LOADING PAGE
At Gambit Cyber BV, the protection of your personal data is of particular importance to us. We protect your personal data in accordance with applicable data protection laws as well as this Privacy Notice.
Updated September 2026
At Gambit Cyber BV, the protection of your personal data is of particular importance to us. We protect your personal data in accordance with applicable data protection laws as well as this Privacy Notice. We have prepared this Privacy Notice to inform you of the manner in which we collect, use, disclose, and otherwise process the information we may collect about you from
(a) your use of our Website, located at https://www.gambitcyber.org and/or our products and services,
(b) your interactions with us online and at in-person events, or
(c) any other circumstances in which we provide you with a copy of this Privacy Notice.
Personal data means any information relating to an identified or identifiable natural person (data subject); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
Recipient means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, including both processors and controllers. Legal basis means a lawful ground for data processing under the GDPR or similar laws.
We may collect information provided by you directly, including from your contacts with us, including through our webpage (such as via our web chat functions) and on social media; by your creation of a user account; and from your use or trial of our products and services. This information may include your first and last name, email address, username, password, job title, phone number, country of residence, company name, payment information, profile picture and any other
information provided by you. We may also collect information provided by you in the course of evaluating or engaging you for employment or other positions. This information may include your first and last name, email address, CV, resume, cover letter and any other information provided by you.
We may collect information using Automated Data Collection Technologies from your use of our Website and products. This information may include your IP Address, Log Files, Referrer URL, Browser Information, Device Information, and Data and Time of user request, cookies, information reflecting how you searched, browsed, and were directed to the Website, including mouse movement, click, touch, scroll, and keystroke activity, and any other information provided by your use of our Website and products, as further explained in the “Use of Cookies and Other Tracking Technologies” section below.
We may collect information from third party sources such as lead generation companies, data sellers, advertising partners, and Service Providers. This information may include your first and last name, email address, phone number, company name, job title, and country, and other information.
We may also receive and process personal data on behalf of our customers in connection with their use of our products and services. For example, we may access personal data when we troubleshoot our products and services that are already in use by our customers. When this happens, our customer acts as the controller and their privacy notice applies to the personal data, not ours. As processor, we process this personal data pursuant to our contract with our customer.
Processors, Service Providers and other companies that work with or on behalf of Gambit Cyber BV Personal data may be disclosed to processors or service providers who act on our behalf in order to process personal data in accordance with the purposes outlined above.
Please note that such processors include our web chat service provider(s). By using web chat functionality to communicate with us, you consent to our use of web chat service providers. We may also share data with entities that are controllers, such as advertising partners, data sellers, and similar companies, in accordance with the “Use of Cookies and Other Tracking Technologies” Section below and other sections of this Privacy Notice.
If, in the future, we sell or transfer, or we consider selling or transferring, some or all of our business, shares or assets to a third party, we will disclose your personal data to such third party (whether actual or potential) in connection with the foregoing events. In the event that we are acquired by, or merged with, a third party entity, or in the event of bankruptcy or a comparable event, we reserve the right to transfer, disclose or assign your personal data in connection with the foregoing events.
We may share your personal data with regulators, courts or competent authorities, to comply with applicable laws, regulations and rules (including, without limitation, federal, state or local laws), and requests of law enforcement, regulatory and other governmental agencies or if we have a good faith belief that the law requires it, such as in response to a search warrant, subpoena, or other legally valid inquiry, order, or process. We may also disclose information to assist us in collecting a debt, or as necessary to exercise our legal rights or defend claims brought against us.
We may share your personal data where you have provided your consent to us sharing or transferring your personal data (e.g., where you provide us with marketing consents or opt-in to optional additional services or functionality).
Obtain confirmation as to whether or not your personal data is being processed and access to copy of your personal data undergoing processing.
