1. Introduction
This policy is for the Novimix group, consisting of Novimix, Independent Information Security Rating Institute Ltd ("IISRI"), IISRI Global Service Centre Limited and CyberRank®. CyberRank® is a SaaS platform owned by Novimix Limited (New Zealand company no. 7377236, NZBN 9429047373495) and operated under licence by the Independent Information Security Rating Institute Ltd ("IISRI"), which contracts with end users, and IISRI Global Service Centre Limited ("IGSC"), which contracts with partners (resellers and managed security service providers). All three companies are incorporated in Auckland, New Zealand, and provide cybersecurity and privacy ratings along with third-party risk management services (the "Services"). IISRI and IGSC ("we," "our," "us") provide through CyberRank automated online services to identify cyber security and privacy risks and issue IISRI® ratings. The data controller for your personal data is IISRI if you are an end user (whether you subscribed directly or through a partner), and IGSC if you are a partner.
We are committed to safeguarding your privacy and protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and protect your personal information in compliance with the New Zealand Privacy Act 2020, the General Data Protection Regulation (GDPR), the UK General Data Protection Regulation and Data Protection Act 2018, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), the Australian Privacy Act 1988, Indonesia's Personal Data Protection Law (UU PDP), and other applicable international privacy laws.
2. Information We Collect
We collect personal data during your interactions with CyberRank, as detailed below.
2.1 Website
Cookies. Cookies are small files stored on your device. The strictly necessary cookies in the table below keep the site working and secure, and do not need your consent. We set any other cookies, such as analytics cookies, only if you accept them. You can accept or reject non-essential cookies on your first visit and change your choice at any time using the link on our site. You can also manage cookies in your browser settings.
| Site | Cookie | Set by | Purpose | Lasts | Type | Consent needed |
|---|---|---|---|---|---|---|
| cyberrank.ai | JSESSIONID | CyberRank platform | Keeps you signed in | Until the browser closes | Strictly necessary | No |
| iisri.com | PHPSESSID | IISRI website | Keeps your visit working | Until the browser closes | Strictly necessary | No |
| Any page with bot protection | __cf_bm | hCaptcha (bot protection) | Detects automated traffic to protect forms and sign-in | About 30 minutes | Strictly necessary (security) | No |
| novimix.com | terms | First party (Novimix) | Stores the user's acceptance of the website's terms | 30 days | Strictly necessary (provisional) | No |
Usage Data and Technical Data: We collect technical information about your use of our website and the CyberRank WebApp, such as pages visited, browsing history on our site, IP address, browser type, and device identifiers. Some of this information, in particular IP addresses and device identifiers, is personal data under applicable privacy laws and we treat it as such. We process this data on the basis of our legitimate interests in securing the platform, preventing fraud and abuse, and analysing and improving website performance. Technical and usage data is retained for no longer than 12 months from collection, after which it is deleted or aggregated so that it no longer identifies you, unless a longer period is required for security investigations or by applicable law.
2.2 CyberRank WebApp
Personal Information: To register and request rating reports, you must provide your first and last name, email address, and your organisation's name. Upon signing up to CyberRank, the domain associated with your email is considered the organisation you are a member of. This automated association is used solely for account management purposes. If the domain does not correctly reflect your organisation, you may contact us at legal@iisri.com to request correction.
2.3 Free Assessment Tools, Free Trial and Campaigns
When you use our free (Post-Quantum Cryptography) Assessment tool, free trial or free assessments as part of a campaign we collect the following information:
Website URL: The domain name you submit for assessment. We retain this domain name along with the resulting assessment data (for example, TLS configuration and cryptographic algorithm findings) as part of our ongoing rating and research activities. This data may be included in aggregated, anonymised statistics (for example, by sector, country, or category) as described in section 3.
Email Address: We request your email address solely to verify that you are affiliated with the organisation whose website is being assessed, by matching your email domain to the domain of the submitted website URL. Your email address is not stored as part of running the assessment. It is used only for this verification step and is not retained, unless you choose to receive a copy of the assessment report or wish to participate in promotions and competitions. If you opt to receive the report or participate in promotions and competitions, we will store your email address together with the associated assessment data for that purpose, in accordance with the retention terms in section 5.
Photographs and/or video recordings: By registering for promotional events, such as competitions and rating awards, you acknowledge and agree that photographs and/or video recordings may be taken and used for promotional and documentation purposes by the organisers.
2.4 Confidential and Sensitive Information
We do not accept classified or security-cleared information through CyberRank or in any assessment. Please do not send it to us.
For internal assessments and audits, you may give us confidential information about your organisation. We use it only for that assessment, and only named IISRI team members on the assessment can access it. All collected assessment data, including evidence, interviews and detailed findings, is encrypted in transit and at rest, and is deleted within 30 days after the assessment is complete. The only information we keep after that is the minimum needed for a legitimate business interest, to follow up in the next assessment cycle: the assessment period, scope, a summary of findings, and the assessor. We keep that minimum information for 12 months.
