Privacy Policy

This policy is intended to comply with the General Data Protection Regulation (GDPR), applicable Belgian data protection laws, and relevant cybersecurity best practices.

CyGhost is a cybersecurity and IT services business based in Belgium.

For most website, sales, billing and business communication activities, CyGhost acts as a data controller.

When CyGhost processes customer logs, security events, technical data, assessment evidence, endpoint metadata or similar information on behalf of a customer, CyGhost usually acts as a data processor. In that case, the customer remains the data controller and the processing is governed by a contract, statement of work, data processing agreement, or similar written instruction.

This Privacy Policy applies to:

• Visitors of our website
• Prospects and customers
• Business contacts
• Suppliers and partners
• Users of CyGhost platforms
• Individuals whose data may appear in customer security logs or technical evidence processed by CyGhost

This policy does not replace a customer agreement, statement of work, data processing agreement, non-disclosure agreement, or professional services contract.

Depending on your relationship with CyGhost, we may process the following categories of data.

CyGhost does not intentionally request or collect sensitive personal data such as health data, biometric data, religious beliefs, political opinions, or criminal offence data unless strictly required for a specific legally authorised engagement.

Customers must not submit sensitive personal data to CyGhost unless this is necessary, lawful, documented and agreed in writing.

CyGhost may process personal data for the following purposes:

• Providing cybersecurity and IT services
• Delivering penetration testing, vulnerability assessments and security reviews
• Operating and securing CyGhost platforms
• Responding to contact requests
• Preparing proposals and contracts
• Managing customer relationships
• Providing customer support
• Sending service notifications
• Processing invoices and payments
• Improving website performance
• Detecting abuse, fraud, attacks or misuse
• Maintaining audit trails
• Meeting legal, tax and accounting obligations
• Defending legal claims
• Improving security controls, documentation and internal processes

CyGhost processes personal data only when a valid legal basis applies.

For cybersecurity services and future SaaS/SIEM/SOAR services, CyGhost may process customer-provided data, including security logs and technical telemetry.

CyGhost processes this data only to:

• Provide the agreed service
• Detect, investigate or report security events
• Maintain platform security
• Troubleshoot technical issues
• Support the customer
• Comply with written instructions
• Meet legal obligations

CyGhost does not sell customer data.

CyGhost does not use customer security logs for unrelated advertising.

CyGhost treats customer systems, vulnerabilities, reports, credentials, logs, business information and security findings as confidential.

Access to confidential information is limited to authorised personnel and service providers who need access for legitimate business or technical reasons.

CyGhost applies technical and organisational security measures appropriate to the risk, including where applicable:

• Access control
• Least privilege
• Multi-factor authentication
• Encryption in transit
• Encryption at rest where appropriate
• Secure credential handling
• Logging and monitoring
• Vulnerability management
• Patch management
• Backup and recovery controls
• Segmentation where appropriate
• Incident response procedures
• Supplier security review
• Secure development practices
• Audit trails
• Internal confidentiality controls

No system can be guaranteed to be completely secure. However, CyGhost continuously works to reduce risk and protect customer information.

CyGhost keeps personal data only as long as necessary.

Typical retention periods are:

Different retention periods may apply if required by law, contract, security investigation, or customer instruction.

CyGhost may share personal data with:

• Hosting providers
• Email providers
• Payment and accounting providers
• Security tools
• Cloud infrastructure providers
• Professional advisors
• Legal authorities where required
• Subcontractors approved or permitted under contract

CyGhost only shares data where necessary and expects service providers to protect the data appropriately.

Where CyGhost acts as a processor, subprocessors may be used to deliver hosting, support, security, monitoring, email, backup, analytics or infrastructure services.

A customer may request available information about relevant subprocessors by contacting: privacy@cyghost.com.

For enterprise customers, subprocessor terms may be handled through a separate Data Processing Agreement.

CyGhost aims to process and store customer data within the European Economic Area where reasonably possible.

If personal data is transferred outside the EEA, CyGhost will use appropriate safeguards where required, such as:

• Adequacy decisions
• Standard Contractual Clauses
• Contractual safeguards
• Security controls
• Transfer risk assessments where needed

Depending on the situation and applicable law, you may have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion
• Restrict processing
• Object to processing
• Request data portability
• Withdraw consent
• Lodge a complaint with a supervisory authority

To exercise your rights, contact: privacy@cyghost.com.

CyGhost may need to verify your identity before responding.

If CyGhost processes your data on behalf of a customer, we may refer your request to that customer because they are usually the data controller.

You have the right to lodge a complaint with the Belgian Data Protection Authority.

CyGhost uses cookies and similar technologies. More information is available in our Cookie Policy.

CyGhost services are intended for businesses and professional users. We do not knowingly target children or collect children’s personal data through our business services.

CyGhost does not use personal data for automated decisions that produce legal or similarly significant effects without appropriate safeguards.

Future security automation features may help detect risks, prioritise alerts or recommend actions, but final customer decisions remain subject to customer configuration, review and responsibility unless otherwise agreed.

CyGhost may update this Privacy Policy from time to time.

The latest version will be published on this page with a new “Last Updated” date.

For privacy questions, contact: