Skip to content
Hackiwi
Get started

Legal - GDPR Articles 13 & 14

Privacy Policy

Last updated: September 2026

This notice explains what personal data Hackiwi B.V. processes, why, on what lawful basis, who else it reaches, how long we keep it, and how you exercise your rights. It is written to be read, not to be survived.

Who we are

Clause 1.1. Hackiwi is a security awareness platform operated by Hackiwi B.V., a company established in the Netherlands ("Hackiwi", "we", "us", "our").
Clause 1.2. This privacy notice explains what personal data we process, why we process it, the lawful basis on which we rely, who else receives it, how long we keep it, and the rights available to you under the General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR").
Clause 1.3. For all privacy matters, including the exercise of the rights described in section 11, contact [email protected].
Clause 1.4. We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 GDPR. Privacy correspondence is handled by the address above.
Clause 1.5. The identity and contact details of the controller, for the purposes of Article 13(1)(a) GDPR, are:
Legal entity
Hackiwi B.V.

Our role: controller and processor

Hackiwi acts in two distinct capacities, and which one applies determines who you should approach about your data.

Clause 2.1. As a processor. When an organisation subscribes to Hackiwi and enrols its employees or contractors, that organisation is the controller of their personal data and decides what is collected and why. Hackiwi processes that data on its documented instructions under the Data Processing Agreement. This covers the majority of the data on the platform: training records, phishing simulation results, exposure findings and audit logs.
Clause 2.2. As a controller. We are the controller for the limited data we determine the purposes of ourselves - the security, fraud-prevention and service-integrity data described in section 4, our own business correspondence, and visits to our public website.
Clause 2.3. If you are an employee of an organisation that uses Hackiwi and you wish to exercise a data subject right, address your request to your employer in the first instance. Where we receive such a request directly, we forward it to the relevant controller in accordance with clause 9 of the Data Processing Agreement, and we will tell you that we have done so.

What personal data we collect and why

The table below sets out each category of personal data we process, the purpose it serves, and the lawful basis under Article 6(1) GDPR on which we rely.

Categories of personal data, purposes and lawful bases
DataPurposeLawful basis
Name, email, rolePlatform accessContract (Art. 6(1)(b))
Training records, quiz answers, progressDeliver trainingContract (Art. 6(1)(b))
Phishing simulation results (clicked / reported)Security awareness trainingLegitimate interests (Art. 6(1)(f))
Breach intelligence (HIBP checks)Security monitoringLegitimate interests (Art. 6(1)(f))
Audit logs (admin actions, timestamps)Security and complianceLegitimate interests (Art. 6(1)(f))
IP addresses, session tokens, user agentsSecurity and fraud preventionLegitimate interests (Art. 6(1)(f))

Where we rely on legitimate interests

Where the lawful basis is Article 6(1)(f), the interests we pursue are the security of our customers' organisations, the integrity and availability of the platform, and the prevention of fraud and abuse. We have assessed those interests against the rights and freedoms of the individuals concerned and concluded that the processing is necessary and proportionate, in particular because the data is minimal, is not used for advertising or profiling, is not sold or shared for any third party's own purposes, and is retained for no longer than the periods in section 8. You may object to processing based on legitimate interests at any time under Article 21 GDPR - see section 11.

Providing your data

Name, email address and role are necessary to give you access to the platform: without them an account cannot be created and the service cannot be provided. The remaining categories are generated by your use of the service rather than supplied by you.

Special categories of data

Hackiwi does not ask for, and the platform is not designed to hold, special categories of personal data within the meaning of Article 9 GDPR, nor personal data relating to criminal convictions and offences under Article 10.

Phishing simulation and breach intelligence

Two features of the platform deserve to be described in their own right, because they process data about identifiable people in ways that are easy to misunderstand.

Phishing simulation

note
Phishing simulation results are used for aggregate security awareness purposes only, and not for individual performance management.
Clause 4.1. When a customer runs a simulated phishing campaign, the platform records, per recipient, that an event occurred and when: that a message was sent, opened, clicked, reported, or that a form was submitted.
Clause 4.2. Where a simulated message contains a credential entry form, the platform records the fact that a submission occurred and nothing else. Submitted credentials are never stored, never logged and never transmitted to the customer.
Clause 4.3. Simulations may only be sent to a customer's own personnel, from domains that customer has verified it owns. Those limits are contractual as well as technical, and they are set out in the Acceptable Use Policy.
Clause 4.4. Customers are responsible for ensuring that their use of simulations complies with applicable employment law and any works council agreements that bind them. See section 6 of the Acceptable Use Policy.

