AstralGuard ("we", "us", "our") is committed to your privacy. This GDPR Compliance Policy explains how we collect, use, store, and protect personal data when you use our website, platform, and services. It applies to all individuals whose data we process, including website visitors, clients, and business contacts. If you are located in the European Economic Area (EEA) or the United Kingdom, you have specific rights under the GDPR that we are fully committed to honouring.
Who We Are (Data Controller)
AstralGuard is the Data Controller responsible for your personal data. As a cybersecurity company operating across Africa, we process personal data to deliver our security services, operate our platform, and communicate with our clients and prospects.
Company: AstralGuard
Address: Security Center, Kampala, Uganda
Email: support@astralguard.online
Phone: +256 020 780 6355
Website: astralguard.online
Where AstralGuard processes personal data on behalf of a client (e.g. during a penetration test or SOC engagement), we act as a Data Processor under the client's instructions, and a separate Data Processing Agreement (DPA) governs that relationship.
Personal Data We Collect
We only collect personal data that is necessary for the purposes described in this policy. The categories of data we may collect include:
2.1 Data You Provide Directly
- Identity data: first name, last name, job title, company name.
- Contact data: email address, phone number, postal address.
- Account data: username, password (hashed), account preferences.
- Communications data: messages you send us via contact forms, email, or support tickets.
- Newsletter data: email address when you subscribe to our security updates.
- Payment data: billing address, payment method details (processed securely by third-party payment processors — we do not store card numbers).
2.2 Data Collected Automatically
- Technical data: IP address, browser type and version, operating system, device type.
- Usage data: pages visited, links clicked, time spent on pages, referral sources.
- Cookie data: session identifiers and analytics cookies (see Section 9).
2.3 Data From Third Parties
- Business contact data from publicly available sources for B2B outreach.
- Analytics data from Google Analytics (anonymised where consent is withheld).
- Review data from Trustpilot when you leave a public review.
We do not collect or process special categories of personal data (health data, biometric data, racial or ethnic origin, political opinions, etc.) unless explicitly required and with your explicit consent.
Legal Basis for Processing
Under GDPR Article 6, we must have a lawful basis for every processing activity. The table below outlines the bases we rely on:
| Processing Activity | Legal Basis | Details |
|---|---|---|
| Account registration & login | Contract | Necessary to perform our service agreement with you. |
| Delivering security services | Contract | Core service delivery under your subscription or engagement. |
| Sending service-related communications | Contract | Transactional emails, incident alerts, account notifications. |
| Newsletter & security updates | Consent | Only sent when you explicitly subscribe. Opt-out anytime. |
| Analytics & website improvement | Legitimate Interest | Understanding how our site is used to improve it. IP anonymised. |
| B2B marketing outreach | Legitimate Interest | Contacting relevant business professionals about our services. |
| Legal obligations & compliance | Legal Obligation | Record-keeping, tax, regulatory reporting requirements. |
| Fraud prevention & security | Legitimate Interest | Protecting our platform and clients from malicious activity. |
How We Use Your Data
We use the personal data we collect for the following purposes:
- To create and manage your AstralGuard account and client portal access.
- To deliver contracted cybersecurity services including penetration testing, SOC monitoring, threat intelligence, and training.
- To send you security alerts, incident reports, and platform notifications relevant to your engagement.
- To process payments and manage billing securely via our payment processors.
- To send you our newsletter and security update emails (only with your consent).
- To respond to your enquiries, support requests, and complaints.
- To improve our website, platform, and service offerings using aggregated analytics.
- To comply with legal and regulatory obligations applicable to our operations.
- To prevent fraud, abuse, and security threats on our platform.
- To conduct internal research, reporting, and business development.
We will never sell, rent, or trade your personal data to third parties for their own marketing purposes. We do not engage in profiling or automated decision-making that produces significant legal effects on individuals.
Data Sharing & Third Parties
We may share your personal data with carefully selected third parties only where necessary. All third-party processors are bound by Data Processing Agreements that require GDPR-equivalent protections.
| Third Party Category | Purpose | Safeguards |
|---|---|---|
| Cloud Infrastructure Providers (AWS, Google Cloud, Azure) | Hosting our platform and client data securely. | Standard Contractual Clauses (SCCs), SOC 2 certified. |
| Payment Processors | Secure payment processing and billing. | PCI-DSS compliant, DPA in place. |
| Google Analytics | Website traffic analysis (anonymised). | IP anonymisation enabled; consent-gated. |
| Email Service Providers | Sending transactional and marketing emails. | DPA in place, EU servers where possible. |
| Trustpilot | Collecting and displaying client reviews. | Independent data controller for review data. |
| Legal & Regulatory Authorities | Compliance with lawful requests or orders. | Disclosed only when legally required. |
We require all third parties to implement appropriate technical and organisational measures to protect your data. We do not allow them to use your data for their own purposes beyond those we have specified.
International Data Transfers
AstralGuard operates primarily from Uganda and may transfer personal data to countries outside the EEA in the course of providing services or using third-party tools. When such transfers occur, we ensure adequate safeguards are in place, including:
- Standard Contractual Clauses (SCCs) — the European Commission-approved contractual terms that require the recipient to provide GDPR-equivalent protections.
