Privacy Policy
NAMTRAC Ltd. (trading as Kiber Kontroll)
Last updated: 8 October 2026
Effective date: 8 October 2026
1. Introduction
This Privacy Policy explains how NAMTRAC Ltd., operating under the brand name "Kiber Kontroll" (hereinafter "we", "us", or "our"), collects, uses, and protects personal data when you use our website at www.kiberkontroll.hu and our cybersecurity awareness training services (the "Service").
We are committed to protecting your privacy and ensuring full compliance with:
- Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR")
- Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information (the "Hungarian Information Act")
- Act CVIII of 2001 on Electronic Commerce Services and Information Society Services
- Other applicable EU and national data protection legislation
Data Controller:
NAMTRAC Ltd.
1094 Budapest, Márton street 23-25, ground floor 4., Hungary
Company registration number: 01-09-877488
Tax number: 13869449-2-43 | EU VAT: HU13869449
Website: www.kiberkontroll.hu
Privacy contact: adatvedelem@kiberkontroll.hu
2. Scope of This Policy
This policy applies to:
- Website visitors — anyone who browses www.kiberkontroll.hu
- Newsletter subscribers and enquirers — anyone who subscribes to our newsletter or contacts us through the website
- Customers — companies and organisations that subscribe to our cybersecurity awareness training services
- Training participants ("mentees") — employees of our customers who take part in phishing simulation and security awareness programmes, including their use of the client portal
Note for training participants: If you are an employee who received a phishing simulation email, accessed a training landing page or uses the client portal, your employer (our customer) is the data controller for your participation in the programme. Kiber Kontroll processes your data exclusively as a data processor acting on your employer's behalf and instructions. Please also refer to your employer's internal privacy notices and acceptable use policies.
3. Our Commitment to Privacy
Privacy as a Core Principle
From the moment your employer subscribes to our Service until the subscription ends, the protection of your personal data and your right to privacy remains our highest priority. This commitment extends especially to training participants: we believe that an effective security awareness programme must be built on trust, and trust requires responsible, proportionate, and transparent data handling.
We apply the following principles throughout our service:
- Data minimisation: We collect only what is strictly necessary to deliver the Service.
- Purpose limitation: Data collected for training is used exclusively for that purpose — never for marketing, profiling, or sharing with parties beyond those listed in this policy.
- Confidentiality: Training results are reported in aggregate to employers; individual results are accessible only to authorised personnel within the employing organisation.
- Dignity and respect: Phishing simulations are conducted exclusively as an educational tool. We do not use outcomes as grounds for disciplinary action, we recommend that employers do not do so either, and we never share them beyond the employing organisation.
- Transparency: We are clear about what we collect, why, and how long we keep it.
- Security by design: Privacy protections are embedded in our architecture — not bolted on afterwards.
4. Data We Collect
4.1 Website Visitors
When you visit www.kiberkontroll.hu, we may process:
| Data | Purpose | Legal Basis |
|---|---|---|
| IP address | Security, fraud prevention, server logs | Legitimate interests (Art. 6(1)(f)) |
| Browser type, operating system, device | Compatibility, statistics | Legitimate interests / Consent |
| Pages visited, time and duration of visit | Website statistics and improvement | Consent (Art. 6(1)(a)) |
| Interaction and device signals on login, registration and password-reset forms (Google reCAPTCHA) | Protection against automated abuse | Legitimate interests (Art. 6(1)(f)) |
| Cookie consent record | Compliance record-keeping | Legitimate interests (Art. 6(1)(f)) |
4.2 Newsletter Subscribers and Enquiries
| Data | Purpose | Legal Basis | Retention |
|---|---|---|---|
| Email address, language of the site you subscribed on, time of subscription and of confirmation | Sending our newsletter in your language | Consent (Art. 6(1)(a)) | Until you unsubscribe or withdraw consent |
| Name, email address, message sent through the contact form | Answering your enquiry | Steps prior to a contract / legitimate interests (Art. 6(1)(b), (f)) | 1 year after the enquiry is closed |
Subscriptions are confirmed by e-mail (double opt-in): you only receive the newsletter after clicking the confirmation link we send you. Subscriber data is stored on our own server in Hungary and newsletters are sent through our own mail server - no third-party newsletter service is involved. You can unsubscribe at any time via the link in every newsletter or by writing to adatvedelem@kiberkontroll.hu.
