User Privacy Notice

Dear Collaborator,

In addition to the information on the processing of your personal data carried out by your employer, as the data controller, for purposes related to the management of the employment relationship, with this notice we wish, in compliance with the principle of progressiveness, to provide you with specific and detailed information on the use of the “Cyber Guru” portal for the continuous training of our employees and collaborators in the field of cyber security. In particular, the training is provided through an innovative e-learning system designed for non-specialist personnel of public and private organizations based on innovative training methodologies that take into account the most effective digital learning methods. The system involves the entire organization in an educational and stimulating learning path, characterized by a "constant and gradual release" approach. Another solution concerns an anti-Phishing training activity that produces effective results thanks to its particular on-the-job training methodology and the automation features supported by machine learning algorithms.

Data Controller is your employer or Client whose contact details you can acquire by accessing the institutional website.

Data Processor (areas of communication of personal data). For the provision of training activities through the indicated portal, your employer or Client has signed a specific contract with the company CYBER GURU s.r.l. designating it as the Data Processor pursuant to Article 28 of the GDPR, requiring compliance with data protection regulations and adequate security measures, including, in particular, the security of the IT tools used and the authorization of the data processing personnel. The responsible company will directly and/or through additional Sub-processors, provide the training activities described here. For the management of access and the authentication system to the portal, personal data may be processed by third parties providing single sign-on (SSO) services. In this case, the data will be pseudonymized by applying a "token" code.

Purpose and legal basis of the processing. The specific purposes relevant to the processing in question concern a precise training activity on cyber security topics and, in particular, on the awareness that our employees must have to make the best use of work tools and reduce the risk that cyber attacks and/or various issues may occur. The purpose, therefore, lies in the continuous and specific training that the employer provides in favor of its employees both as a component of a contractual relationship and as a tool to protect its legitimate interest represented by the security of its systems (training understood as an organizational measure also pursuant to Articles 29 and 32 of the GDPR) as well as, in light of the obligation provided by the aforementioned regulatory provisions, to instruct anyone who processes personal data and acts under its authority. For the reasons stated, therefore, it is not necessary to request your explicit consent for the described processing.

Categories and flow of personal data. For the pursuit of the specified purposes, the Company, or its delegate, will communicate the following personal data to the designated Data Processor: name, surname, email, company function. Special categories of personal data (sensitive data) are not subject to processing.

Authorized subjects. Only specifically authorized subjects will have access to your personal data in compliance with the principle of necessity. In particular: the Data Processor and any sub-processors may have access to the personal information (name, surname, email, company function, test results) necessary for the creation of the user profile for the provision of the training activity. Considering the organization, a Team Leader profile (internal to the company coinciding with the head of the Office) may be created, which may have access to information related to the learning levels (in aggregate form) of the users and a Supervisor profile (internal to the company) that may have access to information on the training path of all users. This is to acquire information regarding the training provided. The feedback information that the data controller may obtain on the outcome of phishing attacks is anonymized information for statistical purposes only (number of successful attack attempts on the number of interested parties involved, etc.).

Extra-EU transfer. The personal data within the scope of the processing in question will not be transferred to non-EU countries or international organizations but will be processed, directly or through Processors, within the EU territory (Dublin).

Retention period. The data is retained based on the time strictly necessary to achieve the purposes indicated in this notice. Personal data will be deleted 90 days after the conclusion of the contract.

Rights of the data subject. We remind you that you can exercise the rights provided by Articles 15 – 22 of the GDPR at any time by sending a simple request to the Data Controller or contacting the Data Protection Officer if appointed. Finally, we remind you that you can also file a complaint with the Supervisory Authority.

Automated processing. The company responsible for processing does not carry out processing based on automated decision-making processes, including profiling. The company owning the training platform carries out automated processing aimed at sending phishing attacks based on the response level of the learners, profiling them to enable the advancement stages of phishing attacks.

Automatic Translation Warning

This Privacy Notice is drafted in Italian and English. Both versions are considered official and have equal legal value. Any versions in languages other than Italian and English, made available through automatic translation tools (including those integrated into digital platforms), are not considered official versions and have no legal value. Such translations are provided for informational purposes only.