PhishShield is designed from the ground up to be GDPR-compliant. We are committed to processing personal data lawfully, fairly, and transparently.
You are the
Your organisation determines why and how employee data is processed. You are responsible for having a lawful basis (e.g. legitimate interests or contract) for running simulations. PhishShield provides the tooling; you provide the authorisation.
We are the
We process data strictly on your documented instructions. Our Data Processing Agreement (DPA) is automatically incorporated into your contract when you subscribe to a paid plan. Request a signed copy at [email protected].
Lawfulness, fairness & transparency
We process data only where we have a lawful basis and are transparent about how we use it.
Purpose limitation
Data collected for security awareness training is used only for that purpose and nothing else.
Data minimisation
We collect only what we need. Campaign results record interactions, not personal communications.
Accuracy
We provide tools to update and correct your employee data at any time.
Storage limitation
Data is retained only as long as necessary — campaign results for 24 months, account data for 90 days post-cancellation.
Security
All data is encrypted in transit and at rest. Access is role-based and audited.
To exercise any right, email [email protected]. We will respond within 30 days. You also have the right to complain to the ICO.