Service providers are authorized to use personal information only to perform services for us (or for the client, when we are a processor) and must protect it under contract. We do not authorize service providers to use Cyber5 business contact data for their own unrelated marketing.

​

9. International data transfers

Cyber5 is based in the United States. Personal information is primarily processed in the United States and may be processed in other countries where our providers operate.

If personal information is transferred from a jurisdiction that restricts cross-border transfers (including the EEA, UK, or Switzerland), we use one or more lawful transfer mechanisms as applicable, such as Standard Contractual Clauses (SCCs) and UK/Swiss addenda where appropriate; other contractual, technical, and organizational safeguards; and explicit consent or another permitted derogation only where appropriate and lawful.

For client engagements, international transfer terms may also appear in the DPA or services agreement.

​

10. Retention

We retain personal information only as long as reasonably necessary for the purposes described in this Statement, including to provide services, meet legal/tax/insurance/contractual requirements, detect security incidents, resolve disputes, and support backup, disaster recovery, and audit needs for limited additional periods.

• Website and security logs: retained for operational security and troubleshooting, then deleted or aggregated

• Marketing contacts: until you unsubscribe or the record is no longer needed

• Sales/CRM records: for the active relationship and a reasonable post-relationship period

• Applicant records: for the recruiting cycle and any legally required period

• Client service records and security evidence: per contract, client instruction, and Cyber5 retention standards

When retention is no longer required, we delete, de-identify, or securely dispose of information, subject to legal holds and residual backup cycles.

​

11. Security posture

Protecting confidentiality, integrity, and availability is core to our business. Cyber5 maintains an information security and privacy program that includes administrative, technical, and physical safeguards appropriate to the nature of the data and our services. Depending on system and engagement, safeguards may include:

• Governance policies and workforce security/privacy expectations

• Role-based access and least privilege

• Multi-factor authentication on core systems

• Encryption in transit (TLS) and encryption at rest on primary platforms

• Endpoint protection, email security, and vulnerability management

• Logging, monitoring, and security operations processes

• Secure remote access practices

• Vendor risk management and contractual security requirements

• Incident response and breach-notification procedures

• Security awareness training

• Data classification and handling rules for sensitive and client information

• Backup and recovery controls

​

Our program is informed by recognized practices and frameworks commonly used in cybersecurity and compliance work, including elements aligned with the NIST Cybersecurity Framework (CSF) and, where relevant to client obligations, controls consistent with frameworks such as NIST SP 800-171, CIS Controls, and other contractual requirements. References to frameworks describe the types of controls and practices we design toward; they are not a claim that every system is certified, assessed, or in scope for a particular external audit unless we state that separately in a contract or report.

No method of transmission or storage is completely secure. We work to prevent unauthorized access, use, alteration, or disclosure and to respond to incidents as required by law and contract. Prefer approved secure channels and client portals for sensitive materials.

​

Security incidents

If we become aware of a security incident affecting personal information we control or process, we will investigate, contain, and remediate as appropriate, and provide notifications required by applicable law, regulation, and contract (including Texas and other U.S. breach-notification rules, and client notice commitments).

​

12. Your privacy rights and choices

Depending on where you live and our relationship with you, you may have rights to:

• Access personal information we hold about you

• Correct inaccurate personal information

• Delete personal information, subject to legal and contractual exceptions

• Obtain a copy of personal information in a portable format

• Opt out of certain processing, including targeted advertising, sale, or sharing where those concepts apply

• Limit use of sensitive personal information where required by law

• Object to or restrict certain processing (including where GDPR/UK GDPR applies)

• Withdraw consent where processing is consent-based

• Appeal a denied consumer request where state law provides an appeal right

• Lodge a complaint with a supervisory authority if those laws apply

 

Texas and other U.S. state privacy laws

If you are a consumer protected by the Texas Data Privacy and Security Act (TDPSA) or another comprehensive U.S. state privacy law (such as laws in California, Colorado, Connecticut, Virginia, and others, as applicable), you may have the rights listed above with the definitions and exceptions in that law.

• Cyber5 does not sell personal information for monetary consideration.

• If our website engages in “sharing” or targeted advertising using advertising cookies or similar technologies, you may opt out through cookie controls, recognized browser signals where honored, and by contacting dpo@cyber5.com.

• We will not discriminate against you for exercising privacy rights.

 

How to submit a request

Email dpo@cyber5.com with your name and contact information, the right you want to exercise, enough detail for us to locate your information, and your relationship to Cyber5 (website visitor, prospect, applicant, client contact, etc.).

We may need to verify your identity and authority (including if you use an authorized agent). If the request concerns data we process only as a client’s service provider/processor, we may direct you to the client or coordinate with the client as required. We will respond within the time required by applicable law.

​

13. Third-party sites and services

Our website may link to third-party websites, social media platforms, or tools we do not control. Their privacy practices are governed by their own policies. We are not responsible for third-party content or practices.

​

14. Children’s privacy

Cyber5 services and our public website are directed to businesses and professionals, not to children under 16 (or under 13 where COPPA applies). We do not knowingly collect personal information from children through the public website. If you believe a child provided personal information to us, contact dpo@cyber5.com and we will take appropriate steps to delete it.

​

15. Do Not Track

Some browsers offer a “Do Not Track” (DNT) signal. Because there is no uniform industry standard for DNT, our site may not respond to DNT signals. Where required, we honor legally recognized opt-out preference signals such as Global Privacy Control as described in Section 7.

​

16. Changes to this Privacy Statement

We may update this Privacy Statement from time to time. The “Last updated” date at the top will change when we post revisions. Material changes may also be highlighted on the website or communicated by other appropriate means. Continued use of the website after an update means the updated Statement applies to post-update collection and use, except where consent or another legal requirement applies.

​

17. Contact us

Cyber5 — Privacy / Data Protection

Email: dpo@cyber5.com
Phone: (713) 982-8006
Web: https://cyber5.com
For client-service or security emergencies related to an active managed service engagement, use the support and escalation channels in your service agreement or customer portal in addition to privacy contacts as appropriate.