Require
(i) access to and/or duplicates of your personal data retained,
(ii) receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and
(iii) to transmit those personal data to another controller without hindrance from our side;
where technically feasible you shall have the right to have the personal data transmitted directly from us to another controller; Request rectification, removal or restriction of your personal data;
Where the data processing is based on your consent, refuse to provide and – without impact to data processing activities that have taken place before such withdrawal – withdraw your consent to processing of your personal data at any time; Take legal actions in relation to any potential breach of your rights regarding the processing of your personal data, as well as to lodge complaints before the competent data protection regulators; Not to be subject to any automated decision making, including profiling (automatic decisions based on data processing by automatic means, for the purpose of assessing several personal aspects) which produce legal effects on you or affect you with similar significance.
Further, you may be entitled to object, out of grounds relating to your particular situation, at any time to processing of personal data concerning you, including object to direct marketing and automated individual decision-making including profiling. In this case, please provide us with information about your particular situation.
After the assessment of the facts presented by you we will either stop processing your personal data or present you our compelling legitimate grounds for an ongoing processing. You can exercise your rights by submitting a request to us at the contact details outlined in this policy. Subject to legal and other permissible considerations, we will make every reasonable effort to honour your request promptly in accordance with applicable law or inform you if we require further information in order to fulfil your request.
When processing your request, we may ask you for additional information to confirm or verify your identity and for security purposes, before processing and/or honouring your request. We reserve the right to charge a fee where permitted by law, for instance if your request is manifestly unfounded or excessive. In the event that your request would adversely affect the rights and freedoms of others (for example, would impact the duty of confidentiality we owe to others) or if we are legally entitled to deal with your request in a different way than initial requested, we will address your request to the maximum extent possible, all in accordance with applicable law.
Performance of a contract.We process your personal data as necessary to perform our obligations under any contract with you, such as to provide our Website or services to you or complete transactions. Consent. We may ask for your consent to use your personal data, including if we need your consent to engage in certain marketing activities. If we obtain your consent as a legal basis for processing, you may withdraw your consent at any time.
Legitimate interests. We have a legitimate interest in using your personal data for our business purposes, including operating, improving, and marketing our business, Website and services. Compliance with a legal obligation. We may need to use your personal data to comply with applicable legal requirements.
Where applicable under the GDPR or similar laws, we have implemented appropriate cross-border transfer mechanisms when transferring your personal data to a country outside of your home jurisdiction, including, where relevant, the EU Standard Contractual Clauses and the UK International Data Transfer Agreement.
We may link to or otherwise enable you to interact with a third party Website, mobile software applications and products or services that are not owned or controlled by us (each a “Third Party Service”). We are not responsible for the privacy practices or the content of such Third Party Services. Please be aware that Third Party Services can collect personal data from you. Accordingly, we encourage you to read the terms and conditions and privacy policies of each Third Party Service.
We retain your personal data as long as reasonably necessary for the respective purpose. In determining the period in which to retain or dispose of your personal data, we consider the following criteria: the type and sensitivity of the personal data, the context and purpose of collecting the information, whether or not data is necessary to retain longer than for the purposes it was collected or otherwise processed, and the terms of any contract we have entered into with you. Gambit Cyber BV may additionally delete your personal data in response to a valid data subject request, as described below.
We maintain administrative, technical, and physical safeguards designed to protect against unauthorised access, use, modification, and disclosure of your personal data in our custody and control. No data, on the Internet or otherwise, can be guaranteed to be 100% secure. While we strive to protect your information from unauthorised access, use, or disclosure, Gambit Cyber BV cannot and does not ensure or warrant the security of your personal data.
Gambit Cyber BV does not knowingly collect or process personal data from children under the age of 13. The Website is not directed at children under the age of 13. In the event that we learn that we have collected personal data of a child under the age of 13 without parental consent, we will promptly take steps to delete that information.
