loading_
Last updated: 17 September 2026
Interim notice
This policy is published in good faith and accurately reflects how we handle personal data today. It remains under review and will be amended in due course as our services and our formal registrations are finalised. Some administrative details are marked as pending completion. We will update this page, and change the date above, whenever anything material changes. If anything here is unclear or you would like the current position on a specific point, please email privacy@cognithreat.co.uk and we will answer you directly.
Cognithreat (“Cognithreat”, “we”, “us”, “our”) is the data controller for personal data processed through this website and, except where section 7 says otherwise, for personal data processed in the course of our services. We are committed to handling personal data lawfully, fairly and transparently, in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
This policy explains what we collect, why we collect it, who we share it with, how long we keep it and what rights you have. If you only want the short version: we collect as little as we can, we do not sell personal data, we do not advertise to you, and our website analytics does not use cookies or track you across other sites.
Cognithreat is a UK social enterprise providing cyber crisis simulation, tabletop exercising and cyber-resilience training. Our data protection contact is privacy@cognithreat.co.uk, and security matters can be raised via security@cognithreat.co.uk or our security.txt.
Pending completion: registered company name and number, registered office address, and ICO registration reference. These will be added to this section once finalised. In the meantime, all enquiries should be directed to the email addresses above.
We collect different data depending on how you interact with us.
We do not knowingly collect special category data (such as health, biometric, political or religious data). Please do not include such information in enquiry forms or in material you submit to our tools.
Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights and freedoms, and we have concluded that they are not. You may ask us for a summary of that assessment, and you have the right to object as described in section 11.
We set no advertising, marketing or cross-site tracking cookies. We do not operate behavioural advertising, we do not build profiles of visitors, and we do not share visitor data with advertising networks.
Analytics. We use Vercel Web Analytics to understand how the site is used in aggregate, for example which pages are visited and which sites refer traffic to us. It is cookieless: it does not set cookies, does not use a persistent identifier to follow you between visits, and does not track you across other websites. Because it does not store or access information on your device for this purpose, it does not require consent under PECR. Even so, we give you a choice: if you select “Decline” on our banner, we discard analytics events in your browser before they are ever sent to us, so your visit is not counted at all.
Browser storage. Our facilitator platform and some of our tools store information locally in your own browser (using localStorage and similar technologies) so that they can function, for example to remember your cookie preference, keep an exercise running across a page refresh, and hold your working session. This information stays on your device, is not transmitted to us for tracking purposes, and can be cleared at any time through your browser settings. Storage that is strictly necessary to deliver a service you have asked for does not require separate consent.
Essential cookies. Where a cookie is strictly necessary, for example to keep you signed in to a facilitator account or to protect against abuse, it is set on that basis and is not used for analytics or advertising.
We provide tools that let you check publicly available information about an organisation or an identifier, such as an exposure check, an email header analyser and an attack-surface snapshot. These carry specific responsibilities, so we are explicit about how they work.
Some features use third-party AI models to draft or summarise content, for example suggesting a facilitator question, drafting a debrief narrative or helping generate exercise material.
During a paid engagement we generally act as a processor on behalf of our client, who is the controller, under a written agreement that sets out the scope, duration and purpose of the processing. In that situation the client’s own privacy notice governs how participants’ data is handled, and requests from participants are directed to the client.
We do not sell personal data, and we do not share it for advertising. We share it only with service providers who process it on our instructions under a contract, and with authorities where the law requires it. Our providers fall into the following categories:
We put a data processing agreement in place with providers acting as our processors, and we assess each provider before adopting it. A current list of named sub-processors is available on request from privacy@cognithreat.co.uk, and clients receive the applicable list as part of their engagement documentation.
Some of our providers are based outside the United Kingdom, principally in the United States and the European Economic Area. Where personal data is transferred outside the UK, we rely on an appropriate safeguard recognised under the UK GDPR, such as UK adequacy regulations, the UK International Data Transfer Agreement, or the International Data Transfer Addendum to the European Commission’s standard contractual clauses, and we carry out a transfer risk assessment where one is required. You can request further information about the safeguards applying to a particular transfer by emailing privacy@cognithreat.co.uk.
Where we no longer need personal data, we delete it or irreversibly anonymise it.
Under the UK GDPR you have the right to:
To exercise any of these rights, email privacy@cognithreat.co.uk. We will respond within one month, and will tell you if we need longer because the request is complex. There is normally no charge. We may need to verify your identity before acting on a request.
If your data was processed as part of a client engagement where we act as a processor, we will forward your request to the relevant client and support them in responding.
If you are unhappy with how we have handled your personal data, please tell us first so that we have the chance to put it right. You also have the right to complain to the UK supervisory authority:
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Helpline 0303 123 1113. ico.org.uk.
As a cyber-resilience business we hold ourselves to the standard we ask of our clients. Our measures include role-based access controls and least-privilege handling, encryption of data in transit, multi-factor authentication on administrative accounts, server-side handling of all API credentials, a strict content security policy, rate limiting and input sanitisation on our services, and regular review of our own attack surface.
No system is perfectly secure. If we suffer a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of it where required, and will inform affected individuals without undue delay where the risk to them is high.
If you believe you have found a vulnerability in our systems, please report it via our security.txt. Good-faith reports are welcomed and never penalised.
Our website and services are directed at organisations and their staff, and are not intended for children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us and we will delete it.
We review this policy periodically and whenever our processing changes materially. When we make a change, we update the “last updated” date at the top of this page. Where a change significantly affects how we use your personal data, we will take reasonable steps to bring it to your attention directly. As noted in the interim notice above, this policy remains under active review and will be amended as our services and registrations develop.
Cognithreat, United Kingdom. Data protection contact: privacy@cognithreat.co.uk. Security contact: security@cognithreat.co.uk.
Pending completion: registered company name and number, registered office address, and ICO registration reference.