Privacy Policy

CyberPostura is a product of Edka Ltd, a company registered in England and Wales. Edka Ltd is the data controller for the personal data described here. You can reach us at info@cyberpostura.com.

• Your name.
• Your work email address.
• Your company name, company size band and industry.
• Your questionnaire answers — the free posture check and, if you buy it, the detailed Cyber Essentials readiness assessment, along with the scores, roadmap and progress notes generated from them.
• Basic account and technical data needed to run the service: sign-in records and security logs. If you buy the assessment, our payment provider handles your card details — we never see or store them.

We do not ask for special category data. Please do not put confidential security detail, credentials or personal data about other people into free-text fields.

• To deliver your posture results and roadmap — including emailing you a copy of your results, and storing your answers so your roadmap and progress are there when you return. Lawful basis: performance of a contract, or our legitimate interests where you are not yet a customer.
• To send service emails — sign-in codes, password resets, purchase receipts and important changes to the service. Lawful basis: performance of a contract and our legitimate interests in operating a secure service.
• To keep the service secure and improve it — including feedback you choose to leave. Lawful basis: legitimate interests.
• To meet legal and accounting obligations for purchases. Lawful basis: legal obligation.

We do not send marketing without your consent, and no marketing box is ever pre-ticked. If you do consent, you can withdraw it at any time by emailing us — it will not affect your results or your account.

We keep your account, assessment answers and roadmap for as long as you have an account with us, so your history stays useful. If you delete your account, we erase your profile, answers, results and roadmap. Free-check leads that never become accounts are deleted after 24 months. Purchase and invoice records are kept for six years to meet UK accounting and tax rules.

We use a small number of processors, each under a data processing agreement:

• Lovable and Supabase — application hosting, database and authentication.
• Our email delivery provider — sending results emails, sign-in codes and service notices.
• Stripe — payment processing for the paid assessment.

Some processors may handle data outside the UK. Where they do, transfers are covered by the UK International Data Transfer Agreement or Addendum, or an adequacy decision. We do not sell your data or share it with advertisers.

You have the right to access your data, correct it, have it erased, restrict or object to our use of it, and to receive a copy in a portable form. You can also withdraw consent where we rely on it.

The quickest route to access and erasure is in the app: open your account page to review or update your details, or use Delete my account there to erase your data yourself. You can also email info@cyberpostura.com and we will respond within one month.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk). We would rather hear from you first so we can put it right.

We use only the storage needed to keep you signed in and to save your questionnaire progress on your own device. We do not use advertising or cross-site tracking cookies.