Deletion is immediate and removes your account, progress, assessments, certificates, feedback sent while signed in and email choices from our database; only the 90 day security log described above outlasts it, and our encrypted backups, which hold a copy for at most 30 days.
See ask for your data for how. We answer within one month. There is no charge in most cases.
Complaints
If you are unhappy with how we have handled your data, please tell us first at legal@greywellcyber.com. We will acknowledge your complaint within 30 days, look into it, keep you told how it is going and let you know the outcome. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
How We Protect It
We keep the data we collect to the minimum this page describes and limit who can reach it. No method of storing or sending data is free of risk, and we will tell you and the ICO if something goes wrong in a way the law requires.
Changes
If we change this policy we will update the date at the top. If a change matters to how we use your data, we will say so on this page, and tell members by email before it takes effect.