Privacy Policy

Definitions

• Service means the Cyber Leadership Institute website operated by Cyber Resilience Pty Ltd.
• Personal Data means information about a living person who can be identified from that information, either on its own or together with other information in our possession or likely to come into our possession.
• Usage Data means data collected automatically through your use of the Service or from the Service infrastructure, such as the duration of a page visit.
• Cookies are small files stored on your computer or mobile device.
• Data Controller means the person or organisation that determines why and how personal information is processed. For this Privacy Policy, Cyber Resilience Pty Ltd is the Data Controller of your Personal Data.
• Data Processor or Service Provider means a person or organisation that processes data on behalf of the Data Controller. We may use Service Providers to process data more effectively.
• Data Subject or User means a living person who uses the Service and is the subject of Personal Data.

Information We Collect

We collect different types of information where needed to provide, maintain and improve the Service.

Personal Data

While you use the Service, we may ask you to provide information that can be used to contact or identify you. This may include:

• Email address
• First name and last name
• Phone number
• Address, state or province, postcode or ZIP code, and city
• Cookies and Usage Data

We may use your Personal Data to send newsletters, marketing or promotional communications and other information that may be relevant to you. You can unsubscribe at any time using the link or instructions included in our emails.

Usage Data

We may collect information about how the Service is accessed and used. This may include your IP address, browser type and version, pages visited, date and time of access, time spent on pages, unique device identifiers and other diagnostic information.

Cookies and Tracking Technologies

We use cookies and similar technologies, including beacons, tags and scripts, to understand activity on the Service, remember information and improve the experience.

You can configure your browser to refuse cookies or alert you when a cookie is being sent. Some parts of the Service may not function properly if you disable cookies.

• Session Cookies - used to operate the Service.
• Preference Cookies - used to remember your preferences and settings.
• Security Cookies - used for security purposes.

How We Use Data

Cyber Resilience Pty Ltd may use collected data to:

• Provide and maintain the Service
• Notify you about changes to the Service
• Enable interactive features when you choose to use them
• Provide customer support
• Analyse information that helps us improve the Service
• Monitor use of the Service
• Detect, prevent and address technical issues
• Provide news, special offers and information about similar goods, services or events, unless you have opted out

Legal Basis for Processing Personal Data under the GDPR

If you are in the European Economic Area (EEA), our legal basis for processing Personal Data depends on the information collected and the context in which it is collected. We may process Personal Data because:

• We need it to perform a contract with you
• You have given us consent
• The processing is in our legitimate interests and those interests are not overridden by your rights
• It is required for payment processing
• It is required to comply with the law

Data Retention

We retain Personal Data only for as long as necessary for the purposes described in this Privacy Policy. We may retain and use Personal Data where required to meet legal obligations, resolve disputes and enforce our agreements and policies.

Usage Data is generally retained for a shorter period unless it is needed to improve security or Service functionality, or a longer retention period is required by law.

International Data Transfers

Your information, including Personal Data, may be transferred to and stored on systems located outside your state, province, country or other jurisdiction, where data protection laws may differ from those that apply where you live.

If you are outside Australia and provide information to us, your data may be transferred to and processed in Australia. By submitting your information, you agree to that transfer.

We take reasonable steps to ensure Personal Data is handled securely and in accordance with this Privacy Policy. We do not transfer Personal Data to an organisation or country unless appropriate controls are in place, including controls designed to protect your personal information.

Disclosure of Data

Law Enforcement and Legal Requirements

We may be required to disclose Personal Data where required by law or in response to a valid request from a public authority, such as a court or government agency. We may also disclose Personal Data in good faith where necessary to:

• Comply with a legal obligation
• Protect and defend the rights or property of Cyber Resilience Pty Ltd
• Prevent or investigate possible wrongdoing connected with the Service
• Protect the personal safety of Service users or the public
• Protect against legal liability

Data Security

The security of your data is important to us. However, no method of internet transmission or electronic storage is completely secure. We use commercially reasonable measures to protect Personal Data, but we cannot guarantee absolute security.

