Cybermate Terms of Use

The short version

• Cybermate is an online service that trains people to spot scams and use AI safely, runs practice phishing emails, checks whether work email addresses appear in known data breaches, and reports on the results.
• You can try it free for 7 days with no card. After that you choose a plan and pay, or your organisation is locked. Your information is kept for a while when it locks, so you can come back (section 3.3).
• Your organisation’s information stays yours. We use it only to provide Cybermate to you, as set out in section 12.
• Cybermate’s software, content and name stay ours.
• Either of us can end the agreement as set out in section 6.

1. Who we are, and what these terms cover

1.1 In these terms, we, us and Cybermate mean Sycurus Australia Pty Ltd, ABN 19 649 664 013, ACN 649 664 013, trading as Cybermate, whose registered address is 11/14-28 Blues Point Road, Mcmahons Point NSW 2060. You means the organisation or the individual who starts a trial or subscribes. If you accept these terms for an organisation, you confirm that you are authorised to bind it, and you means the organisation.

1.2 These terms apply to the Cybermate website, the Cybermate platform and its features (the training modules, phishing simulations, dark web monitoring, secure messages, reports, policies, support and any other feature we make available), the content in them, and any support we give you (together, the Services).

1.3 These terms are the entire agreement between us about the Services. They replace any earlier discussion, proposal or marketing material. A statement on our website, in a sales conversation or in a guide is not a term of this agreement unless it is written here.

1.4 Cybermate’s Services are built for businesses, charities, not-for-profits and other organisations, and for individuals who want to protect themselves and their work. They are for people aged 18 or over. A school programme for students is not offered under these terms and needs a separate written agreement.

1.5 Some words have a set meaning. Customer Data means the information you or your people put into the Services or that the Services produce about your organisation and your people (including names, work email addresses, roles, training results, phishing simulation results, support requests and messages). Authorised Users means the people your organisation adds, invites or lets join, and the administrators who manage them. Administrator means a person your organisation has given an administrator role. Order means the plan, number of seats and fees you choose when you subscribe.

2. How you accept these terms

2.1 You accept these terms when you tick the box to say you have read and understood them, which you do when you sign up for a free trial and again when you choose a subscription, or the first time you use the Services after we have told you about them, whichever is first. The free trial is covered by these terms (section 3) from the moment your account is created.

2.2 We record who accepted the terms for your organisation, the version of the terms, and when. If the person who accepted did not have authority to do so, they are personally responsible for that, and we may treat the acceptance as binding on the organisation if it then uses the Services.

2.3 Your Authorised Users do not each accept these terms, but you must make sure they follow the parts of these terms that apply to them (sections 9, 10 and 13), and you are responsible for what they do on the Services.

3. The free trial

3.1 A free trial lasts 7 days from the day your account is created. It needs no card. It gives access to the Services so you can decide whether to subscribe. We may limit trial features.

3.2 Each business email domain can have one trial, and each address at a free email provider can have one trial. We may refuse or end a trial that we reasonably believe is being repeated or misused.

3.3 When the trial ends, access is locked unless you have chosen a plan. While your organisation is locked we keep your information, so that you can subscribe later and carry on. We are not obliged to keep it forever, and we may delete the information of an organisation that has been locked for more than 90 days after giving 14 days’ notice by email to its Administrators.

3.4 The trial is provided as it is, with no promise about availability or fitness for a particular purpose, to the extent the law allows.

4. Your subscription, your people and your account

4.1 We provide the Services to you for the term of your subscription, for your own internal use and the use of your Authorised Users. You may not resell the Services, or let anyone outside your organisation use them, except through a managed service provider you have appointed under section 4.6.

4.2 Your Order is for a number of seats. A seat is one person your organisation has added, invited or let join. You must have a seat for every person who has an account, whether they have signed in yet or not. If you add people beyond your subscribed seats, we will charge for the extra seats under section 7.4.

4.3 You are responsible for keeping sign-in details secure, for the accuracy of the information you give us, and for everything done with your accounts. Administrators must use two-step verification, as the platform requires. Tell us as soon as you suspect an account has been misused.

4.4 We may change, add or remove features. If we remove a feature that you rely on in a way that materially reduces what you paid for, we will tell you at least 30 days before, and if you do not accept the change you may end the agreement under section 6.6.

