MyCyberWay provides cyber security training, Microsoft certification training and career services. This policy explains how we collect and use personal data when you visit our website, contact us or learn with us, and the rights you have.
Last updated 17 October 2026.
The short version
- We collect only what we need to deliver our training and services and to run our business.
- We never sell your personal data or share it for anyone else’s marketing.
- We use carefully selected service providers, who are bound by contract to protect your data.
- Live classes are recorded so that learners on the course can review them.
- You have rights over your data, and you can contact us about them at any time.
- Who we are
- What we collect
- How we use it
- Class recordings
- Sharing
- Outside the UK
- How long we keep it
- Your rights
- Deleting your data
- Complaints
- Cookies
- Security
- Changes
1. Who we are
MyCyberWay Limited is the controller of your personal data. We are registered in Scotland (company number SC872069), our registered office is 29 Bellerophon Drive, Penicuik, EH26 8NU, and we are registered with the Information Commissioner’s Office (ZC145856).
For any question about this policy or your data, email hello@mycyberway.co.uk with “Data protection” in the subject line, or write to our registered office.
Our courses and services are for adults, and we do not knowingly collect personal data from children.
2. The information we collect
Depending on how you deal with us, we may collect:
- Identity and contact details – your name, email address, phone number and billing address.
- Account and order details – your account login, the courses and services you buy, and payment confirmations. Card payments are handled by our payment providers; we never see or store your full card details.
- Sign-in details from Google, Facebook or LinkedIn – if you choose to sign in with one of them, the name and email address it holds for you and a reference number for your account there. We never receive your password for that account, we do not keep your profile photo, and we never post anything on your behalf.
- Learning records – your enrolment agreement, attendance, submitted work, assessment results, feedback and the credentials you earn.
- Class recordings – your voice, display name, chat messages and, if your camera is on, your image (section 4).
- Career information – your CV, professional profile, career goals and interview feedback, when you use our career services.
- Communications and preferences – the messages you send us, any testimonial you give us, and your marketing choices.
- Adjustment information – details of a disability or health condition, only if you choose to tell us so that we can support you. This is special category data, and we give it extra protection.
- Technical information – your IP address, browser type and the pages you request, recorded in our website’s security logs.
Most of this comes from you. We also receive information from your employer if they book training for you (your name, work contact details and the training booked), from our payment providers (whether a payment succeeded), and from Google, Meta (Facebook) or LinkedIn if you choose to sign in with them.
3. How we use your information, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Providing the courses and services you buy – your account, scheduling, classes, materials, assessments, credentials and career services | Contract |
| Creating your account and signing you in, including with Google, Facebook or LinkedIn if you choose to | Contract; steps you ask us to take before a contract |
| Taking payments, invoicing and keeping financial records | Contract; legal obligation |
| Responding to your enquiries | Legitimate interests; steps you ask us to take before a contract |
| Recording live classes for the learners on that course | Legitimate interests |
| Reporting attendance and completion to an employer who paid for your training | Legitimate interests |
| Sending our newsletter | Consent |
| Telling existing customers about similar courses and services | Legitimate interests – you can opt out at any time |
| Supporting adjustments for a disability or health condition | Explicit consent |
| Publishing testimonials | Consent |
| Keeping our systems secure, preventing fraud, and handling complaints and legal claims | Legitimate interests; legal obligation |
| Improving our courses and services | Legitimate interests |
Where we rely on legitimate interests, we have balanced them against your rights, and you can object (section 8). Where we rely on consent, you can withdraw it at any time. We do not make decisions about you based solely on automated processing.
Some information is needed to provide our services – for example, we cannot enrol you or issue a credential without your name and contact details.
4. Class recordings
Live classes are recorded so that learners can catch up on or review a class. Recordings are available only to the learners on that course and our tutors, and are deleted after a limited period (section 7). If you have any concerns about being recorded, speak to your tutor. Please do not make or share your own recordings, as they include other learners.
