1. Who we are
Purple Dragon Cybersecurity B.V. ("we," "us," or "our") provides the following consulting and advisory services: cybersecurity; governance, risk and compliance; privacy and cybersecurity certification preparation; cybersecurity tooling selection, configuration and implementation; vCISO and other related services.
This Privacy Notice explains how we collect, use, disclose, and otherwise process personal data in connection with our website, products, services, communications, and business operations.
Data controller
Purple Dragon Cybersecurity B.V.
Nicolaas Beetsstraat 216, 3511 HG Utrecht
The Netherlands
We act as a controller for the personal data described in this Privacy Notice unless we state otherwise.
2. Scope of this notice
This Privacy Notice applies to personal data we process about customers and prospective customers, website visitors, business contacts, users of our services, event attendees, vendors, and other individuals who interact with us. This Privacy Notice does not apply to personal data processed by our customers through their own use of our products or services, where we act only on their instructions as a processor or service provider.
3. Personal data we collect
| Category | Example content |
|---|---|
| Contact and account information | Name, business email address, phone number, company name, job title, account identifiers, billing contact details. |
| Service and technical information | IP address, device identifiers, log data, authentication data, browser type, operating system, usage metadata, approximate location derived from IP, error and diagnostic data. |
| Communications | Information you provide when you contact us, request a demo, subscribe to updates, or communicate with support. |
| Transaction and commercial information | Subscription details, order records, contract information, invoices, and payment-related metadata. |
| Compliance and security information | Records relevant to fraud prevention, security monitoring, access control, incident detection, and legal compliance. |
The categories of personal data we collect depend on how you interact with us, the services you use, and the choices you make.
4. How we collect personal data
We collect personal data directly from you, automatically from your device or use of our services, from your employer or organization, from service providers acting on our behalf, and in some cases from publicly available sources or third-party business partners.
- Directly from forms, contracts, support requests, events, and meetings.
- Automatically through logs, analytics, cookies, and similar technologies.
- From your organization when it provisions your access.
- From vendors, resellers, integration partners, or publicly available business sources where relevant.
5. Why we process personal data and our legal basis
| Purpose | Categories | Legal basis |
|---|---|---|
| Provide and operate our services | Contact, account, technical, support data | Contract; legitimate interests |
| Secure our systems, products, and business | Log, device, account, security-event data | Legitimate interests; legal obligation |
| Communicate with customers and prospects | Name, email, company, communications history | Legitimate interests; consent where required |
| Manage contracts, billing, and vendor relationships | Contact, transaction, payment metadata | Contract; legal obligation |
| Comply with law and enforce rights | Any relevant category | Legal obligation; legitimate interests |
Where we rely on legitimate interests, we do so only where those interests are not overridden by the interests or fundamental rights and freedoms of the affected individual.
6. Cookies and similar technologies
We and our service providers may use cookies, SDKs, local storage, pixels, and similar technologies to operate our website and services, understand usage, improve performance, remember preferences, and, where permitted, support analytics and marketing.
7. Sharing of personal data
We may disclose personal data to the following categories of recipients, as necessary for the purposes described in this Privacy Notice:
- Service providers and subprocessors, including hosting, cloud, analytics, CRM, support, payment, and security vendors.
- Professional advisers such as auditors, lawyers, insurers, and accountants.
- Corporate-transaction counterparties in connection with a merger, acquisition, financing, or reorganization.
- Authorities and law enforcement where required by law or necessary to protect rights and safety.
- Your organization, where you use the services through an employer or customer account.
8. International transfers
Your personal data may be transferred to and processed in countries other than the country in which you reside. Where required, we implement appropriate safeguards for such transfers, such as the European Commission's Standard Contractual Clauses, adequacy decisions, or other lawful transfer mechanisms.
9. Retention
We determine retention periods by considering the nature of the data, the purpose of processing, operational necessity, legal requirements, contractual commitments, and risk. When personal data is no longer required, we delete, anonymize, or securely archive it as appropriate.
10. Your rights
Depending on your location and applicable law, you may have the right to request access to personal data, rectification, erasure, restriction, objection, data portability, and withdrawal of consent where processing is based on consent. You have the right to object to processing based on legitimate interests, the right to withdraw consent, and the right to lodge a complaint with an EEA supervisory authority where GDPR applies. We may need to verify your identity before fulfilling a request.
11. Security
We implement technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, and disclosure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
12. Children
Our services are intended for business use and are not directed to children.
13. Changes to this notice
We may update this Privacy Notice from time to time to reflect changes in our practices, technologies, legal requirements, or other operational factors. We will post the updated version on this page and revise the 'Last Updated' date.
14. Contact us
privacy@purpledragoncyber.com
Nicolaas Beetsstraat 216, 3511 HG Utrecht, The Netherlands
If you have questions about this Privacy Notice or our privacy practices, please contact us at the address above. If you are located in the EEA or UK, you may also have the right to lodge a complaint with the relevant supervisory authority.