4.3 Customers (Subscribing Organisations)
When your organisation subscribes to our Service, we process the following data, provided by the organisation itself:
| Data | Purpose | Legal Basis |
|---|---|---|
| Company name | Account identification, invoicing | Contract (Art. 6(1)(b)) |
| Billing address | Invoice generation | Legal obligation (Art. 6(1)(c)) |
| Contact person's name and email | Account management, support | Contract (Art. 6(1)(b)) |
| Payment information | Subscription billing via Revolut — we store no card data | Contract (Art. 6(1)(b)) |
| Invoice history | Tax and accounting compliance | Legal obligation (Art. 6(1)(c)) |
| Subscription status and history | Service delivery and entitlement management | Contract (Art. 6(1)(b)) |
Providing these data is a precondition of the subscription contract; without them we cannot provide the Service or issue invoices.
4.4 Training Participants (Mentees)
For employees enrolled in awareness training programmes, the following data is processed on behalf of their employer. The data are provided by the employer; we do not collect them from any other source.
Enrolment data entered by the employer:
| Data | Purpose | Retention |
|---|---|---|
| First name, last name | Personalising training communications | Duration of subscription |
| Email address | Sending training emails | Stored only in encrypted form (AES-256) in the employer's account for the duration of the subscription; decrypted in memory solely at the moment of sending |
| Preferred timezone | Scheduling communications at appropriate local times | Duration of subscription |
| Preferred language | Delivering training in the correct language | Duration of subscription |
| Group / team membership | Targeting relevant training scenarios | Duration of subscription |
Training interaction data recorded during simulations:
| Data | Purpose | Retention |
|---|---|---|
| Whether a simulation email was delivered | Training effectiveness measurement | Subscription + 1 year |
| Whether the simulation email was opened | Training effectiveness measurement | Subscription + 1 year |
| Whether a simulated link was clicked | Training effectiveness measurement | Subscription + 1 year |
| Whether a simulated form was submitted | Training effectiveness measurement | Subscription + 1 year |
| Whether the participant self-reported the simulation | Measuring security awareness level | Subscription + 1 year |
| IP address at the time of interaction | Security integrity, fraud prevention | Subscription + 1 year |
| Browser type at the time of interaction | Technical record | Subscription + 1 year |
| Timestamp of each interaction | Record integrity | Subscription + 1 year |
Client portal (training dashboard):
| Data | Purpose | Retention |
|---|---|---|
| Portal account identified by a random identifier (not the email address) | Logging in to the personal training dashboard | Duration of subscription |
| Non-reversible fingerprint of the email address (HMAC-SHA256) | Recognising the participant at login without storing the address | Duration of subscription |
| Password (stored only as a one-way hash) | Authentication | Duration of subscription |
| Points, level and badges calculated from the interaction data | Showing the participant's own progress | Duration of subscription |
| Notification emails (welcome, report acknowledgement, new badge or level) | Informing the participant about the programme | Not stored (see email protection below) |
Email address — special protection: Mentee email addresses are stored only encrypted (AES-256) in the employer's account. At send time, the address is decrypted in memory solely for the purpose of dispatching the training communication, then immediately discarded — it is never written in readable form to application logs, email logs, analytics systems, or any database field outside the employer's encrypted storage.
Form submissions — password exclusion: If a simulated form contains a password field, that field is automatically excluded from recording and never stored. Kiber Kontroll will never retain any password — real or test — submitted through a training form.
