SV

Privacy policy

Last changed 26 October 2026.

Cybono is a service from Bivaro AB, Jönköping, Sweden. This policy describes which personal data we process when your company uses Cybono and when you visit cybono.com, why, and the rights you have.

Who is responsible

Bivaro AB is the controller for processing data about users and website visitors where we determine the purposes and means of the processing. When we process personal data on your company's behalf and under its instructions, the company is the controller and Bivaro AB the processor. That processing must be governed by a data processing agreement.

The allocation of responsibility depends on what the data is used for. The same person may be subject to both Bivaro's own processing and processing on the company's behalf.

Send privacy questions and requests for access, correction or deletion through the contact form.

What we process

  • Account: name, email address, password (stored as a hash), two-factor authentication settings, role in the company, and sign-ins.
  • The company's data: company name, the domains, websites and email addresses the company chooses to monitor, and the results of the checks.
  • Breach monitoring: the email addresses the company monitors are matched against known data breaches. We store which breaches an address appears in, never passwords or other content from the breaches.
  • Microsoft 365 check: if the company's administrator connects its Microsoft 365 tenant, we store the organisation's identifier at Microsoft and the Secure Score with the recommendations Microsoft reports. We also read the tenant's security settings and whether its users have two-step verification, without names, and keep only the result. We do not read email, files or other information that is not necessary for the service.
  • Google Workspace check: if the company's administrator connects its Google Workspace, we store the organisation's identifier at Google, the security settings Google reports and the number of users with and without 2-step verification. The user list is read for the count; no names or addresses are kept. We do not read email, files or other information that is not necessary for the service.
  • Training and self-assessment: which trainings and questions each user has completed, and the results.
  • Support: what you write or tell us when asking for help.
  • Technical: IP address, browser and time in logs for operations and security; cybono.com sets no cookie and runs no analytics.

Why, and on what basis

We process data to provide the service: manage accounts, carry out checks, show risk events, deliver training and provide support. We also use data to send invitations, verifications, alerts about new risks and reminders.

When we do this as a processor, your company is responsible for having a legal basis, and we follow its documented instructions. The agreement between Bivaro and the company does not in itself provide a legal basis for processing employees' personal data. For processing where Bivaro is the controller, performance of a contract can be used as a legal basis only when you are a party to that contract and the processing is necessary to perform it.

For our own processing, we use the following legal bases:

  • To keep the service secure and trace misuse: sign-in history, logs, audit trail (legitimate interest).
  • To answer questions and handle support requests: contact details and information about the request (legitimate interest in providing support and following up on requests).
  • To send you newsletters if you have consented (consent).
  • To meet legal obligations, such as bookkeeping (legal obligation).

Who receives the data

We do not sell personal data. We use external providers to deliver the service. When a provider processes personal data on our behalf, that processing must be governed by a data processing agreement. The provider may then only process the data under documented instructions and must be subject to confidentiality and security requirements. Providers that are independent controllers are responsible for their own processing.

The following providers are used for the functions listed:

  • Hosting and storage: UpCloud (EU). The service runs on servers in Sweden.
  • Content delivery: BUNNYWAY d.o.o. (bunny.net, EU) in front of the service and the website.
  • Email: Oderland Webbhotell AB (Sweden) for outgoing system email, Proton AG (Switzerland) for support email and direct contact with us.
  • Breach monitoring: Have I Been Pwned (Superlative Enterprises Pty Ltd, Australia) receives the monitored email addresses to look them up against known breaches.
  • Microsoft 365 check: Microsoft (Microsoft Ireland Operations Ltd) when the company has connected its tenant. The data is read from the company's own Microsoft account.
  • Google Workspace check: Google (Google Ireland Ltd) when the company has connected its Google Workspace. The data is read from the company's own Google account.
  • Push notifications in the app: Apple and Google respectively, to deliver notifications to the phone.

Transferring personal data outside the EU/EEA, for example to Australia or the United States, requires a basis under the GDPR. This may be an adequacy decision or appropriate safeguards, such as the European Commission's standard contractual clauses. Contact us through the contact form for information on the safeguards applicable to a particular transfer and how to obtain a copy of them.

For how long

We do not keep personal data longer than needed for each purpose. The following retention periods apply:

  • Account and service data: data is kept while the relevant account or subscription is active. When a user account is closed, personal data associated with that account is deleted or anonymised within 13 months. When the company's subscription ends, the company's service data is deleted or anonymised within 13 months. This deadline also covers copies in backups.
  • Support requests: contact details and information about the request are kept for at most 13 months after it is closed, to answer follow-up questions and review the support provided. They are then deleted or anonymised.
  • Check history: historical results are kept for up to a year to show the trend while the company's subscription is active. On termination, the deadline for service data above applies.
  • Security logs: kept for at most 14 months.
  • Bookkeeping: data required for bookkeeping is kept in accordance with Swedish bookkeeping law, normally through the seventh year after the end of the calendar year in which the financial year ended.

Where Bivaro is a processor, the customer's documented instructions and the data processing agreement on returning or deleting data at termination also apply.

Your rights

You have the right to request access to your personal data and have inaccurate data corrected. Subject to the conditions in data protection law, you can also have data deleted or processing restricted and object to processing based on legitimate interest. You always have the right to object to direct marketing.

When processing is automated and based on your consent or a contract with you, you have the right to receive personal data you have provided in a structured, commonly used and machine-readable format and, where technically feasible, have it transferred to another controller.

You can withdraw your consent at any time, for example to newsletters, by contacting us. This does not affect the lawfulness of processing before consent was withdrawn.

For processing where your company is the controller, contact the company. For processing where Bivaro is the controller, contact us, even if you use Cybono as an employee. The contact route is listed under Who is responsible. You can always complain to the Swedish Authority for Privacy Protection.

Changes

If we change the policy in a way that affects you, we say so in the service before the change takes effect. The date at the top shows the current version.