Privacy Policy

1. Who is responsible

The controller for the personal data processed on pwnd.rs is pwnd.rs, Street 1, 1234 AB City. Reach us about privacy at privacy@pwnd.rs. This policy applies to the website and the training platform; it does not cover the websites of our payment provider, which have their own policies.

We run a training platform, not an advertising business. We do not sell data, we do not profile you, and there is no analytics or tracking script on the site.

2. What we process, why, and on what legal basis

Card details are entered on Mollie’s pages and never touch our systems. We do not ask for anything we do not need: no phone number, no date of birth, no photo (the avatar is drawn from a random seed).

If you join a live session, the instructor and your team see your name, avatar, team and score on the session leaderboard. On a Teams plan the team owner sees the members’ names, emails and training progress.

3. Who we share data with

We use a small number of service providers (processors) that act only on our instructions under a data processing agreement:

Beyond that we disclose data only when the law requires it, to enforce our Terms after abuse (which may include reporting to the authorities), or to a successor if the business is transferred, under this same policy.

4. How long we keep it

• Account and training data: until you delete your account. Deletion removes your profile, progress, captures, certificates and reviews.
• Invoices and payment records: 7 years after the financial year they belong to, as tax law requires, even if you delete your account. They are kept in a minimal form (name, address, amount, invoice number).
• Lab submissions: 12 months after submission, then deleted.
• Sessions: 7 days, or until you log out or revoke them.
• Server logs: rotated within a short period, at most 30 days.
• Email: our mail provider keeps delivery logs briefly; we keep correspondence with you for as long as the matter is open.

Backups are overwritten on a rolling schedule; deleted data disappears from them within a few weeks.

5. Your rights

Under the GDPR you can:

• access your data and take it with you: download a JSON export from your account page, no request needed;
• correct your name, email, avatar and password yourself on the same page;
• erase everything by deleting your account there, subject only to the invoice records we must keep;
• object to processing we base on legitimate interest, and ask us to restrict processing while we look into it;
• complain to a supervisory authority. Ours is Autoriteit Persoonsgegevens; you may also complain to the authority of the country where you live.

For anything the account page cannot do, email privacy@pwnd.rs from your account address. We answer within one month. We do not use automated decision-making with legal effect on you.

6. Cookies

We set two cookies, both strictly necessary for the site to work, which is why there is no consent banner:

No analytics, no advertising, no third-party cookies, no fingerprinting. The payment pages run on Mollie’s domain and use their own cookies.

7. Security

• All traffic is encrypted with TLS; the database and lab network are not reachable from the internet.
• Passwords are stored as salted scrypt hashes. We never see or email your password.
• Fix-lab checks run in sandboxes; attack-lab targets are isolated, throwaway instances that are destroyed after the exercise and cannot reach your data or other users’ targets.
• Sessions are random tokens stored hashed; you can revoke any session from Security & devices.
• Access to production is limited to the people who run the platform and is logged. Backups are encrypted.

If a breach affects your data we will tell you and the authority without undue delay, as the GDPR requires. Found a vulnerability? Tell us at privacy@pwnd.rs; we will not take action against good-faith research on the platform itself.

8. Children

pwnd.rs is for people aged 16 and over. We do not knowingly collect data from anyone younger, and team owners may not seat them. If you believe a child has created an account, email privacy@pwnd.rs and we will delete it.

9. Changes to this policy

We update this policy when the Service or the law changes. The date at the top tells you which version you are reading. For changes that affect you materially, such as a new purpose or a new category of recipients, we email you before they take effect.

10. Contact

pwnd.rs, Street 1, 1234 AB City. Privacy: privacy@pwnd.rs. Everything else: hello@pwnd.rs.