If you believe that we may have collected personal data from a child under 13, please contact us using the contact details outlined in this policy. No processing for automated individual decision-making including profiling We do not knowingly collect or process personal data for automated individual decision-making including profiling. Use of Cookies and other Tracking Technologies If your browser is configured to accept cookies, we may collect your information passively using “cookies” and other tracking technologies (“Tracking Technologies”).
“Cookies” are small text files that can be placed on your computer or mobile device in order to identify your Web browser and the activities of your computer on the Gambit Cyber BV Service and other Website.
We use cookies to personalise your experience on the Gambit Cyber BV Website (such as dynamically generating content on webpages specifically designed for you), to assist you in using the Gambit Cyber BV Service (such as saving time by not having to reenter your name each time you use the Service), to allow us to statistically monitor how you are using the Service so that we can improve our offerings, and to target certain advertisements to your browser which may be of interest to you or to determine the popularity of certain content. By using cookies and page tags together, we are able to improve the Service and measure the effectiveness of our advertising and marketing campaigns.
“Page tags, ” also known as web beacons or gif tags, are a web technology used to help track Website or email usage information, such as how many times a specific page or email has been viewed. Page tags are invisible to you, and any portion of the Gambit Cyber BV Service, including advertisements, or email sent on our behalf, may contain page tags.
You do not have to accept Tracking Technologies to use Gambit Cyber BV Website or services. If you reject Tracking Technologies, certain features or resources of the Website may not work properly or at all and you may have a degraded experience. Although most browsers are initially set to accept cookies, you can change your browser settings to notify you when you receive a cookie or to reject cookies generally. To learn more about how to control privacy settings and cookie management, click the link for your browser below.
Mozilla Firefox Google Chrome Apple Safari To learn more about cookies; how to control, disable or delete them, please visit https://www.aboutcookies.org. Some third party advertising networks, like Google, allow you to opt out of or customise preferences associated with your internet browsing. For more information on how Google lets you customise these preferences, see their documentation.
Essential; Advertising; Analytics & Customisation; and Performance & Functionality. Log files We collect non-personal data through our Internet log files, which record data such as browser types, domain names, and other anonymous statistical data involving the use of the Gambit Cyber BV services. This information may be used to analyse trends, to administer the Gambit Cyber BV services, to monitor the use of the Gambit Cyber BV services, and to gather general demographic information. We may link this information to personal data for these and other purposes such as personalising your experience on the Gambit Cyber BV services and evaluating the Gambit Cyber BV services in general.
We do not currently respond or take any action with respect to web browser “do not track” signals. We do that provide consumers the ability to exercise choice regarding the collection of personally identifiable information about an individual consumer’s online activities over time and across third-party web sites or online services.
We will make our best effort to respond to a verifiable consumer request within 45 days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing. Within ten (10) days of receiving the request, we will confirm receipt and provide information about its verification and processing of the request.
We may update this Privacy Notice from time to time. If we modify our Privacy Notice, we will post the revised version here, with an updated revision date. You may visit these pages periodically to be aware of and review any such revisions.
If we make material changes to our Privacy Notice, we may also notify you by other means prior to the changes taking effect, such as by posting a notice on our Website or sending you a direct notification.
This Privacy Policy, its interpretation, and any claims and disputes related hereto, shall be governed the laws of The Netherlands. Any and all such claims and disputes shall be brought in, and you hereby consent to them being litigated in and decided exclusively by a court of competent jurisdiction located in The Netherlands. This Privacy Policy was written in English and may be translated into other languages for convenience. If a translated (non-English) version of this
Privacy Policy conflicts in any way with the English version, the provisions of the English version shall prevail.
Please feel free to contact us at any time if you have any questions or comments about this Privacy Notice. Contact the Controller for the processing of this Website at:
Gambit Cyber BV Julius Caeserlaan 26, 2314 BR Leiden, Netherlands, [email protected]
Supports modern enterprises with agentic AI discovery, real-time threat validation, and autonomous exposure prioritization.