4.5 The platform’s plans show what is included. Plans and features that are described as coming later, including any AI product that is not yet on sale, are not part of your Order until we offer them to you and you choose them.

4.6 If you let a managed service provider (MSP) manage your organisation, you authorise that provider to act for you on the Services. You remain responsible for what it does, and we may rely on its instructions as yours. We are not a party to your arrangement with it.

5. Term and renewal

5.1 Your first term starts when your subscription starts (when you choose your plan) and lasts 12 months. Every renewal term lasts 12 months.

5.2 Each renewal is for the plan and number of seats you then have, at the fees in section 7. We will email your Administrators between 60 and 30 days before each renewal date, telling you the renewal date and the fees that will apply. If we do not send that reminder, you may cancel the renewal by giving us notice up to 14 days after the renewal date and we will refund the fees for the new term in full.

5.3 You can cancel your subscription at any time. Email support@cybermate.com.au from an Administrator’s address and say that you want to cancel. Cancelling stops the subscription from renewing; you keep access until the end of the term you have paid for (section 6.5). We will confirm your cancellation by email. You may also tell us to reduce the number of seats at renewal.

5.4 We may decide not to renew by giving you at least 30 days’ notice before the end of the term.

6. Ending the agreement

6.1 The agreement ends at the end of the current term if either of us has given notice not to renew under section 5.

6.2 Either of us may end the agreement immediately by written notice if the other commits a material breach and, where the breach can be fixed, does not fix it within 30 days of written notice that describes it, or if the other becomes insolvent or is unable to pay its debts.

6.3 We may suspend access to the Services as section 7.5 describes if you do not pay, and we may end the agreement if an amount you owe is more than 30 days overdue after we have emailed you a reminder. We may also suspend access, or end the agreement, if we reasonably believe that your use puts the security of the Services, other customers or any person at risk, or breaks the law or section 9 or 13. We will tell you why, and we will restore access once the reason is fixed, unless we have ended the agreement.

6.4 We may end the agreement for our convenience by giving you at least 60 days’ written notice. If we do, we will refund the fees you paid for the period after the agreement ends, in proportion to the unused part of your term.

6.5 You may cancel at any time under section 5.3. Your cancellation takes effect at the end of the current term, and the fees for that term are not refunded because the 7-day free trial lets you assess the Services before you pay, except as section 7.7 and section 17 provide.

6.6 You may end the agreement by written notice, and receive a refund of the fees for the unused part of your term in proportion to the time left, if we materially change or remove a feature you rely on and do not offer an alternative that you reasonably accept (section 4.4), or if we make a change to these terms that you do not accept (section 18).

6.7 When the agreement ends: your access ends; amounts you owe become payable; sections that by their nature continue (including sections 7 for unpaid fees, 12 to 16, and 19 to 21) continue; and section 12.6 says what happens to your information.

7. Fees, payment and tax

7.1 The fees are those shown for your plan and number of seats when you choose your plan, in Australian dollars. They are shown without GST. We add GST, currently 10 per cent, and show it on the tax invoice. The fee is worked out from the price book we publish: the number of seats you have selects one price band, and that band’s price per person per month applies to every seat, billed as a year in advance. Prices for groups of more than 1,000 people are quoted separately.

7.2 We invoice the first year when your subscription starts, and each renewal year on or about the renewal date. Fees are payable in advance.

7.3 You can pay by card or by invoice. If you pay by card, you authorise us to charge the card you give us (through our payment provider, Stripe) for the fees as they fall due, including renewals and extra seats, and you confirm you are entitled to use that card. If a charge fails we may try again and we will tell you. If you pay by invoice, the invoice is due 14 days after we issue it, by bank transfer to the account on the invoice.

7.4 If you add people beyond your subscribed seats during a term, we will charge for the extra seats from the day they are added to the end of your term, in proportion to the days left. Reducing seats during a term does not reduce your fees until the next renewal. At renewal, your fee is based on the number of people your organisation then has.

7.5 If an amount is not paid by its due date we will email you. If it is still unpaid 7 days after its due date, access to the Services may be paused until it is paid, and section 6.3 applies. We do not charge late-payment interest. We may recover the reasonable costs of collecting an overdue amount, to the extent the law allows.

