GDPR Compliance

1. Our GDPR Role

When you use CyberGuardian, we act in two capacities:

• Data Controller — for account data, billing, license management, and website analytics
• Data Processor — for endpoint data processed by the agent on your systems (process, configuration, and security event data). Where you deploy CyberGuardian on employee workstations, you act as Data Controller in respect of that data, and we process it solely on your documented instructions.

As Data Controller of employee data, you are responsible for informing your employees about the monitoring, and for establishing a lawful basis for it under applicable national employment and data protection law.

A Data Processing Agreement (DPA) under Article 28 is available for enterprise customers. Contact: support@cyberguardian.bg

2. Lawful Basis for Processing

• Article 6(1)(b) — Contract: Processing your account and license data to deliver the service
• Article 6(1)(f) — Legitimate interests: Network and information security, as expressly recognised in Recital 49 GDPR. This basis covers the processing of data relating to third parties involved in detected intrusion attempts, including source IP addresses.
• Article 6(1)(a) — Consent: Marketing emails (opt-in only, withdrawable at any time)

3. Data Minimization

We collect only the technical data necessary to deliver threat detection, incident response and license validation. The full categories of data processed by the agent are described in our Privacy Policy, Section 2.2.

4. Data Transfers

All data is processed by infrastructure providers that implement appropriate technical and organisational measures in accordance with GDPR requirements. We do not transfer personal data to third countries.

5. Data Subject Rights

Under GDPR Articles 15-22, you have the following rights regarding your personal data:

• Right of access (Art. 15) — obtain a copy of your personal data within 30 days
• Right to rectification (Art. 16) — correct inaccurate or incomplete data
• Right to erasure (Art. 17) — request deletion ("right to be forgotten")
• Right to restriction (Art. 18) — limit how we process your data
• Right to portability (Art. 20) — receive your data in a structured, machine-readable format
• Right to object (Art. 21) — object to processing based on legitimate interests
• Rights re: automated decisions (Art. 22) — our AI-based risk scoring assists human decision-making and does not produce legally binding decisions

Submit requests to: support@cyberguardian.bg. We will assess each request individually and respond within 30 days.

6. Security Measures (Art. 32)

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, loss or disclosure.

7. Data Breach Notification (Art. 33-34)

In the event of a personal data breach:

• We will notify the Bulgarian CPDP within 72 hours of becoming aware
• We will notify affected individuals without undue delay if the breach poses a high risk
• Enterprise customers will be notified immediately as part of our incident response

8. Data Retention

We retain personal data only for as long as necessary to provide the service or as required by applicable law. Financial records are retained for 7 years in accordance with the Bulgarian Accounting Act.

9. NIS2 and GDPR Intersection

CyberGuardian supports organisations in addressing both GDPR and NIS2 compliance requirements through integrated security monitoring and documentation capabilities.

10. Supervisory Authority

You have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP):

• Website: www.cpdp.bg
• Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
• Email: kzld@cpdp.bg