Privacy policy

Chandu Komme
operating under the project/brand Cybnivo
Martin-Luther-Ring 38
98574 Schmalkalden
Germany
Email: info@cybnivo.com

• Contact requests — name, work email, company, role, company size, country, area of interest and your message. Legal basis: Art. 6 (1)(b) GDPR (pre-contractual steps) and Art. 6 (1)(f) GDPR (legitimate interest in responding to business enquiries).
• Readiness self-check — your answers, the calculated category scores, the overall score, and optionally company name, contact email, company size and sector. Legal basis: Art. 6 (1)(a) GDPR (consent, given by submitting the check).
• Abuse-prevention data — a pseudonymous hashed connection identifier, derived from your IP address with a private secret, is temporarily processed to limit automated or excessive form submissions. The hash is used only to distinguish repeated submissions for abuse prevention. The raw IP address is not stored in the Cybnivo application database for this purpose, and the hash is automatically deleted 24 hours after it is created. Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in protecting the service against abuse).
• Server logs — technical request data generated by our hosting provider for security and stability. Legal basis: Art. 6 (1)(f) GDPR.

• No advertising trackers, no third-party marketing pixels, no cross-site profiling.
• No sale or rental of personal data to third parties, ever.
• No scanning, credential collection or technical testing of your systems from this website. Any assessment activity happens only under a separate signed authorization with a defined scope.

This website is hosted on a managed cloud platform, and contact requests and self-check submissions are stored in a managed database service provided through that platform. Both act as processors on our behalf under Art. 28 GDPR, on the data processing terms published by those providers, which we accepted when creating the services. Where a transfer outside the EU occurs, it relies on the Standard Contractual Clauses included in those terms.

Transactional email delivery: recipient email addresses and relevant request or self-check details are processed by our managed email delivery provider solely to send confirmations, results and internal notifications.

We name the specific providers we use on request. Write to info@cybnivo.com and we will send you the current list together with the relevant processing terms.

AI may assist with report drafting and website translation. Every customer-facing cybersecurity finding in a Cybnivo assessment is reviewed by the Cybnivo cybersecurity lead before delivery. Website translations may be machine-generated and are identified as such; the English version is authoritative for legal pages. Data you submit through this website is not sent to AI models, and we do not make assessment answers or engagement material available for third-party model training.

Deletion is currently handled manually: write to info@cybnivo.com and we remove your records from the database. Our retention policy is:

• Contact requests: 24 months after the last exchange, then deleted.
• Readiness self-checks: 12 months, or immediately on request.
• Abuse-prevention connection hashes: 24 hours, deleted automatically by a scheduled job.
• Engagement and accounting records: retained for the applicable statutory retention periods under German commercial and tax law.

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21), and you may withdraw consent at any time with effect for the future. Write to info@cybnivo.com and we will respond within one month.

You may also lodge a complaint with a supervisory authority in the EU member state of your residence or workplace.

This site sets no advertising or analytics cookies. Only strictly necessary technical storage is used to keep the site working, which does not require consent under § 25 (2) TDDDG.