7.6 If you dispute an invoice, tell us in writing within 30 days of the invoice date, explaining the reason, and pay the part that is not in dispute. We will work with you in good faith to resolve it. A chargeback or reversal of a payment without first raising a dispute is a breach of these terms.

7.7 Fees are not refundable, except: (a) as section 5.2, 6.4 or 6.6 says; (b) where we have charged you in error; (c) where a refund is required by law, including the Australian Consumer Law; or (d) where we agree to one in writing.

7.8 We may change our prices for a renewal term by telling you at least 30 days before the renewal date (we will include the new fees in the renewal reminder). During a term, the fees in your Order do not change except for extra seats under section 7.4. If you do not accept the new fees you may stop the renewal under section 5.

7.9 Some organisations (for example registered charities, not-for-profits and schools) may be offered a discount that we have checked. A discount applies to the fees it is given for, may be reviewed when we renew, and we may withdraw it if we find the organisation did not qualify. A promotional code applies as stated on it.

8. Support

8.1 Support is by the Support page in the platform and by email to support@cybermate.com.au, which is where you can ask questions and report problems. Your Administrators may use it for questions about the organisation’s account; other Authorised Users may use it for questions about their own account.

8.2 Part of Support is an automatic answer service that gives an AI-written answer from Cybermate’s help pages and guides. When it cannot answer, or for sensitive matters such as billing, signing in, security incidents and privacy, the question goes to our team. An automatic answer is general information and is not advice (section 10).

8.3 We do not promise a response time, opening hours or a resolution time. We will respond to support requests with reasonable care and skill.

9. Phishing simulations, dark web monitoring and your responsibilities

9.1 The Services include practice phishing emails (and where we make them available, text messages) that look like scams, sent to your people to teach them to spot the real thing, and monitoring that checks whether your people’s work email addresses appear in known data breaches. These features act on your people. You are responsible for making sure that you may use them.

9.2 You confirm, and promise, that before you run any phishing simulation or breach check: (a) you have the authority to test the people involved (they are your employees, contractors or volunteers); (b) you have given them any notice, and obtained any consent, that the law of the place they work requires, including workplace surveillance, privacy and employment laws; and (c) your acceptable use policies and employment arrangements allow it. The platform asks you to record that your people have been told before simulations start, but recording it does not by itself satisfy the law, and Cybermate does not decide for you what the law requires.

9.3 You must use simulations only to train and assess your own people. You must not use them to harm, harass, deceive anyone beyond the simulation, take real credentials or money, target anyone outside your organisation, or imitate a real person, organisation or brand in a way that would mislead or defame. We may block or remove a simulation that does not meet this section.

9.4 Simulations may not reach everyone. Whether an email arrives depends on your mail systems and filters, and you are responsible for allowing our simulation messages through. Results are a guide to behaviour and are not a measure of any person’s performance or a basis for discipline on their own.

9.5 Breach monitoring checks email addresses against a third-party service of known breaches and tells your administrators what it finds. It does not stop a breach and may not find every exposure.

9.6 Reports, scores and certificates produced by the Services describe training and simulation activity in your organisation. They are not an audit, an assessment by an independent body, or advice about meeting any law or standard.

9.7 The Cybermate badge that your organisation may display shows that your subscription is current. It does not show that your organisation is secure or that anyone has checked it. You may display it only while your subscription is current, in the form we provide and without suggesting any endorsement or assurance we do not give. We may withdraw it at any time, and it stops working when your subscription ends.

9.8 Secure messages are encrypted so that we cannot read them. We cannot recover a message that is lost or has expired, we cannot scan attachments for malicious content, and you must not use secure messages to send unlawful material or malicious files.

10. AI features

10.1 Parts of the Services use artificial intelligence to write training content personalised to a person, quiz questions, reminder wording, drafts of practice emails for an Administrator to review, and automatic answers in Support. AI output can be wrong, incomplete or out of date even after our checks.

10.2 You are responsible for reviewing AI-drafted material before you send or rely on it (for example, a practice email), and for how you use what the Services produce. AI output is general information for training and is not legal, financial, security or other professional advice.

10.3 To produce AI features we send the information needed to do so (for example a person’s role, the topic, or the text of a support question) to the AI providers listed in Schedule 1. Cybermate does not use Customer Data to train its own models.