2.5 Eligibility
The Services are for business use by people aged 18 or over. We do not knowingly collect personal data from anyone under 18.
3. Use of Collected Information
We use your personal data to:
Legal Bases for Processing
We process your personal data on the following legal bases:
Contractual necessity: to provide the Services you have registered for, including account management and service delivery.
Legitimate interests: to improve our services, ensure platform security, and prevent fraud, and, as described in section 4, to collect and process publicly available security, privacy and breach data about organisations in order to provide the Services.
Legal obligation: to comply with applicable laws and regulatory requirements.
Consent: for marketing communications, and for non-essential cookies, where you have given explicit consent and may withdraw it at any time.
4. Disclosure of Information and Data Sharing
We do not disclose your personal information to third parties without your explicit consent, except in the following limited circumstances.
Legal Requirements: We may disclose your information when required by law, such as to comply with a court order, subpoena, or other legal process. We may also disclose information to protect our legal rights or interests.
Payment Processors: We may share your data with trusted third-party service providers (Stripe) who process data on our behalf. These service providers are contractually obligated to maintain the confidentiality and security of your data.
Service Providers: We use a limited number of third-party processors and service providers who process personal data on our behalf and only on our instructions in order to operate the Services. These fall into the following categories: cloud hosting and infrastructure providers; email and notification delivery providers; website and product analytics providers; bot protection providers (hCaptcha); and payment processing (see above). Each is bound by written data protection obligations at least equivalent to those in this Policy and may not use your data for their own purposes. A current list of these providers is available on request by contacting legal@iisri.com.
Group Companies: IISRI and IGSC are subsidiaries of Novimix Limited. We may share limited personal data (such as customer and partner contact and billing details) with Novimix Limited and with each other for group administration, forecasting, compliance, legal, sales and accounting reporting, on the basis of our legitimate interests in operating the CyberRank business as a group (GDPR Recital 48). Novimix Limited has no other access to customer personal data or to Customer Services Data, and performs no engineering or support role. Platform engineering is performed by IISRI; support is provided by IISRI to end users and by IGSC to partners. Each group company is bound by the protections in this Policy.
Vendor Services Data: As part of our core service, we collect and process publicly available security, privacy, and compliance data about organisations. This data, including security ratings and risk indicators, may be made available to other CyberRank subscribers for the purpose of third-party risk assessment. This processing is conducted under IISRI’s own legal basis as an independent data controller and is distinct from personal information submitted by users during account registration. Specifically:
Legal basis. We process Vendor Services Data on the basis of our legitimate interests (GDPR Article 6(1)(f)) in providing cybersecurity and privacy ratings and third-party risk management services, and the legitimate interests of our subscribers in assessing the security posture of the organisations they work with. We have assessed that these interests are not overridden by the rights of individuals, because the data originates from sources that are already publicly accessible, we do not create new exposure, and we apply the minimisation measures described below.
Breach and credential-leak data. Vendor Services Data may include indicators that an organisation has been the subject of a data breach or credential leak, derived exclusively from existing public breach databases and exposed sources. Where such sources contain personal data of individuals (for example an email address or username), we extract only what is necessary to attribute the finding to an organisation, and any credential or identifier we hold is truncated or masked in CyberRank so that it cannot be used to access an account or to identify an individual beyond their organisational affiliation. We do not collect, store or display passwords or other secrets in usable form.
Retention. Vendor Services Data, including historical ratings and breach indicators, forms the substance of the Services and the IISRI® rating history, and is therefore retained for as long as the Services are provided. This retention is separate from, and not subject to, the retention periods that apply to customer account data in section 5.
Your rights. If you believe that Vendor Services Data held by IISRI contains personal data relating to you, you may object to the processing or request erasure by contacting legal@iisri.com. We will consider each request on its merits and respond within the timeframes in section 7, balancing your rights against the interests described above.
Resellers: Where you access CyberRank Services through an authorised Reseller, your personal data is processed by IISRI as the data controller in the same manner as described in this Privacy Policy. Your Reseller may have access to account-level information necessary to manage your subscription and to your vendor data if you have authorised the reseller to manage CyberRank on your behalf. Your Reseller is an independent data controller in respect of the personal data it collects for its own resale, managed-security and consultancy activities. Where you authorise your Reseller to manage CyberRank on your behalf, the Reseller acts as your processor, under your instructions and your own contract with it, and not as our processor or sub-processor. We do not act as a processor for your Reseller. IISRI remains responsible for the protection of the personal data it controls regardless of whether you accessed the Services directly or through a Reseller.
