Privacy Policy

CyberQuest SME ("we", "us", "our") is committed to protecting the privacy and personal data of our users. This Privacy Policy explains how we collect, use, disclose, and protect your personal data in accordance with the Singapore Personal Data Protection Act 2012 ("PDPA") and other applicable data protection laws.

We collect the following types of personal data:

• Account data: Name, email address, job title, and organisation details provided during registration.
• Usage data: Mission progress, quiz responses, training completion records, and engagement analytics.
• Content submissions: Threat scenarios and photos you submit through the "Spot a Threat" module.
• Technical data: Login timestamps, device type, and IP address for security auditing.

We use your personal data to:

• Provide and personalise the cybersecurity training platform.
• Track learning progress, award certificates, and calculate gamification metrics (XP, streaks, badges).
• Generate aggregate, anonymised analytics reports for your organisation's managers and admins.
• Send service notifications, weekly reports, and security alerts.
• Maintain audit logs for compliance and security purposes.

We do not sell your personal data. We may share data with your organisation's designated administrators and managers for the purpose of training oversight. Aggregate, de-identified statistics may be used for platform improvement. We only disclose personal data to third parties where required by law or as permitted under the PDPA.

We implement reasonable technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or loss. These include encryption in transit, access controls, and regular security reviews. Access to personal data is restricted to authorised personnel on a need-to-know basis.

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable laws. Organisation admins may request data deletion when a user leaves the organisation.

Under the PDPA, you have the right to request access to your personal data and to request corrections of any inaccurate or incomplete data. To make such a request, please contact your organisation administrator or our support team.

This Privacy Policy is aligned with the Personal Data Protection Act 2012 (No. 26 of 2012) of Singapore, administered by the Personal Data Protection Commission ("PDPC"). For more information about your rights under the PDPA, visit the PDPC website at www.pdpc.gov.sg.

We may update this Privacy Policy from time to time. We will notify users of material changes through the platform or via email. Continued use of the service after changes constitutes acceptance of the updated policy.

For any questions or concerns regarding this Privacy Policy or your personal data, please contact us through our Contact page.