Privacy Policy

MyCyberWay provides cyber security training, Microsoft certification training, career services and the Premium Jobs Board. This policy explains how we collect and use personal data when you visit our website, contact us, learn with us or use Premium Jobs, and the rights you have.

Last updated 10 November 2026.

• Who we are
• What we collect
• Tailor my CV
• CV vault
• MyCyberWay Apply
• How we use it
• Class recordings
• Sharing
• Outside the UK
• How long we keep it
• Your rights
• Deleting your data
• Concerns
• Cookies
• Security
• Changes

1. Who we are

MyCyberWay Limited is the controller of your personal data. We are registered in Scotland (company number SC872069), our registered office is in Penicuik, Midlothian, EH26 8NU, and we are registered with the Information Commissioner’s Office (ZC145856).

For any question about this policy or your data, email hello@mycyberway.co.uk with “Data protection” in the subject line, or write to our registered office.

Our courses and services are for adults, and we do not knowingly collect personal data from children.

2. The information we collect

Depending on how you deal with us, we may collect:

• Identity and contact details – your name, email address, phone number and billing address.
• Account and order details – your account login, the courses and services you buy, and payment confirmations. Card payments are handled by our payment providers; we never see or store your full card details.
• Your profile – the name you give us for your certificates and, if you choose to add one, a profile photo. We keep a small square copy of the photo without its location data, and you can remove it at any time in your account.
• Sign-in details from Google, Facebook or LinkedIn – if you choose to sign in with one of them, the name and email address it holds for you and a reference number for your account there. We never receive your password for that account, we do not keep the profile photo it holds, and we never post anything on your behalf.
• Sign-in security – if you sign in with a password: whether your sign-in codes come by email or from an authenticator app, that app’s secret key (kept encrypted), your backup codes (kept only in a form that can’t be read back) and the browsers you chose not to be asked on.
• Learning records – your enrolment agreement, your batch and attendance, the work you submit in our learning portal (including your lab and simulation answers and the queries you run in our practice lab), marks and feedback, quiz results, the recordings and materials you open, your progress and the credentials you earn.
• Class recordings – your voice, display name, chat messages and, if your camera is on, your image (section 4).
• Premium Jobs – the job families, filters and email times you choose, the roles you save and track, your notes on them, the interview details you add, the CV match score when you applied and the kind of CV and letter you sent with each application, and what our CV match reads from your CV: the file’s name, the skills it finds, your years of experience in each field, your seniority, certifications and clearance, and your scores. Your CV file is read in your browser and is never sent to us; its text comes to our website only for the match to read it, and is not kept. If you set up a CV vault, we also keep your CVs in it, and your application details if you choose, locked so that we cannot read them (see Your CV vault).
• Career information – your CV, professional profile, career goals and interview feedback, when you use our career services.
• Communications and preferences – the messages you send us, any testimonial you give us, your marketing choices and, if you switch them on, the address your browser gives us to send notifications to your device.
• Adjustment information – details of a disability or health condition, only if you choose to tell us so that we can support you. This is special category data, and we give it extra protection.
• Technical information – your IP address, browser type, the pages you request and your sign-ins, recorded in our website’s security logs.

Most of this comes from you. We also receive information from your employer if they book training for you (your name, work contact details and the training booked), from our payment providers (whether a payment succeeded), and from Google, Meta (Facebook) or LinkedIn if you choose to sign in with them.

Tailor my CV

When you use Tailor my CV, your CV is read, changed and written as a Word or PDF file in your own browser, on your device. The copies tailored for each role, and the cover letters you write there, are made the same way: their words are not sent to us, and we do not keep them. Your CV is one CV across Premium Jobs: wherever you add it (in My CV, on a role’s page or from your LinkedIn profile), and when you edit it, our CV match reads it and keeps only the facts described below.

If you choose to keep a copy for tailoring, it is stored in your browser on that device, with a copy for each role you tailor and the answers you gave for it (the latest 20), your letters and your choices for them (the latest 20), any adverts you paste, and any other CVs you add for particular roles (up to four, so five CVs in all), which are read and kept in your browser in the same way and are not read by our CV match. You can remove them all at any time in My CV (“Remove from this device”); clearing your browser’s data removes them too. On a shared computer, remove them when you finish. If you keep a CV vault, these CVs are in it too, locked (see Your CV vault); removing them from a device leaves your vault as it is.

