01Who We Are
Cybernyx is a managed endpoint security service operated by Unserver Business Solutions S.R.L., which is the controller of the personal data collected through this website.
- Company
- Unserver Business Solutions S.R.L.
- Registered address
- 1 Decembrie 1918 Street, No. 26, Sc. B, Ap. 8, Târnăveni, Mureș County, Romania
- Trade Register
- J26/804/2014
- VAT No.
- RO33532152
- Contact
- hello@cybernyx.eu
For any question about this policy or to exercise your rights as a data subject, please write to us at the email address above.
02Definitions
- Personal Data
- Any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
- Processing
- Any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
- Controller
- The natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by European Union law or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
- Processor
- A natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller.
- Sub-processor
- Another processor engaged by the Provider to carry out specific processing activities on behalf of the controller.
03GDPR Compliance
In accordance with the provisions of the General Data Protection Regulation (GDPR) and Law No. 190/2018 for its implementation into Romanian legislation, the Service Provider and the Client commit to comply with all legal obligations regarding the collection, processing, and protection of personal data.
This includes ensuring that data is processed in a secure, transparent manner and in compliance with the rights of data subjects, including the right of access, the right to rectification, data portability, restriction of processing, objection, and erasure of personal data.
Data subjects also have the right to lodge a complaint with the Romanian supervisory authority, ANSPDCP (www.dataprotection.ro).
04Data Collected via This Website
When you complete one of the forms on this website, we collect the data you provide. Depending on the form, this may include:
| Form | Data you provide | Purpose |
|---|---|---|
| Contact form | Name, company, email address, phone number (optional), estimated number of endpoints, area of interest, message. | To answer your enquiry or arrange a demo. |
| Free trial request | Submitted through the same contact form, with "Free 14-day trial" selected as the area of interest (interest=trial); same data as above. |
To contact you, agree the devices included in the trial and set up the free 14-day trial. |
| Order form | Contact name, company name, email address, phone number, VAT number, billing address, implementation contact (name and email), preferred deployment date, operating-system environment, selected plan and quantities, notes. | To process and confirm your order, invoice the service and plan the deployment. |
| Risk assessment form | Your answers to the assessment questions (about company size, IT set-up, devices, data and incident history), name, company, email address, phone number (optional) and role. | To prepare and deliver your risk assessment and recommended protection plan. |
This data is transmitted to us by email and is used exclusively to respond to your enquiry, set up a requested free trial, process and confirm your order, or prepare and deliver your risk assessment. The legal basis for this processing is your consent (Art. 6(1)(a) GDPR), given via the checkbox on each form, and the taking of steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR).
We do not use the data submitted through these forms for marketing purposes and we do not sell or share it with third parties, except where required to fulfil the requested service or by law.
For information about the cookies used on this website, please see our Cookie Policy. The site does not currently use any third-party analytics or marketing trackers. Fonts are loaded from Google Fonts, which technically requires your IP address to be transmitted to Google (see section 07).
05Client as Controller
The Client — as the controller, acknowledges and accepts the responsibility of protecting personal data stored and processed on its devices, in accordance with the requirements of the General Data Protection Regulation (GDPR) and applicable Romanian legislation. This includes the obligation to ensure the integrity and confidentiality of the data through technical and organizational measures.
06Provider as Processor
The Provider — Unserver Business Solutions S.R.L., as the processor, acknowledges that, for the purpose of providing the requested services, it may be necessary to access and process personal data provided by the Client. The Provider commits to accessing this data solely to fulfill contractual obligations and to provide the agreed services, fully respecting the confidentiality and integrity of this information.
Depending on the plan and add-ons contracted, the data processed in delivering the service may include:
- technical and security data from protected devices (for example device and user names, IP addresses, file, process and network activity, detections and security events);
- for Email Security, once activated, the content and metadata of emails in the protected mailboxes, accessed through an API connection to the Client's Microsoft 365 or Google Workspace tenant;
- for DNS Filtering, the DNS queries made by protected devices;
- for Identity Threat Detection & Response (EDR + MDR plan), sign-in and identity-related events of the protected user identities.
The same applies to devices included in a free trial, for the duration of the trial.
The Provider undertakes to implement appropriate technical and organizational measures to prevent unauthorized access, misuse, or disclosure of personal data.
The processing carried out on behalf of the Client is governed by the data processing agreement included in every client contract, in accordance with Art. 28 GDPR.
07Service Providers and Sub-processors
To operate this website and deliver the Cybernyx service, the Provider relies on the following third-party providers:
| Provider | Role | Data concerned |
|---|---|---|
| ThreatDown (Malwarebytes) | Endpoint security platform used to deliver all plans, including the Managed Detection and Response (MDR) service in the EDR + MDR plan. | Technical and security data from protected devices; identity-related events where ITDR applies. |
| IRONSCALES | Technology behind the Email Security component (EDR and EDR + MDR plans). | Email content and metadata of the protected mailboxes. |
| Cloudflare | Technology behind the DNS Filtering component (EDR and EDR + MDR plans). | DNS queries made by protected devices. |
| Google Fonts (Google) | Delivery of the fonts used on this website. | IP address and standard browser request data. |
| Website hosting and email providers | Hosting of this website and transmission of form submissions to us by email. | Data submitted through the website forms. |
Where these providers process personal data on behalf of the Client, they act as sub-processors of the Provider and are engaged under written agreements that impose data protection obligations, in accordance with Art. 28 GDPR. The Provider will inform Clients of any intended changes concerning the addition or replacement of sub-processors.
08Data Retention Period
Personal data will be retained as long as necessary to fulfill contractual purposes. Upon termination of the contractual relationship, data will be deleted or anonymised in accordance with applicable legal requirements and the agreed data retention schedule.
If a free trial ends without a plan being ordered, the Provider removes the agents and deactivates the licences on the trial devices, and the data processed during the trial is handled in the same way.
09Transfer of Data Outside the EU
Some of the providers listed in section 07, including ThreatDown (Malwarebytes), IRONSCALES and Cloudflare, may process personal data outside the European Economic Area (EEA), for example in the United States.
If personal data is transferred outside the EEA, the Provider will ensure appropriate protection measures are in place, in accordance with Chapter V of the GDPR. Such transfers will only occur on the basis of an adequacy decision of the European Commission — such as the EU–US Data Privacy Framework, for recipients certified under it, where applicable — or of other appropriate safeguards, such as the EU Standard Contractual Clauses.
10Data Breach Notification Procedure
In the event of a data security breach, the Provider will notify without delay both the competent authority and the data subjects, in accordance with the procedures established by the GDPR.
By accepting this document, the controller expresses agreement with the content of this document, including the operations of accessing and processing data from devices by the processor.
11Legislation
The General Data Protection Regulation (GDPR) — Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, is directly applicable in all EU member states, including Romania. In Romania, it is supplemented by Law No. 190/2018 on measures implementing the GDPR.