Breach intelligence

note
Individual employee email addresses are checked against known breach databases. This data is handled with appropriate care.
Clause 4.5. Breach and exposure checks tell an organisation that an address belonging to it has appeared in a publicly known third-party data breach. The finding concerns an incident at another company; it is not an assessment of the individual, and it does not give us or the customer the breached passwords.
Clause 4.6. Breach lookups are performed against Have I Been Pwned, and only where the customer has connected its own API key for that service. Where no key is connected, no address leaves the platform for this purpose. See section 6 for what this means for the relationship between the customer and that provider.
Clause 4.7. Findings are visible to the administrators of the organisation the address belongs to, and to the individual concerned in their own view of the platform.

Where the data comes from

Most personal data reaches us from you or from your employer. Article 14 GDPR requires us to tell you when it comes from elsewhere.

  • From you - the details you enter when you activate an account, complete training, answer a quiz, or report a suspicious message.
  • From your organisation - the name, email address, job title, department and role an administrator supplies when enrolling you, or that arrives through your employer's single sign-on provider.
  • Generated by your use of the platform - progress records, simulation events, session data, IP addresses and audit log entries.
  • From publicly available and third-party sources - breach exposure data from Have I Been Pwned, and open-source intelligence drawn from public certificate transparency logs, public domain registration records and public DNS. These are consulted only in relation to domains a customer has verified it owns and addresses at those domains.

Who we share personal data with

We do not sell personal data, and we do not share it for any third party's own marketing purposes. Personal data is disclosed only as described below.

Sub-processors

The following companies process personal data on our behalf, under written contracts that impose the obligations required by Article 28(4) GDPR. The current list is also published, on its own, at hackiwi.com/subprocessors.

Hackiwi sub-processors
Sub-processorCountryPurposeTransfer mechanism
Cloudflare, Inc.USA (EU Standard Contractual Clauses)Infrastructure, database, CDN, WAFStandard Contractual Clauses
Resend, Inc.USA (EU Standard Contractual Clauses)Transactional emailStandard Contractual Clauses
Functional Software, Inc. (Sentry)USA (EU Standard Contractual Clauses)Error trackingStandard Contractual Clauses

Customer-controlled integrations

The services below are not Hackiwi sub-processors. They receive data only where a customer chooses to connect its own API key, which establishes a direct relationship between that customer and that provider on that provider's terms. Where no key is connected, no data is sent.

Customer-controlled integrations
ProviderPurposeWhat is sent
Anthropic PBCAI-assisted content generationThe prompts an administrator writes
Have I Been PwnedBreach-exposure lookupsThe domain or email address being checked
VirusTotal (Google)URL and file reputation lookupsThe web addresses being checked

Other disclosures

  • To your organisation. If you use Hackiwi through an employer, its administrators can see your training records, your simulation outcomes and exposure findings relating to your work address.
  • To professional advisers. Our lawyers, accountants and auditors, where they are bound by a duty of confidentiality.
  • Where the law requires it. To a competent authority where we are legally obliged to disclose, or where disclosure is necessary to establish, exercise or defend legal claims. We will notify the affected customer unless legally prohibited from doing so.
  • On a corporate transaction. To a purchaser or successor in the event of a merger, acquisition or reorganisation, subject to this notice continuing to apply.

International transfers

Clause 7.1. All international transfers of personal data are covered by the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), together with the supplementary technical measures described in section 9 - principally encryption in transit and at rest.
Clause 7.2. Each of the sub-processors listed in section 6 is established in the United States. Personal data may therefore be processed outside the European Economic Area.
Clause 7.3. Cloudflare EU data localisation is available on request. Customers with a data residency requirement should contact [email protected] before onboarding.
Clause 7.4. A copy of the transfer mechanism relied upon for a given sub-processor is available to customers on request to [email protected].