To read an advert, your browser fetches our skills vocabulary and phrase bank, and to write a PDF, the font it uses, all from our own website. When you paste an advert from a board that shows only a summary, your browser sends us only the names of the skills it found, so we can update your CV match; the advert and your CV stay in your browser. Your CV match works as before: we keep only the facts it needs (the file’s name, the skills found, your years in each field, seniority, certificates, clearance and scores), never the file or its words. Tailor my CV uses those facts, in your browser, when it writes a profile for you.

Your application answers. If you set answers for application forms (your notice period, right to work, salary expectation, security clearance, where you are based and how you want to work), they are kept in your browser on that device, like your CV. They are not sent to us, and “Remove from this device” removes them too. If you import your LinkedIn profile, the file you choose is read in your browser and is not sent to us; the CV made from it is your CV, read by our CV match like any other. When you mark a role as applied, we keep with that role in your applications which kind of CV and letter went with it (your own or tailored; formal or warm; a full letter or an email) and the dates, so that you can see them later. We do not keep their words.

Your interviews and your numbers. Interview details you add to an application (the day, time, place and who you will meet) are kept with your applications on your account, as your notes are. When you mark a role as applied, we keep its CV match score with the application, so we can show you your numbers. We keep the score only, never your CV. Your notes on how an interview went, and why an application closed, are kept with your applications on your account.

Your stories and who you know. Your interview stories in Premium Jobs are kept in your browser on the device you use. They are not sent to us. If you add the connections file from your own LinkedIn data download, it is read and kept in your browser on that device. It is not sent to us, we never access LinkedIn for you, and you can remove it at any time. A role you add yourself is kept with your applications on your account; its advert stays in your browser, and only its title and the names of the skills it asks for reach us to work out your CV match.

Your CV vault

If you choose, you can keep up to five CVs in your CV vault, so that they are on every device you sign in on. You can keep your application details in it too: what MyCyberWay Apply fills forms with (your name, email, phone, address and answers) and the application answers you give in Premium Jobs, so that they come back on a new device, or if a browser forgets them. We keep them only with your consent, which you give when you set your vault up, and we record when you gave it. If your vault was set up before we offered this, My CV asks you once whether to keep your application details in it too; pressing “Keep them in my vault” gives your consent, and we record when.

Before a CV or your application details leave your browser, your browser locks them with a key made on your device (AES-256 encryption) and locks that key with a passphrase you choose. We never receive your passphrase, or the key unlocked, so we cannot open what we keep, and neither could anyone who stole it from us. What we keep is your CVs and application details locked, your key locked, and when each was saved and its size. They are kept on Microsoft Azure in the UK, in a store used only for CV vaults; the list of what is in your vault, and your locked key, are kept with your account on our website.

On another device, your passphrase unlocks your vault in that browser. Your application details then come back on that device, and to MyCyberWay Apply in that browser if it has none, or older ones; where two copies differ, the one saved last is kept. If you tick “Remember it on this device”, the key stays in that browser so that you are not asked again; “Lock it on this device” or “Remove from this device” in My CV makes that browser forget it. We cannot reset your passphrase: if you forget it, a device where your vault is open can set a new one, or you can start a new vault.

You can delete your vault at any time in My CV, even after your Premium Jobs end; this withdraws your consent. The CVs in it are deleted from our store straight away, and from Microsoft’s recovery copies within 7 days. Removing one of your CVs in My CV removes it from your vault too. You can take your application details out of your vault at any time with “Take them out” in My CV; this withdraws your consent to them, and they are deleted from our store straight away, and from Microsoft’s recovery copies within 7 days. Your CVs stay in your vault. We delete your vault 12 months after your Premium Jobs end, and when your account is deleted. Your CVs and details on your own devices, and in MyCyberWay Apply, are not affected.

MyCyberWay Apply (browser extension)

