Privacy policy

1. Who is responsible

This website is operated by Cyberfrog Security, c/o Spoofguard AG, Chamerstrasse 172, 6300 Zug, Switzerland ("Cyberfrog", "we", "us"). We are responsible for the processing of personal data described in this policy. For any privacy question or request, write to info@cyberfrogsecurity.com.

This policy covers the website cyberfrogsecurity.com, including the blog at /blog/. It does not cover the Cyberfrog platform used by our customers, which is governed by the customer agreement and its data processing terms.

2. Which data we process and why

Visiting the website

When you open a page, our web server automatically records technical data: your IP address, date and time, the page requested, the referring page, and your browser and operating system. We use this data to deliver the site, keep it secure and investigate abuse. Legal basis: our legitimate interest in a secure, working website (art. 6(1)(f) GDPR; art. 31 Swiss FADP).

Demo, quote and contact requests

When you send one of our forms we receive what you enter, for example your name, business email, company, website, job title, company size, country, area of interest and message, plus the page you sent it from, the time and your IP address. We use this to answer you, arrange a demo, prepare a quote and keep a record of the conversation. Legal basis: steps taken at your request before a possible contract, and our legitimate interest in answering business enquiries (art. 6(1)(b) and (f) GDPR).

To keep the forms free of spam, each form uses a short-lived signed token, a hidden honeypot field, a check that your company website exists, and limits on how often one IP address can submit.

Newsletter

If you subscribe, we store your email address and use it to send our newsletter about security threats, lessons and product news. Legal basis: your consent (art. 6(1)(a) GDPR). You can unsubscribe at any time through the link in every issue or by emailing us.

Chat assistant

The "Ask Cyberfrog" assistant answers questions about our product automatically. Your messages, your browser language and your time zone are sent to our own server to pick an answer and a language. We do not store the content of chat conversations. If you choose to leave your name and business email in the assistant to receive updates, we store those details for that purpose. Legal basis: our legitimate interest in answering visitors, and your consent for updates.

Blog

The blog runs on WordPress on our own server. If you leave a comment, we store the name, email, website and text you enter together with your IP address and browser details, and the comment may be checked for spam by Akismet, a service of Automattic Inc. in the United States. When you are logged in or have commented, WordPress may set functional cookies to remember you.

3D lessons

Links to our interactive 3D lessons open a separate site, 3d.cyberfrogsecurity.com, also operated by us. Playing a public lesson works without an account; the server records the same technical data as described for this website.

3. Cookies, analytics and fonts

We use Google Analytics (Google Ireland Ltd., with possible transfer to Google LLC in the United States) to understand how the website is used: which pages are visited, approximate location, device and browser, and how visitors arrived. Google Analytics sets cookies in your browser and receives your IP address. Legal basis: our legitimate interest in understanding and improving our website and, where the law requires it, your consent. We do not use advertising cookies or tracking pixels. The blog may also set the functional WordPress cookies described above.

You can block Google Analytics with a browser extension or by disabling cookies in your browser settings, or ask us to stop processing your data by emailing info@cyberfrogsecurity.com.

Our fonts are loaded from Google Fonts (Google Ireland Ltd., with possible transfer to Google LLC in the United States). When a page loads, your browser connects to Google and transmits your IP address. Legal basis: our legitimate interest in a consistent appearance of the website.

4. Who receives your data

We do not sell your data and share it only where needed to run this website:

• Hosting: the website, blog, forms and chat assistant run on servers of Hetzner Online GmbH in Germany.
• Email: form submissions are delivered to our team by email through Namecheap Private Email (Namecheap, Inc., United States).
• Google Analytics and Google Fonts (Google) and, for blog comments, Akismet, as described above.
• Authorities, where we are legally required to disclose data.

Where data is processed outside Switzerland or the European Economic Area, for example in the United States, we rely on an adequacy decision (such as the EU-U.S. and Swiss-U.S. Data Privacy Framework for certified companies) or on the standard contractual clauses of the European Commission, as recognised by the Swiss Federal Data Protection and Information Commissioner.

5. How long we keep it

• Web server access logs: deleted automatically after 14 days.
• Demo, quote and contact requests: for as long as needed to handle your request and any resulting business relationship, and afterwards only where the law requires us to keep business records.
• Newsletter and update sign-ups: until you unsubscribe or ask us to delete them.
• Blog comments: until you ask us to remove them or we delete the article.

6. Your rights

Under the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR), you have the right to:

• ask what personal data we hold about you and receive a copy;
• have incorrect data corrected and data deleted;
• restrict or object to our processing, including direct marketing at any time;
• receive data you gave us in a portable format;
• withdraw your consent at any time, without affecting processing before the withdrawal.

To use these rights, email info@cyberfrogsecurity.com. We may ask you to confirm your identity. You can also lodge a complaint with a supervisory authority, in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), or the authority of your EU country of residence.

7. Security

The website is served only over encrypted connections (HTTPS). Our servers are kept up to date, accessible only to authorised staff, and protected by firewalls and access controls.

8. Changes to this policy

We may update this policy when our website or the law changes. The current version is always published on this page, with the date of the last update at the top.