5. Who we share your information with
We share personal data only where it is needed, with:
- Service providers who support our business – such as IT and cloud services, email and video conferencing, website hosting, payment processing, invoicing and accounting, newsletter delivery and digital credentials. They act on our instructions and must keep your data secure and confidential. Payment providers also use payment information for their own fraud-prevention and legal duties.
- Anyone verifying your credential – each digital credential has a verification page, showing your name, the credential and its date, that anyone with the link can view.
- Your employer, if they paid for your training (section 3).
- Employers or recruiters, only if you ask us to introduce you.
- Google, Meta (Facebook) or LinkedIn, only if you sign in with them – that service knows you used it to sign in to our website, under its own privacy policy.
- Professional advisers, such as accountants, lawyers and insurers.
- Public authorities, such as HMRC, the police or the courts, where the law requires it.
- A buyer or successor of our business, if it is ever sold or reorganised, under the same protections.
If you contact us through, or join a community on, a third-party platform such as a messaging app or social network, that platform handles your data under its own privacy policy, and other members may see your profile.
6. Transfers outside the UK
Some of our service providers process data outside the UK. When they do, your data is protected by UK adequacy regulations or by safeguards approved under UK law, such as the International Data Transfer Agreement or the UK Addendum. Contact us if you would like more information.
7. How long we keep your information
We keep personal data only for as long as we need it for the purposes in this policy, then delete it or make it anonymous.
| Information | How long we keep it |
|---|---|
| Orders, invoices and financial records | As long as tax and company law requires – normally six years |
| Enrolment agreements and learning records | Normally six years after your course ends, so that we can confirm your training and deal with any questions or claims |
| Credentials | For as long as the credential is valid, so that it can be verified |
| Class recordings | Normally six months after the course’s final class |
| Career services material | Up to 12 months after we deliver the service |
| Your account | While it is active; we remove accounts that have been inactive for two years |
| The link between your account and Google, Facebook or LinkedIn | Until you remove it in your account, or your account is deleted |
| Enquiries | Up to 12 months after our last contact |
| Marketing | Until you unsubscribe; we keep a record of opt-outs so that we can respect them |
| Adjustment information | Until your course ends |
If information is needed for a complaint or legal claim, we keep it until that is resolved.
8. Your rights
You have the right to access, correct or erase your personal data; to restrict or object to how we use it; to data portability; and to withdraw your consent at any time. You can always object to direct marketing.
To use your rights, email hello@mycyberway.co.uk with “Data protection request” in the subject line. We may need to confirm your identity. We respond within one month, or within three months for complex requests, and there is normally no charge. Some rights have legal limits – for example, we must keep financial records for as long as the law requires – and we will explain if one applies.
Deleting your account and your data
To delete your account and the personal data we hold about you – including what we received when you signed in with Google, Facebook or LinkedIn – email hello@mycyberway.co.uk from the address on your account, with “Delete my account” in the subject line. We delete your account and its sign-in links and confirm it within one month. Anything the law makes us keep, such as invoices, we keep only for as long as it requires (section 7).
You can also stop Google, Facebook or LinkedIn sharing anything more with us by removing MyCyberWay from the apps connected to your account there: Google, Facebook or LinkedIn.
9. Complaints
If you are unhappy with how we have handled your data, please contact us first at hello@mycyberway.co.uk with “Data protection complaint” in the subject line. We acknowledge complaints within 30 days and tell you the outcome.
You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
10. Cookies
Our website uses only the cookies it needs to work, plus one that remembers your answer to our newsletter invitation. We do not use analytics, advertising or tracking cookies. Our Cookie Policy explains more.
11. Security
We use appropriate technical and organisational measures to protect your data, including encryption in transit and access limited to those who need it, and we require the same of our service providers. If a breach is likely to put your rights at high risk, we will tell you without undue delay.
12. Changes to this policy
We may update this policy from time to time. The date at the top shows the latest version, and we will tell you directly about any significant change.