5. How We Process Data
5.1 Delivery of the Awareness Training Service
We process personal data to:
- Send scheduled phishing simulation emails on behalf of the employer
- Record participants' interactions with simulation emails (opens, clicks, form submissions, self-reports) and make these available to the employer as training outcomes
- Provide participants with a personal client portal showing their own progress, and send them programme notifications
- Generate anonymised, aggregate reports on programme effectiveness
- Manage subscription entitlements (active, trial, suspended)
5.2 Simulated Phishing Emails
Simulation emails are sent from domains operated or licensed by Kiber Kontroll and are designed to resemble common social engineering attacks. Every simulation link contains a cryptographically signed tracking identifier (HMAC-SHA256) that is unique per participant per simulation. This ensures that:
- Interaction records are authentic and tamper-evident
- No participant can be confused with another
- Tracking is strictly limited to the simulation in question
5.3 Aggregate Reporting and Statistics
Training results presented to employers are anonymised or aggregated wherever possible. Where individual outcomes are visible (e.g., in a per-participant report), access is restricted to authorised administrator accounts within the subscribing organisation.
5.4 Customer Account and Billing Management
Subscription and billing data is used to manage accounts, generate invoices, process payments via our payment gateway, and comply with Hungarian accounting and tax obligations.
5.5 Website Operation and Statistics
We use session cookies, website statistics tools and server logs to operate and improve our website. Statistics and marketing tools are enabled only with your consent.
5.6 Emails We Send
Our emails (training notifications, order and invoice emails, newsletters, replies to enquiries) are sent through our own mail server operated in Hungary. A delivery log of sent emails is kept for 12 months for troubleshooting; for emails sent to training participants, the log records only the fact of sending — never the address or the content.
6. Legal Basis for Processing
| Processing Activity | Legal Basis | GDPR Provision |
|---|---|---|
| Delivering subscription services to customers | Performance of a contract | Art. 6(1)(b) |
| Invoice and payment processing | Legal obligation | Art. 6(1)(c) |
| Sending phishing simulation emails to training participants | Legitimate interests of the employer in cybersecurity training | Art. 6(1)(f) |
| Recording training interaction outcomes | Legitimate interests of the employer in measuring programme effectiveness | Art. 6(1)(f) |
| Client portal and participant notifications | Legitimate interests of the employer in an effective training programme | Art. 6(1)(f) |
| Security logging, fraud and abuse prevention (incl. reCAPTCHA) | Legitimate interests | Art. 6(1)(f) |
| Answering enquiries | Steps prior to a contract / legitimate interests | Art. 6(1)(b), (f) |
| Newsletter | Consent | Art. 6(1)(a) |
| Website statistics | Consent | Art. 6(1)(a) |
| Marketing cookies | Consent | Art. 6(1)(a) |
| Compliance with Hungarian and EU law | Legal obligation | Art. 6(1)(c) |
Legitimate interests assessment for employee data processing: Security awareness training is a widely recognised organisational necessity to protect against cyber threats. The phishing simulation and awareness training activities are proportionate to this objective. Employees are notified of security awareness testing through their employer's acceptable use policy, employment contract, or information security policy; in Hungary, Section 11/A of Act I of 2012 on the Labour Code requires employers to inform employees in advance about such measures. Kiber Kontroll acts as a data processor; the employing organisation is the data controller and is responsible for ensuring a proper legal basis exists and for communicating this to employees.
7. The Privacy of Training Participants
We consider the protection of employee privacy to be non-negotiable. This section summarises the specific safeguards we apply for training participants.
What we never do:
- Never store mentee email addresses in plain text
- Never log email addresses in readable form at any level — application logs, email logs, infrastructure logs, or analytics
- Never record passwords submitted through simulated forms
- Never share individual training results with any party outside the employing organisation
- Never use training interaction data for advertising, profiling, or any purpose outside the training programme
- Never enable recording of audio, video, screen content, or keystrokes
What we always do:
- Encrypt email addresses (AES-256) and discard them from memory immediately after sending
- Use unique cryptographic identifiers per simulation to prevent tracking ambiguity
- Ensure that training outcomes are accessible exclusively to authorised employer-side administrators
- Apply de-duplication so that a single interaction is counted only once per simulation
- Provide participants with a mechanism to self-report suspicious emails, turning the simulation into an immediate learning opportunity
- Redirect participants who interact with a simulation link to a neutral educational page that explains the nature of the training
Reporting: Employers receive summary statistics (e.g., click rates by department or team). Individual results are surfaced only through role-controlled reporting, accessible only to authorised employer personnel.
