Privacy Policy

1. Who We Are

CyberGuardian is an enterprise endpoint detection and response platform developed and operated by CyberGuardian Security EOOD, registered in Bulgaria, EU. We act as data controller in respect of license and account data, and as data processor in respect of endpoint data processed on behalf of our customers.

Contact: support@cyberguardian.bg

2. Data We Collect

2.1 License & Payment Data

• Email address (for license management and communication)
• Payment information (processed securely via Stripe — we do not store card data)
• License key and activation status

2.2 Agent Telemetry

The CyberGuardian agent periodically transmits operational and security data from the protected endpoint to our servers. This includes:

(a) Device and status data

• Hostname and local IP address
• Agent version and protection status
• CPU, RAM and disk utilisation

(b) Process and execution data

• Names, executable paths and identifiers of running processes
• The Windows account under which a process is running
• Resource usage per process

(c) Security posture data

• System configuration relevant to security (e.g. firewall state, network protocol settings, account and policy configuration, patch and update status, software inventory)
• Integrity and self-protection status of the agent

(d) Detection and incident data

• Security events and alerts generated on the endpoint
• Records of quarantined files (file name, hash, action taken)
• Details of detected intrusion attempts, including the source IP address and port of the connecting party

Where connectivity is unavailable, data may be stored locally on the endpoint in encrypted form and transmitted once connectivity is restored.

2.3 Third-Party Data in Security Events

Detection and incident data (2.2(d)) may contain information relating to individuals other than the customer, such as the IP address of a party attempting unauthorised access. This data is processed on the basis of legitimate interests in network and information security (GDPR Recital 49) and is retained only as long as necessary for incident investigation and legal defence.

2.4 Customer Responsibility

Where the agent is deployed on employee workstations, the customer acts as data controller in respect of employee data processed by the agent, and is responsible for informing its employees and establishing a lawful basis for such monitoring under applicable national law. CyberGuardian Security EOOD acts as processor for this data.

3. Legal Basis for Processing

• Contract performance — processing necessary to deliver the CyberGuardian service
• Legitimate interests — network and information security, including the detection and investigation of intrusion attempts, as expressly recognised in Recital 49 GDPR

4. Data Retention

• License data: retained for the duration of your subscription + 2 years
• Agent telemetry: 90 days
• Detection and incident data: up to 12 months, or longer where required for ongoing incident investigation or legal defence
• Payment records: 7 years (legal obligation under Bulgarian Accounting Act)

5. Data Sharing

We do not sell your data. We share data only with:

• Stripe — payment processing (PCI DSS compliant)
• Railway — cloud infrastructure hosting (EU data centers)

6. Your Rights Under GDPR

• Right of access — request a copy of your data
• Right to rectification — correct inaccurate data
• Right to erasure — request deletion of your data
• Right to portability — receive your data in machine-readable format
• Right to object — object to processing based on legitimate interests
• Right to restriction — restrict processing in certain circumstances

To exercise any right, contact: support@cyberguardian.bg. We will respond within 30 days.

7. Security

All data is encrypted in transit (TLS 1.3) and at rest (AES-256). Access to production systems is restricted to authorized personnel only. We conduct regular security audits aligned with NIS2 Article 21 requirements.

8. Cookies

We use only technically necessary cookies for the website to function. We do not use advertising or tracking cookies.

9. Changes to This Policy

We will notify you of material changes via email at least 30 days before they take effect. Continued use of CyberGuardian after changes constitutes acceptance.

10. Contact & Complaints

Data Protection Officer: support@cyberguardian.bg

You have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP): www.cpdp.bg