- Adequacy Decisions — transferring to countries that the European Commission has deemed to offer adequate data protection.
- Binding Corporate Rules — where applicable within corporate group transfers.
- Your explicit consent — in limited cases where other mechanisms do not apply and you have been fully informed.
You may request details of the specific safeguards applied to any transfer by contacting us at support@astralguard.online.
Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements.
| Data Category | Retention Period | Reason |
|---|---|---|
| Client account data | Duration of contract + 3 years | Contract performance & dispute resolution. |
| Security engagement records | 5 years post-engagement | Legal liability, compliance audit trails. |
| Financial & billing records | 7 years | Statutory tax and accounting obligations. |
| Newsletter subscribers | Until unsubscribe + 6 months | Consent-based; deleted promptly on opt-out. |
| Website analytics data | 26 months (Google Analytics default) | Trend analysis (anonymised). |
| Support & contact records | 3 years from last contact | Service continuity & dispute resolution. |
| Security logs | 12 months | Threat investigation & platform security. |
When data is no longer needed, we securely delete or anonymise it in accordance with industry best practices, including cryptographic erasure for cloud-stored data.
Your Rights Under GDPR
If you are located in the EEA, UK, or a jurisdiction with equivalent data protection laws, you have the following rights regarding your personal data. We will respond to all verified requests within 30 days.
Right of Access
You have the right to request a copy of all personal data we hold about you, along with information about how we process it.
Right to Rectification
You can ask us to correct inaccurate or incomplete personal data we hold about you at any time.
Right to Erasure
You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected.
Right to Restriction
You can request that we restrict processing of your data in certain circumstances, such as while a dispute is being resolved.
Right to Portability
You have the right to receive your personal data in a structured, machine-readable format and to transfer it to another controller.
Right to Object
You can object to processing based on legitimate interests or direct marketing at any time, and we will cease unless we have compelling grounds.
Right to Withdraw Consent
Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
Rights re: Automated Decisions
You have the right not to be subject to solely automated decisions that produce significant legal or similar effects on you.
To exercise any of these rights, contact us at support@astralguard.online with your request. We may need to verify your identity before processing it. There is no fee for standard requests, though we may charge a reasonable fee for manifestly excessive or repetitive requests.
Cookies & Tracking Technologies
We use cookies and similar tracking technologies on our website. Our cookie use is governed by our consent management platform (Consentmanager), which requests your consent before placing non-essential cookies.
| Cookie Type | Purpose | Basis |
|---|---|---|
| Strictly Necessary | Session management, security, authentication. Required for the site to function. | Legitimate Interest |
| Analytics | Google Analytics — understanding page visits and traffic sources (IP anonymised). | Consent |
| Functional | Remembering your preferences, language settings, and personalisation. | Consent |
| Marketing | Tracking interactions to deliver relevant advertising (currently not active). | Consent |
You can manage or withdraw your cookie consent at any time by clicking the cookie settings link in our footer, or by adjusting your browser settings. For full details, see our Cookie Policy.
Security Measures
As a cybersecurity company, we apply rigorous technical and organisational measures to protect personal data against unauthorised access, loss, destruction, or disclosure. These include:
- Encryption in transit: All data transmitted to and from our platform uses TLS 1.3 encryption.
- Encryption at rest: Sensitive data is encrypted at rest using AES-256.
- Access controls: Role-based access control (RBAC) with principle of least privilege enforced across all systems.
- Multi-factor authentication: MFA is mandatory for all staff accessing systems that process personal data.
- Regular penetration testing: Our own systems are subject to independent security assessments and internal red team exercises.
- Security monitoring: 24/7 SOC monitoring covers our own infrastructure for anomalous activity.
- Incident response: A documented incident response plan ensures we can detect, contain, and notify within GDPR's 72-hour window.
- Staff training: All staff undergo regular data protection and security awareness training.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay, as required by GDPR Article 33 and 34.
Children's Data
Our services are designed for and directed at organisations and business professionals. We do not knowingly collect or process personal data of individuals under the age of 18. Our platform, client portal, and CTF arena require users to confirm they are of legal age.
If we become aware that we have inadvertently collected personal data from a minor, we will delete it promptly. If you believe we have collected data from a child under 18, please contact us immediately at support@astralguard.online.
Changes to This Policy
We may update this GDPR Compliance Policy from time to time to reflect changes in our practices, services, or applicable law. When we make material changes, we will:
- Update the "Last Updated" date at the top of this page.
- Notify registered users via email where the changes are significant.
- Where required, seek fresh consent if the new processing purpose requires it.
We encourage you to review this policy periodically. Your continued use of our services after changes are posted constitutes your acknowledgement of the updated policy.
Contact Us & Supervisory Authority
If you have any questions, concerns, or requests regarding this policy or how we handle your personal data, please reach out to us directly. We aim to resolve all queries promptly and transparently.
Data Protection Contact
Reach our data protection team through any of the following channels. We respond to all GDPR-related requests within 30 days.