8. Data Sharing and Sub-processors
We share personal data only as described below. We do not sell, rent, or trade personal data.
| Category | Provider | Country | Purpose | Transfer Basis |
|---|---|---|---|---|
| Web hosting and infrastructure | RACKFOREST Zrt. | Hungary (EEA) | Server and database hosting | EEA — no third-country transfer |
| Payment processing | Revolut Payments UAB | Lithuania (EEA) | Subscription billing | EEA — no third-country transfer |
| Invoice generation | Billingo Technologies Zrt. | Hungary (EEA) | Hungarian electronic invoices | EEA — no third-country transfer |
| Bot protection | Google Ireland Ltd. (reCAPTCHA) | Ireland (EEA) / USA | Protecting login and registration forms against automated abuse | EU–US Data Privacy Framework / Standard Contractual Clauses |
| Marketing and advertising | Meta Platforms Ireland Ltd. (Facebook Pixel) | Ireland (EEA) / USA | Marketing effectiveness (only with consent) | EU–US Data Privacy Framework / Standard Contractual Clauses |
RACKFOREST Zrt. (1132 Budapest, Victor Hugo utca 11., 5. em.) hosts our web servers and databases in Hungary, within the European Economic Area. No personal data processed under the awareness training Service leaves the EEA as a result of our hosting arrangements.
All sub-processors are required to maintain appropriate technical and organisational security measures. Data Processing Agreements (DPAs) are in place where required by GDPR.
Transfers outside the EEA take place only where:
- The recipient is covered by an EU adequacy decision — including companies certified under the EU–US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795) — or
- Standard Contractual Clauses (SCCs — Commission Implementing Decision (EU) 2021/914) have been put in place.
9. Data Retention
| Data Category | Retention Period | Basis |
|---|---|---|
| Customer account and contact data | Duration of subscription + 5 years | General limitation period (Hungarian Civil Code) |
| Invoice and billing records | 8 years from invoice date | Act C of 2000 on Accounting (Hungarian law) |
| Training interaction logs (mentees) | Duration of subscription + 1 year, or until erasure is requested by the employer | GDPR Art. 5(1)(e) |
| Mentee names, enrolment status and client portal account | Duration of subscription | Contract with the employer |
| Mentee email addresses | Encrypted, for the duration of the subscription; never stored in readable form | Data minimisation principle |
| Newsletter subscription | Until you unsubscribe or withdraw consent | Consent |
| Contact form enquiries | 1 year after the enquiry is closed | Legitimate interests |
| Website statistics (traffic source of an order, WooCommerce order attribution) | Stored on our own server together with the order, for as long as the order record is kept | Consent |
| Email delivery logs | 12 months | Legitimate interests |
| Server and security logs | 90 days | Legitimate interests |
| Cookie consent records | 3 years | EDPB guidance on consent records |
10. Security Measures
We implement appropriate technical and organisational measures in accordance with GDPR Art. 32 and industry best practices, including:
- Encryption of sensitive data at rest — Email addresses protected with AES-256 encryption; passwords stored only as one-way hashes; sensitive API credentials encrypted at rest using industry-standard algorithms
- Encryption in transit — TLS 1.2 or higher enforced on all connections
- Cryptographically signed tracking — All simulation links contain HMAC-SHA256 signed tokens; tampering is immediately detectable and rejected
- Role-based access control — Access to personal data is restricted based on organisational roles; the principle of least privilege is applied
- No logging of email addresses — Application, email and infrastructure logging is configured to exclude mentee email addresses at all levels
- Separation of privileges — The component that records participant interactions has read-only access to participant data and write access only to interaction records
- Web application firewall and brute-force protection — Active on the public-facing website
- Regular security patching — Operating system and application updates applied on a regular schedule
- Encrypted backups — Database backups are encrypted and stored off-site
Despite these measures, no system is completely secure. In the event of a personal data breach, we will notify the competent supervisory authority within 72 hours where required, and affected data subjects without undue delay where the breach is likely to result in a high risk to them, in accordance with GDPR Art. 33–34. Where we act as a processor, we notify the employer (data controller) without undue delay.