Do Not Track Signals

We do not currently support Do Not Track (DNT) browser signals. DNT is a browser preference that can be used to indicate that you do not want to be tracked. You can enable or disable DNT through your browser settings.

Your GDPR Data Protection Rights

If you are a resident of the EEA, you may have rights in relation to your Personal Data. We take reasonable steps to help you access, correct, amend, delete or restrict the use of your information. Depending on the circumstances, your rights may include:

• Access, update or deletion - request access to, correction of or deletion of Personal Data we hold about you.
• Rectification - have inaccurate or incomplete information corrected.
• Objection - object to our processing of your Personal Data.
• Restriction - ask us to restrict processing of your Personal Data.
• Data portability - receive a copy of your information in a structured, commonly used and machine-readable format.
• Withdrawal of consent - withdraw consent at any time where we rely on consent as the basis for processing.

We may ask you to verify your identity before responding to a request. You may also have the right to complain to your local data protection authority in the EEA about our collection and use of Personal Data.

Service Providers

We may engage third-party companies or individuals to facilitate the Service, provide services on our behalf, perform Service-related functions or help us understand how the Service is used. These providers may access Personal Data only to perform those tasks on our behalf and are required not to disclose or use it for other purposes.

Analytics

We may use third-party providers to monitor and analyse use of the Service. Google Analytics may collect website traffic and usage information. Google may also use collected data across its services. You can use the Google Analytics opt-out browser add-on to prevent Google Analytics from collecting information about your visits. For more information, review Google Privacy & Terms.

Google reCAPTCHA

We use Google reCAPTCHA to help protect our website and forms from spam, abuse and automated attacks. reCAPTCHA may process technical information such as your IP address, browser and device details, interaction patterns and access time to help determine whether you are a human user.

Legal Basis for reCAPTCHA under the GDPR

For users in the EU/EEA, our use of reCAPTCHA is based on our legitimate interest under Article 6(1)(f) GDPR in protecting the website and preventing fraud and abuse. Where required by law, reCAPTCHA will only be activated after appropriate consent has been obtained.

Roles and International Transfers for reCAPTCHA

Cyber Leadership Institute is the Data Controller for Personal Data collected through reCAPTCHA on this website. From April 2, 2026, Google acts as our Data Processor for this service. Data may be processed outside the EEA. Where applicable, safeguards such as Standard Contractual Clauses are used. For more information, review Google's data processing and privacy terms.

Behavioural Remarketing

We use remarketing services to advertise on third-party websites after you have visited the Service. We and our third-party vendors may use cookies to inform, optimise and serve advertising based on previous visits to the Service.

Google Ads remarketing is provided by Google. You can manage personalised advertising through Google Ads Settings and use the Google Analytics opt-out browser add-on. Review Google Privacy & Terms for more information.

Facebook remarketing is provided by Facebook. You can manage interest-based advertising through Facebook settings and relevant industry opt-out tools. Review Facebook's Data Policy for more information.

Payments

We may offer paid products or services through the Service and use third-party payment processors to process payments. We do not store or collect your payment card details. Payment information is provided directly to the payment processor and is handled under that provider's privacy policy. Our payment processors are expected to comply with PCI-DSS requirements designed to support secure handling of payment information.

• Stripe - review Stripe's Privacy Policy for more information.

Links to Other Websites

The Service may contain links to websites that we do not operate. If you follow a third-party link, you will be taken to that party's website. We encourage you to review the privacy policy of every site you visit. We do not control and are not responsible for the content, privacy policies or practices of third-party websites or services.

Children's Privacy

The Service is not directed to anyone under 18 years of age. We do not knowingly collect personally identifiable information from anyone under 18. If you are a parent or guardian and believe a child has provided us with Personal Data, please contact us. If we become aware that we collected Personal Data from a child without appropriate parental consent, we will take steps to remove it from our systems.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page and update the effective date. Where appropriate, we may also notify you by email or through a prominent notice on the Service before a change takes effect. We encourage you to review this policy periodically. Changes take effect when posted on this page.

Contact Us

If you have questions about this Privacy Policy, please contact us by email at contact@cyberleadershipinstitute.com.