11. Availability and changes to the service

11.1 We aim to keep the Services available and work to restore them quickly when they are not, but we do not promise a particular level of availability, and the Services may be unavailable for maintenance, upgrades, the failure of services we rely on (including cloud, email and AI providers) or events outside our control. We will try to give notice of planned maintenance that we expect to cause an interruption.

11.2 We back up the platform’s data so that we can restore it after a failure, but the Services are not a place to keep the only copy of anything you need to keep. Export or copy what you need.

11.3 We may update the Services from time to time, including to fix problems, improve them and respond to the law.

12. Your information and privacy

12.1 You own your Customer Data. You give us a licence to use it, only as needed to provide the Services to you and to run, secure, improve and support the platform, and as the law requires. We do not sell Customer Data, and we do not use it to advertise to your people.

12.2 Roles. For the personal information of your people that you put into the Services, you decide why and how it is used, and we handle it for you to provide the Services. You are responsible for having a lawful reason to collect it and for telling your people what you collect and why, including that their training results, simulation results and breach-monitoring results are visible to the Administrators you choose. For the information we hold about your account and your Administrators (for billing, support and security), we are responsible for it under the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

12.3 What we collect, and who sees it. We collect the information you give us, what your people do in the Services (training attempts and results, simulation interactions, reports, secure message metadata, support requests), and information about how the Services are used for security and fraud prevention (sign-in and audit records, IP address and device information). Each person can see their own results. Their manager and Administrators see what the platform’s role rules allow, and some information (for example a person’s own support requests) is private to them. Cybermate staff can see Customer Data only where needed to provide support and keep the platform secure, and their access is recorded.

12.4 Where it is kept. The platform’s database, files and backups are held with Google Cloud in Australia. Some features send limited information to other service providers, some of which may handle it outside Australia: they are listed in Schedule 1. By using those features you agree to that disclosure, and you are responsible for telling your people about it if the law requires.

12.5 Requests from your people. If one of your people asks you for access to, or correction or deletion of, their personal information, you are responsible for responding, and we will help you with reasonable requests. If a person contacts us directly we may refer them to you. Our team’s contact for privacy questions is support@cybermate.com.au.

12.6 Ending, deletion and return. When the agreement ends, we will, on your written request made within 60 days, give you your Customer Data in a common file format (such as spreadsheets of training and simulation results) or delete it, and in either case delete it from the platform within 60 days of your request or, if you make no request, after 90 days from the end of the agreement. We may keep what we must keep by law (including invoices and payment records for 7 years), records of the agreement and its acceptance, security and audit logs, and anonymised information that no longer identifies a person. Deleted information may remain in our backups for up to 35 days and in logs for up to 7 days, and is then overwritten.

12.7 Notifiable data breaches. If we become aware of a breach of security affecting personal information we hold for you that is likely to result in serious harm, we will tell your Administrators without undue delay, and give you what we know so you can meet your own obligations under the Notifiable Data Breaches scheme. You are responsible for deciding whether to notify the people affected and the Office of the Australian Information Commissioner, and we will cooperate.

12.8 Our Privacy Policy, which is published on the Cybermate platform, describes in more detail what we collect, why, who handles it, how long we keep it, and how to ask for access, correction or deletion, or to complain. It forms part of how we handle personal information under these terms, and if it and section 12 are inconsistent, the one that gives the person more protection applies.

13. Acceptable use

13.1 You and your Authorised Users must not: (a) break the law or another person’s rights using the Services; (b) try to gain access to the Services, other customers’ information or our systems without permission, or test the security of the Services without our written agreement; (c) interfere with or overload the Services, or use automated means to access them except through features we provide; (d) copy, reverse engineer, resell or build a competing product from the Services or their content; (e) upload malicious code or unlawful, defamatory or harmful material; (f) misrepresent who you are or your authority; or (g) use the Services in a way that breaks section 9.

13.2 We may remove content, limit a feature or suspend access if we reasonably believe this section has been broken, and will tell you why where we can.

13.3 If you become aware of a security weakness in the Services, tell us at support@cybermate.com.au and give us reasonable time to fix it before you tell anyone else.

14. Security

14.1 We take reasonable steps to protect Customer Data, using the measures described in Schedule 2, and we keep them in line with the risks to the information we hold. We do not claim that any security measure is perfect, and we do not claim that an independent body has assessed our security.

14.2 You are responsible for the security of the devices, networks and accounts you use to reach the Services, for managing who is an Administrator and removing people who leave, and for acting on what the Services show you.