MyCyberWay Apply is our extension for Chrome and Edge. When you choose “Send to MyCyberWay Apply” on a role’s page, your CV and cover letter for that role, the details in that CV (such as your work history, education and address, and what it says about the questions forms ask, such as your right to work, notice period, clearance, years of experience and highest qualification) and your application answers go from the page to the extension, in your browser on that device. The extension keeps them there until you send another role’s, choose “Forget this pack”, or sign out of our website. When you add it, it asks for your details once: your name, email, phone, address and the answers application forms ask for. To start you off, our website gives it your account’s name, email, phone and billing address, with what your CV says (the address in it, and what it says about your right to work, notice period, clearance, driving licence and moving for work, each with the CV’s own words) and your application answers; these go from the page to the extension in your browser, and you check and change them before saving. The extension keeps your details in your browser on that device and uses them on the forms you ask it to fill. If you keep your application details in your CV vault, the extension gives its details to the Premium Jobs page in that browser, which locks them in your vault (see Your CV vault); when your vault opens in a browser where the extension has none, or older ones, the page gives them back to it. You can remove them at any time, in the extension or with “Remove from this device” in My CV, and they go if another account signs in to our website in that browser; signing out does not remove them, so on a shared computer, remove them when you finish. It starts only when you click it on an application form, and then fills that form and its next steps as they appear, until you press Stop or leave the page – your work history and education too, pressing the form’s own button for adding another job or qualification for each one in your CV. It fills only empty fields and never submits the form: you check it and send it yourself. What it fills from your CV, rather than from your details, it outlines in blue and lists for you to check. It also lists each part of your CV and your answers, so that you can copy any of them into the form yourself; copying puts that one piece on your device’s clipboard. When you press the form’s own upload button for your CV or cover letter, it hands that file to the form instead of opening your file browser. It does nothing on LinkedIn. The extension itself sends nothing to us and fetches nothing. The only pages it reads are the form you ask it to fill and our own website, where it receives what you send it and sees when you have signed out. What goes on an employer’s form goes to that employer, under their own privacy notice; some forms upload your CV or letter as soon as it is attached, before you submit, so check you are on the right employer’s form before you fill it.

3. How we use your information, and our lawful basis

Purpose	Lawful basis
Providing the courses and services you buy – your account, scheduling, classes, the learning portal, materials, assessments, credentials, Premium Jobs and career services	Contract
Creating your account and signing you in, including with Google, Facebook or LinkedIn if you choose to	Contract; steps you ask us to take before a contract
Taking payments, invoicing and keeping financial records	Contract; legal obligation
Responding to your enquiries	Legitimate interests; steps you ask us to take before a contract
Recording live classes for the learners on that course	Legitimate interests
Checking that submitted work is the learner’s own, by comparing submissions for similarity	Legitimate interests
Keeping the evidence behind a credential, so that it can be verified	Legitimate interests
Reporting attendance and completion to an employer who paid for your training	Legitimate interests
Keeping your CVs, and your application details if you choose, in your CV vault, so that you can use them on your other devices	Consent – you give it when you set your vault up (or, for your application details, with “Keep them in my vault”), and withdraw it by deleting your vault, or with “Take them out” for your application details
Sending our newsletter	Consent
Recording which website, advert or link brought you to us, with your order if you buy, to see which of our posts and adverts help people find our courses – only if you agree in our cookie banner	Consent
Telling existing customers about similar courses and services	Legitimate interests – you can opt out at any time
Supporting adjustments for a disability or health condition	Explicit consent
Publishing testimonials	Consent
Keeping our systems secure, preventing fraud, and handling complaints and legal claims	Legitimate interests; legal obligation
Improving our courses and services	Legitimate interests

Where we rely on legitimate interests, we have balanced them against your rights, and you can object (section 8). Where we rely on consent, you can withdraw it at any time.

Some things are scored automatically – quiz answers in the learning portal, and the CV match and ATS score in Premium Jobs, which are guidance for you alone – but decisions about your enrolment and your credentials are made by our team, never by automated processing alone.

Some information is needed to provide our services – for example, we cannot enrol you or issue a credential without your name and contact details.

4. Class recordings

Live classes are recorded so that learners can catch up on or review a class. Recordings are available only to the learners on that course and our tutors – for our Blue Team programmes, in our learning portal – and are deleted after a limited period (section 7). If you have any concerns about being recorded, speak to your tutor. Please do not make or share your own recordings, as they include other learners.

5. Who we share your information with

We share personal data only where it is needed, with:

• Service providers who support our business – such as IT and cloud services, email and video conferencing, website hosting, payment processing, invoicing and accounting, newsletter delivery and digital credentials. They act on our instructions and must keep your data secure and confidential. Payment providers also use payment information for their own fraud-prevention and legal duties.
• Anyone verifying your credential – each digital credential has a verification page, showing your name, the credential and its date, that anyone with the link can view.
• Your employer, if they paid for your training (section 3).
• Employers or recruiters, only if you ask us to introduce you. Premium Jobs never passes your details or your CV to employers.
• Google, Meta (Facebook) or LinkedIn, only if you sign in with them – that service knows you used it to sign in to our website, under its own privacy policy.
• Public authorities, such as HMRC, the police or the courts, where the law requires it.
• A buyer or successor of our business, if it is ever sold or reorganised, under the same protections.

