Privacy
What we collect about you, why, who we pass it to, and how long we keep it. Without the legal padding.
Last updated: 28 October 2026
The data controller is CypherOn, company ID 23496495, registered at Korunní 2569/108, Vinohrady, 101 00 Prague 10, Czech Republic.
For anything related to personal data, reach us at [email protected] or +420 910 927 985. We have not appointed a Data Protection Officer — the law does not require one of us.
Contact form and the “Under attack” form. Your name, email, phone, company, the type of inquiry or incident, and whatever you write to us. We process it so we can reply and possibly agree on working together — the legal basis is steps prior to entering a contract and our legitimate interest in answering an inquiry (Art. 6(1)(b) and (f) GDPR). Filling in the form is voluntary; without an email or phone number we have no way to get back to you.
Newsletter. The email address you give us with your consent (Art. 6(1)(a) GDPR). Alongside it we store the IP address and browser details from which the consent was given — that is our record that the consent exists. You can withdraw it at any time via the link at the bottom of every email — no reason needed, no consequences.
Document downloads. Name, email and optionally company. We use it to send you the download link; we also keep a record of which document was downloaded, together with browser details and a fingerprint of the IP address. The legal basis is our legitimate interest in knowing which documents people are interested in.
Security tools. The password check, the password generator and the file fingerprint calculation run entirely in your browser — neither the password nor the file reaches us. With the email domain check, the website header check and the file fingerprint check, all you send us is the domain, the page address or the fingerprint you entered; we cache the result for a few minutes so we do not ask the same question repeatedly. The breach check needs your email address, because that is where we send the verification link: we hold the address encrypted for at most 60 minutes, until you confirm the link or it expires, and then delete it. The legal basis is our legitimate interest in running a publicly available tool and preventing its misuse — with the breach check, above all preventing anyone from querying somebody else's mailbox through it (Art. 6(1)(f) GDPR).
Self-checks and calculators. The answers you fill in stay in your browser and are not sent to us. The email address you enter in the ZKB readiness check to receive the report is processed only if you also tick the newsletter subscription — the same applies to it as to the newsletter above, including the consent and your ability to withdraw it at any time.
Visiting the site. See cookies and analytics below.
Ad measurement and reaching you again. Only if you allow marketing cookies in the cookie bar does the site load the Meta Pixel (Facebook and Instagram), the LinkedIn Insight Tag and Google advertising cookies. They record the pages you visit and the submission of an inquiry form, so we can see which ads work and show you our ads again on those platforms. The form content (name, email, phone, company or message) is not passed to them, only the fact that an inquiry was sent. The legal basis is your consent (Art. 6(1)(a) GDPR and Section 89(3) of Czech Act No. 127/2005 Coll., on Electronic Communications). You can withdraw it at any time via Cookie settings in the site footer.
We do not use personal data for automated decision-making that has legal effects on you. With marketing consent, however, Google, Meta and LinkedIn build audiences for ad targeting from your visits.
We do not sell it to anyone. We share it only with these recipients:
Transfers outside the EU. Google, Meta and LinkedIn may transfer data to their parent companies in the USA (Google LLC, Meta Platforms, Inc. and LinkedIn Corporation). All three are certified under the EU-U.S. Data Privacy Framework, covered by the European Commission's adequacy decision.
We may also disclose data where the law requires it — typically to law enforcement or the supervisory authority.
After that we delete it. We keep things longer only where the law says we must (accounting records, for instance).
The site runs its own traffic measurement, which stores no cookies and does not handle your IP address in a form that could identify you. It records the page visited, where you came from, browser language, screen resolution and how long you stayed.
Google Analytics 4 is always on the site, but without your consent it runs in a limited mode (Consent Mode): it neither stores nor reads cookies and does not build a profile out of your visits. Even in that mode it still sends the basic page-view signal, so Google records your IP address and browser type. Only after consent do the analytics cookies get added, which are what makes a returning visitor recognisable.
Your choice in the cookie bar. You give consent separately for two categories, and you can reject both as easily as accept them:
We store your choice in browser storage (localStorage), not in a cookie, and it lasts until you change it or clear the site data. You can change or withdraw it at any time via Cookie settings in the site footer. After withdrawal the marketing tags no longer load from the next page view and we delete their cookies on our domain. Cookies that Meta and LinkedIn stored on their own domains we cannot delete. You can do that in your browser settings. How long the platforms themselves keep the data is governed by their policies.
Technical cookies required to run the site (admin login, form protection) do not require consent.
Under the GDPR you have the right to:
Just write to [email protected]. We will get back to you as soon as we can, within one month at the latest.
If you believe we are handling your data badly, you can complain to the Czech Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz.
When the way we handle data changes, we update this text and change the “last updated” date at the top. We do not keep a version history, so if this document matters to you, save a copy.