14.3 On reasonable written request, and no more than once a year, we will answer a security questionnaire about the Services in good faith. We do not allow customers to audit or test our systems, but we will give you reasonable information to show we meet this section.

15. Intellectual property and confidentiality

15.1 The Services, the software, the training, simulation and report templates, the AI-written content, the Cybermate name, logos and badge, and everything we create belong to us or our licensors. While you have a subscription, we give you a non-exclusive licence to use the Services and their content for your own internal training and security purposes. You may not use our name, logos or marks except as these terms allow.

15.2 Content you put into the Services (for example your logo, policies and customised templates) remains yours. You give us a licence to host and use it to provide the Services. You promise that you have the right to put it there.

15.3 If you give us suggestions or feedback, we may use them without restriction or payment.

15.4 Each of us must keep the other’s confidential information (information marked confidential or that a reasonable person would see as confidential, including our non-public pricing, security information and the contents of the Services) confidential and use it only for this agreement. This does not apply to information that is public, that the receiving party already had or developed separately, or that the law requires it to disclose (in which case it should tell the other first where it can).

15.5 We will not use your name or logo to promote the Services without your written consent, which you can withdraw.

16. Warranties, liability and indemnities

16.1 We will provide the Services with due care and skill. Each of us promises that it has the right to enter into this agreement.

16.2 Apart from what is stated in these terms and what the law guarantees, we give no warranty. We do not promise that the Services will be error-free or uninterrupted, that they will prevent a cyber incident, that your people will not fall for a scam, or that they meet your or any regulator’s requirements. Using the Services does not guarantee a result, a reduction in insurance cost, or compliance with any law, framework or standard.

16.3 Subject to section 17: (a) neither of us is liable to the other for indirect or consequential loss, loss of profit, revenue, goodwill or data, or business interruption, however caused; and (b) each party’s total liability to the other for everything arising out of this agreement in any 12 month period is limited to the fees you paid or owed for the Services in the 12 months before the event that first gave rise to the claim.

16.4 Section 16.3 does not limit: your obligation to pay fees; liability that the law does not allow to be limited; liability for fraud, wilful misconduct or personal injury; or your responsibility under section 16.6.

16.5 We will defend you against a claim by a third party that the Services, as we provide them, infringe that party’s Australian intellectual property rights, and pay damages and costs a court finally awards or that we agree, if you tell us promptly, let us control the defence and cooperate. We may modify the Services or end the affected feature, with a refund of the fees for the part of your term it affects, if that is reasonably needed to avoid the claim. This is your only remedy for infringement. It does not apply to the extent the claim is caused by content you provided, by use that breaks these terms, or by a combination we did not provide.

16.6 You are responsible for, and will indemnify us against, loss, claims and costs (including reasonable legal costs) to the extent they arise from: your breach of section 9, 12.2 or 13; your instructions or content breaking the law or someone’s rights; or a claim by one of your people or another person about a simulation, notice or consent that you were responsible for. We will tell you promptly of any claim and let you manage it, except that we may defend ourselves if you do not.

16.7 A party must take reasonable steps to reduce its loss. Neither party is liable to the other for a failure caused by an event beyond its reasonable control, including failure of a utility, cloud, internet, email, payment or AI provider that it did not cause, natural disaster, industrial action, war, terrorism or law, for as long as the event continues. A payment obligation is not excused by this clause.

17. Australian Consumer Law and your legal rights

17.1 Nothing in these terms excludes, restricts or modifies a right or remedy, or a guarantee, warranty or term, that you have under the Competition and Consumer Act 2010 (Cth), including the Australian Consumer Law, or any other law, that cannot lawfully be excluded, restricted or modified (a Non-Excludable Right).

17.2 If you acquire the Services as a consumer (for example as an individual using them for personal purposes) our goods and services come with guarantees that cannot be excluded under the Australian Consumer Law. You are entitled to a replacement or refund for a major failure, and compensation for any other reasonably foreseeable loss or damage. You are also entitled to have the Services fixed or supplied again if they fail to be of acceptable quality and the failure does not amount to a major failure.

17.3 To the extent the law allows, and where the Services are not of a kind ordinarily acquired for personal, domestic or household use, our liability for a failure to meet a guarantee under the Australian Consumer Law, other than one that cannot be limited, is limited to resupplying the Services or paying the cost of having them resupplied.