If you contact us through, or join a community on, a third-party platform such as a messaging app or social network, that platform handles your data under its own privacy policy, and other members may see your profile.

6. Transfers outside the UK

Some of our service providers process data outside the UK. When they do, your data is protected by UK adequacy regulations or by safeguards approved under UK law, such as the International Data Transfer Agreement or the UK Addendum. Contact us if you would like more information.

7. How long we keep your information

We keep personal data only for as long as we need it for the purposes in this policy, then delete it or make it anonymous.

Information	How long we keep it
Orders, invoices and financial records	As long as tax and company law requires – normally six years
Enrolment agreements and learning records	Normally six years after your course ends, so that we can confirm your training and deal with any questions or claims
Work you upload in the learning portal	Three years after your course ends, as the evidence behind your credential, then deleted
Credentials	For as long as the credential is valid, so that it can be verified
Class recordings	Normally six months after the course’s final class
Premium Jobs settings, saved roles and CV match details	While your access lasts, and 12 months after it ends so that you can renew without starting again. You can remove your CV details at any time
Your CV vault, and the application details in it	Until you delete it (or take your application details out), or 12 months after your Premium Jobs end, and no longer than your account. What you delete leaves Microsoft’s recovery copies within 7 days
Career services material	Up to 12 months after we deliver the service
Your account, profile photo and notification settings	While your account is active, or until you remove them; we remove accounts that have been inactive for two years
The link between your account and Google, Facebook or LinkedIn	Until you remove it in your account, or your account is deleted
Sign-in security: your authenticator app’s key, backup codes and trusted browsers	Until you remove them in your account, or your account is deleted. A code we email you works for ten minutes
Enquiries	Up to 12 months after our last contact
Marketing	Until you unsubscribe; we keep a record of opt-outs so that we can respect them
Adjustment information	Until your course ends

If information is needed for a complaint or legal claim, we keep it until that is resolved.

8. Your rights

You have the right to access, correct or erase your personal data; to restrict or object to how we use it; to data portability; and to withdraw your consent at any time. You can always object to direct marketing.

To use your rights, email hello@mycyberway.co.uk with “Data protection request” in the subject line. We may need to confirm your identity. We respond within one month, or within three months for complex requests, and there is normally no charge. Some rights have legal limits – for example, we must keep financial records for as long as the law requires – and we will explain if one applies.

Deleting your account and your data

To delete your account and the personal data we hold about you – including what we received when you signed in with Google, Facebook or LinkedIn – email hello@mycyberway.co.uk from the address on your account, with “Delete my account” in the subject line. We delete your account and its sign-in links and confirm it within one month. Anything we must keep, such as invoices or the evidence behind a credential you hold, we keep only for as long as section 7 says.

You can also stop Google, Facebook or LinkedIn sharing anything more with us by removing MyCyberWay from the apps connected to your account there: Google, Facebook or LinkedIn.

9. Concerns and complaints

If anything about how we handle your data concerns you, please tell us – we want to put it right. Email hello@mycyberway.co.uk with “Data protection” in the subject line, or use the form on our Contact page. We acknowledge every complaint within 30 days, look into it properly and tell you what we have done.

If you are still not satisfied after that, you have the right to raise it with the Information Commissioner’s Office, the UK’s data protection regulator.

10. Cookies

Our website uses the cookies it needs to work, one that remembers your answer to our newsletter invitation, and, only if you agree in our cookie banner, cookies that record which website, advert or link brought you to us. We do not use analytics or advertising cookies. Our films play from YouTube only if you press play. Our Cookie Policy explains more, and how to change your choice at any time.

11. Security

We use appropriate technical and organisational measures to protect your data, including encryption in transit and access limited to those who need it, and we require the same of our service providers. Signing in with a password also needs a second step: a code by email, or from an authenticator app if you set one up in your account. Your CV vault is locked in your own browser with your passphrase before anything reaches us, so only you can read the CVs in it. If a breach is likely to put your rights at high risk, we will tell you without undue delay.

12. Changes to this policy

We may update this policy from time to time. The date at the top shows the latest version, and we will tell you directly about any significant change.