GDPR Compliance

1. Our GDPR Role

When you use CyberGuardian, we act in two capacities:

• Data Controller — for account data, billing, and website analytics

A Data Processing Agreement (DPA) is available upon request for enterprise customers. Contact: support@cyberguardian.bg

2. Lawful Basis for Processing

• Article 6(1)(b) — Contract: Processing your account and license data to deliver the service
• Article 6(1)(f) — Legitimate interests: Security threat detection and platform improvement
• Article 6(1)(a) — Consent: Marketing emails (opt-in only, withdrawable at any time)

3. Data Minimization

We collect only the minimum technical data necessary to deliver the CyberGuardian service, including device identifiers and system information required for threat detection and license validation.

4. Data Transfers

All data is processed by infrastructure providers that implement appropriate technical and organisational measures in accordance with GDPR requirements. We do not transfer personal data to third countries.

5. Data Subject Rights

Under GDPR Articles 15-22, you have the following rights regarding your personal data:

• Right of access (Art. 15) — obtain a copy of your personal data within 30 days
• Right to rectification (Art. 16) — correct inaccurate or incomplete data
• Right to erasure (Art. 17) — request deletion ("right to be forgotten")
• Right to restriction (Art. 18) — limit how we process your data
• Right to portability (Art. 20) — receive your data in a structured, machine-readable format
• Right to object (Art. 21) — object to processing based on legitimate interests
• Rights re: automated decisions (Art. 22) — our AI-based risk scoring assists human decision-making and does not produce legally binding decisions

Submit requests to: support@cyberguardian.bg. We will assess each request individually and respond within 30 days.

6. Security Measures (Art. 32)

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, loss or disclosure.

7. Data Breach Notification (Art. 33-34)

In the event of a personal data breach:

• We will notify the Bulgarian CPDP within 72 hours of becoming aware
• We will notify affected individuals without undue delay if the breach poses a high risk
• Enterprise customers will be notified immediately as part of our incident response

8. Data Retention

We retain personal data only for as long as necessary to provide the service or as required by applicable law. Financial records are retained for 7 years in accordance with the Bulgarian Accounting Act.

9. NIS2 and GDPR Intersection

CyberGuardian supports organisations in addressing both GDPR and NIS2 compliance requirements through integrated security monitoring and documentation capabilities.

10. Supervisory Authority

You have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP):

• Website: www.cpdp.bg
• Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
• Email: kzld@cpdp.bg