11. Your Rights
Under the GDPR, you have the following rights regarding your personal data:
| Right | Description | GDPR Article |
|---|---|---|
| Access | Request a copy of the personal data we hold about you | Art. 15 |
| Rectification | Ask us to correct inaccurate or incomplete data | Art. 16 |
| Erasure ("right to be forgotten") | Request deletion of your data where there is no longer a lawful basis | Art. 17 |
| Restriction of processing | Ask us to pause processing in certain circumstances | Art. 18 |
| Data portability | Receive your data in a structured, machine-readable format | Art. 20 |
| Objection | Object to processing based on legitimate interests | Art. 21 |
| Withdrawal of consent | Withdraw consent at any time without affecting the lawfulness of processing before withdrawal | Art. 7(3) |
How to exercise your rights: Send a written request to adatvedelem@kiberkontroll.hu. We will respond without undue delay and in any event within one month of receipt; this may be extended by a further two months for complex or numerous requests, in which case we will inform you within the first month. We may ask you to verify your identity before fulfilling the request.
Training participants: For rights related to phishing simulation and client portal data, contact your employer in the first instance, as they are the data controller for your training data. We will cooperate fully with your employer to assist in fulfilling rights requests affecting data we hold on their behalf.
Supervisory authority: If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH):
- Name: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
- Website: www.naih.hu
- Postal address: 1363 Budapest, Pf. 9.
- Email: ugyfelszolgalat@naih.hu
You may also contact the supervisory authority of your country of residence or place of work within the EU.
Court: You may also bring legal proceedings before a court (GDPR Art. 79). In Hungary such cases fall within the competence of the regional courts (törvényszék); you may choose to bring the case before the regional court of your place of residence or stay.
12. Cookies
We use the LW Cookie consent management platform to obtain and record your consent before setting non-essential cookies. The full list of cookies, their purpose and duration is available in the cookie settings panel.
Cookie categories used:
| Category | Examples | Consent Required |
|---|---|---|
| Strictly necessary | Session management, login, shopping cart, security, bot protection (reCAPTCHA), consent record | No |
| Functional | Language preference | Yes |
| Statistics | WooCommerce order attribution (traffic source of an order, stored on our own server) | Yes |
| Marketing | Facebook Pixel | Yes |
You can change your cookie preferences at any time via the "Cookie settings" link in the website footer.
Note on training pages: Simulation landing pages do not set statistics or marketing cookies. They use only the minimum cookies required for secure validation of the training token.
13. Automated Decision-Making
We do not make decisions about individuals based solely on automated processing that produce legal or similarly significant effects (GDPR Art. 22). The points, levels and badges shown in the client portal are calculated automatically, but they serve only as feedback to the participant and have no legal or similarly significant effect. Training outcome reports are made available to employers as factual records; human review and judgment by authorised employer personnel govern any actions taken in response.
14. Children's Data
Our Service is designed for use by business organisations and their adult employees. We do not knowingly process personal data of individuals under 16 years of age. If you believe a minor's data has been submitted, please contact us immediately at adatvedelem@kiberkontroll.hu.
15. Changes to This Policy
We may update this Privacy Policy to reflect changes in our data processing practices, legal requirements, or services. Material changes will be notified to account holders by email and/or by a prominent notice on our website at least 14 days before the effective date. The "Last updated" date at the top of this page reflects the most recent revision.
16. Contact Us
For any data protection questions, to exercise your rights, or to raise concerns:
NAMTRAC Ltd. — Kiber Kontroll
1094 Budapest, Márton street 23-25, ground floor 4., Hungary
Email: adatvedelem@kiberkontroll.hu
Website: www.kiberkontroll.hu
This Privacy Policy has been prepared in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Hungarian data protection legislation. The English and Hungarian versions have the same content.
English 
Magyar