17.4 These terms are to be read so that they apply to the fullest extent permitted by law, and so that any term that would otherwise be unfair or unenforceable is read down, or severed, to the extent needed.

18. Changes to these terms

18.1 We may change these terms. We will give your Administrators and your billing contact at least 30 days’ notice by email, and show a notice in the platform, before a change that matters to you takes effect, and we will keep each version on the Terms page of the Cybermate platform so you can see what it was.

18.2 A change applies from the date in the notice. It applies to a subscription already running only from the next renewal, unless the change is needed to comply with the law, to fix an error, or is in your favour. If a change that applies during your term is materially adverse to you and you do not accept it, you may end the agreement under section 6.6 within 30 days of the notice. Otherwise, using the Services after the date in the notice means you accept the change.

19. Disputes and governing law

19.1 These terms are governed by the laws of New South Wales, Australia. Each of us submits to the non-exclusive jurisdiction of the courts of New South Wales and the courts that hear appeals from them.

19.2 If there is a dispute, the person raising it must tell the other in writing what it is about. We will then try in good faith to settle it within 30 days. If we cannot, we will try mediation by an accredited mediator we agree on (or, if we cannot agree, one nominated by the Resolution Institute), with the costs shared equally, before either of us starts court proceedings, except for urgent relief or to stop a breach of sections 13 or 15.

20. Notices

20.1 Notices to us must be in writing and emailed to support@cybermate.com.au (for payments and invoices: accounts@cybermate.au), or posted to 11/14-28 Blues Point Road, Mcmahons Point NSW 2060. Notices to you may be emailed to the Administrators and billing contact on your account, shown in the platform, or posted to the address you give us. A notice by email is taken to be received on the next business day after it is sent, unless the sender receives a message that it was not delivered.

20.2 You must keep your Administrators’ and billing contact’s email addresses up to date. A notice sent to an address you have not updated is still a valid notice.

21. General

21.1 Assignment. You may not transfer your rights or obligations under this agreement without our written consent, which we will not unreasonably withhold. We may transfer ours to a company that takes over our business or the Services, if we tell you.

21.2 Subcontractors. We may use subcontractors and the service providers in Schedule 1 to provide the Services, and are responsible for them as if they were ours.

21.3 Relationship. We are independent contractors. Nothing makes either of us the other’s agent, partner or employee. No third party has any right to enforce these terms.

21.4 Severance and waiver. If a part of these terms is unenforceable, it is read down or removed and the rest continues. A right is waived only in writing, and a delay in using a right is not a waiver.

21.5 Electronic signing and counterparts. This agreement can be accepted electronically, and our records of acceptance are evidence of it.

21.6 Compliance. Each of us must comply with the laws that apply to it in relation to the Services, including anti-bribery, sanctions and export control laws, and you must not use or let anyone use the Services from a place or for a purpose that the law of Australia prohibits.

21.7 Order of precedence. If these terms and an Order or a written agreement signed by both of us are inconsistent, the signed agreement applies to the extent of the inconsistency.

Schedule 1: Service providers that handle information

We use the service providers below to run the Services. Some may handle information outside Australia. We will update this list when it changes and tell you under section 18 if a change is significant.

Schedule 2: Security measures

These are the measures we describe as in place at the date of these terms. We may improve them and may change them, but not in a way that materially reduces the protection of Customer Data. We do not claim that an independent body has assessed our security.

• Customer information is kept apart by organisation in the database, with controls that stop one organisation’s information being read through another’s account.
• Information is encrypted in transit and at rest, with encryption keys managed through Google Cloud’s key management.
• Two-step verification is required for administrator-level accounts, and single sign-on through an identity provider can be used where we have made it available.
• Access to Customer Data by Cybermate staff is limited to what their role needs and is recorded in an audit log, including when staff act as a user to help with a problem.
• Sign-ins and changes to the platform and to organisations’ settings are written to an audit log.
• The platform is hosted with Google Cloud in Australia, with backups of the database kept for up to 35 days.
• Card details are handled only by our payment provider. Cybermate does not receive or store card numbers.
• We keep a record of security incidents and follow a documented process to assess them and to notify as section 12.7 describes.

Schedule 3: Retention and deletion at a glance