5. Data Retention
We retain your personal data for the period necessary to fulfil the purposes outlined in this policy or as required by applicable laws, including the New Zealand Privacy Act 2020 and the GDPR. We retain your personal data for no longer than 90 days following termination or expiry of your account, after which it is securely deleted or anonymised, unless a longer period is required by applicable law. As an exception, billing records and data reasonably necessary to invoice, collect outstanding fees or meet tax and accounting obligations may be retained for as long as required for those purposes.
Technical and usage data is retained as described in section 2.1, and Vendor Services Data is retained as described in section 4. For free trial accounts, personal data may be deleted within 90 days of trial expiry if the user has not converted to a paid subscription. Photographs and/or video recordings obtained during promotional events of IISRI are deleted within 12 months after the event, or once the promotional or campaign purpose has been met, if earlier.
6. Data Security
We employ a range of technical and organisational security measures to protect your data against unauthorised access, alteration, disclosure, or destruction. These measures include:
Encryption
TLS 1.3 in transit, AES-256 encryption, and SHA-512 hashing.
Access Controls
Strong passwords and multi-factor authentication.
Security Audits
Regular audits and penetration testing.
Data breach notification. If a personal data breach is likely to result in a risk to your rights and freedoms, we will:
- notify the relevant supervisory authority within 72 hours of becoming aware of the breach, where the GDPR applies;
- notify the Office of the Privacy Commissioner in New Zealand as soon as practicable, where the New Zealand Privacy Act applies; and
- notify affected customers without undue delay, where required by applicable law.
We have obtained ISO/IEC 27001 certification to support ongoing improvement of our Information Security Management System (ISMS).
7. Your Rights
We comply with the GDPR and the New Zealand Privacy Act 2020, which grant you certain rights regarding your personal data.
Access
You can access your personal information in the CyberRank dashboard or request copies of your personal data that we hold.
Rectification
You can correct any inaccurate or incomplete data about you in CyberRank or ask us to do it for you.
Erasure
You can delete your personal data by closing the CyberRank account or ask us to help.
Restriction of Processing
You can ask us to temporarily or permanently stop processing all or some of your personal data while we verify the accuracy of your data or the legitimacy of our processing.
Objection
You can object to our processing of your personal data if we rely on a legitimate interest (or that of a third party) and your situation gives you grounds to object. You can also object where we process your personal data for direct marketing.
Data Portability
You can ask us to transfer your personal data to you or to a third party in a structured, commonly used, machine-readable format.
Automated decisions and profiling
You can ask for a human to review any decision that has legal or similarly significant effects on you, as described in section 3.
Complaint
You can lodge a complaint with a supervisory authority if you believe our processing of your personal data infringes on data protection laws.
Withdrawal of Consent
If our processing of your personal data is based on your consent, you have the right to withdraw that consent at any time. This will not affect the lawfulness of processing based on consent before its withdrawal.
To exercise any of these rights, email legal@iisri.com. We will reply within 20 working days under the New Zealand Privacy Act 2020, and within one month under the GDPR, whichever applies to you.
8. Policy Modifications
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make material changes, we will let you know 30 days in advance by email. We will update the effective date at the top of this page. Please review this Privacy Policy periodically to stay informed about how we are protecting your personal data.
9. Service Communications
We may send you administrative or operational communications relating to the Services, such as notices of significant changes to the CyberRank platform (for example, new features, service interruptions, deprecations, or security-related updates), and updates to our Privacy Policy or Terms and Conditions as described in section 8. These communications are necessary for the proper administration and security of your account and are not marketing communications. They do not require separate marketing consent and cannot be opted out of while you hold an active account, though you may close your account at any time if you no longer wish to receive them.
10. International Data Transfers
Your data may be transferred to countries outside New Zealand or the European Economic Area. Where we transfer personal data from the EEA, we rely on New Zealand's adequacy decision from the European Commission. For transfers to other third countries, we implement Standard Contractual Clauses (EU SCCs) or equivalent safeguards. For transfers from the United Kingdom, we use the ICO-approved International Data Transfer Agreement (IDTA) or equivalent mechanism. Our bot-protection provider, hCaptcha (operated by Intuition Machines, Inc.), processes data in the United States. Transfers rely on its EU-US Data Privacy Framework certification and Standard Contractual Clauses in its data processing agreement. Full details are set out in Addendum A and Addendum B of our End User Platform Agreement, available at CyberRank.ai.
11. Contact Us
For any questions, concerns, or requests regarding this Privacy Policy, email legal@iisri.com or use our contact form.
Data Protection Officer. IISRI and IGSC have appointed a Data Protection Officer, who may be contacted on any matter relating to this Privacy Policy or to the processing of your personal data at DPO@iisri.com, or at IISRI / IGSC / Novimix Limited, Level G, 26 Hobson Street, Auckland City 1010, New Zealand, marked for the attention of the Data Protection Officer.
Postal Address
IISRI / IGSC / Novimix Limited, Level G, 26 Hobson Street, Auckland City 1010, New Zealand