How long we keep personal data

Retention periods
DataRetention period
Active dataRetained for the lifetime of the organisation account
After account deletionPermanently deleted within 30 days
BackupsUp to 30 days after deletion from live systems
Clause 8.1. When an organisation account is deleted, access is revoked immediately: every session belonging to that organisation is invalidated at once, and the platform refuses the account from that moment. Permanent erasure of the underlying records follows within 30 days, and copies in encrypted backups age out within a further 30 days.
Clause 8.2. Audit log entries are deliberately durable. Removing a member from an organisation does not delete the record of the administrative actions they performed. The audit log records the actor's email address as plain text with no link to the user record, precisely so that a person leaving an organisation cannot erase the record of what they did while they were there. This is a security control required by Article 32 GDPR, and we rely on Article 17(3)(b) and (e) in retaining it. It is disclosed here because a customer's own erasure process needs to account for it.
Clause 8.3. Where a longer period is required by law - for example, statutory retention of accounting records - we retain the minimum data necessary for that purpose and no more.

How we protect personal data

We implement appropriate technical and organisational measures under Article 32 GDPR. These are described in full in Annex II of the Data Processing Agreement and include:

  • encryption of data at rest and in transit (TLS 1.2 or higher);
  • encrypted storage of all credentials and third-party API keys;
  • role-based access control, with every query scoped to a single organisation so that one customer's data cannot be read by another;
  • audit logging of administrative and security-relevant actions;
  • automatic session expiry and explicit session revocation;
  • a hardened public surface: strict transport security, a restrictive content security policy, and rate limiting on authentication endpoints.

To report a vulnerability, write to [email protected].

Automated decision-making and profiling

Clause 10.1. We do not carry out automated decision-making that produces legal effects concerning you or that similarly significantly affects you within the meaning of Article 22 GDPR.
Clause 10.2. The platform computes risk indicators and training progress from your activity, and presents them to your organisation's administrators. These are informational: no decision about you is taken by the platform itself, and any action a customer takes on the basis of them is that customer's decision as controller.

Your rights under the GDPR

Subject to the conditions in the GDPR, you have the following rights.

Data subject rights
RightWhat it means
Access (Art. 15)Obtain confirmation of whether we process your data, and a copy of it.
Rectification (Art. 16)Have inaccurate data corrected and incomplete data completed.
Erasure (Art. 17)Have your data deleted where one of the grounds in Article 17(1) applies.
Restriction (Art. 18)Have processing limited while a dispute about accuracy or lawfulness is resolved.
Portability (Art. 20)Receive data you provided in a structured, commonly used, machine-readable format.
Objection (Art. 21)Object to processing based on legitimate interests, on grounds relating to your situation.

How to exercise them

  • Erasure requests may be submitted in the platform at Settings → Data → Right to erasure, or by email to [email protected].
  • All other requests may be sent to [email protected].
  • If your data is on the platform because of your employer, we will normally forward your request to them as controller, and tell you that we have done so.

We respond to requests within one month of receipt, as required by Article 12(3) GDPR. That period may be extended by up to two further months where a request is complex, in which case we will tell you within the first month and explain why. Exercising these rights is free of charge, except where a request is manifestly unfounded or excessive.

Complaints

You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or the place of the alleged infringement. Our lead supervisory authority is the Autoriteit Persoonsgegevens (the Dutch Data Protection Authority): autoriteitpersoonsgegevens.nl. We would appreciate the chance to address your concern first.

Cookies and similar technologies

Hackiwi sets a strictly necessary session cookie and stores a theme preference in your browser. We use no analytics cookies, no advertising cookies and no third-party tracking. The full detail, including the cookies Cloudflare sets for security purposes, is in the Cookie Policy.

Children

Hackiwi is a workplace product intended for use by adults. It is not directed at children, and we do not knowingly collect personal data from children. If you believe a child's data has been provided to us, write to [email protected] and we will delete it.

Changes to this notice

Clause 14.1. We may update this notice to reflect changes to the platform, to our sub-processors, or to the law. The date at the top of this page always shows when it was last revised.
Clause 14.2. Where a change materially affects how we process personal data, we will give customers at least 30 days' notice before it takes effect, by email to the administrative contact on the account and by notice in the platform. Keep your administrative contact current in Settings so that you receive it.

Contact

For any question about this notice or about how we handle personal data:

Hackiwi B.V. is established in the Netherlands. Its registration details are:

Legal entity
Hackiwi B.V.

This document was prepared in good faith. Hackiwi recommends that customers seek independent legal advice regarding their own compliance obligations.