Privacy Policy — weakestlink
Last updated: 29 September 2026
This policy describes how weakestlink processes personal data for which we are ourselves the data controller. If your employer uses weakestlink for security training, your employer is the data controller for employee data, and weakestlink acts as a data processor — see Annex A.
1. Data controller
WEAKESTLINK ApS (Danish company registration number, CVR 46614011) is the data controller for the processing of personal data on weakestlink.io. Contact: info@weakestlink.io.
2. What data we process, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR Art. 6) | Deleted |
|---|---|---|---|
| Customer contact person (name, email, job title) | Create and administer your workplace's account | Contract (Art. 6(1)(b)) | When the customer relationship ends |
| Billing information | Invoicing and accounting | Legal obligation (Art. 6(1)(c)) | 5 years, per the Danish Bookkeeping Act |
| Server logs (IP, timestamp) | Operations and security | Legitimate interest (Art. 6(1)(f)) | 90 days |
| Email address, when you sign up yourself to hear about an upcoming module (AI-Ready, deepfakes) | Letting you know when the module is ready | Consent (Art. 6(1)(a)) — you can withdraw it by writing to us | No later than 12 months after sign-up |
| Google's click ID when you arrive from a Google ad, the time of the click, and whether the account was created or started paying | Ad measurement: seeing whether a Google ad led to an account being created | Legitimate interest (art. 6(1)(f)) — you can object, see section 7 | 90 days after the click. If a conversion has been reported to Google, it is deleted 90 days after it was reported |
| Visitor statistics: page views and button clicks, with browser type, device and country. No cookies, and IP addresses are not stored | Seeing which pages are used so we can improve them. The statistics run on our own server (Umami) and are not shared with any third party | Legitimate interest (art. 6(1)(f)) | Stored as aggregated statistics without name, email or IP address |
We do not process Danish CPR numbers or any special category data (GDPR Art. 9).
3. AI processing
We use AI (Claude from Anthropic) to write training content and simulation templates — lessons, quizzes and lure emails — internally, before it is published. No customer data and no personal data about your employees is sent to AI services, and no AI is run on your data in production.
4. Data processors and sub-processors
We use the following data processors. For providers outside the EU/EEA, transfers are based on the European Commission's adequacy decision (the EU-U.S. Data Privacy Framework) and/or Standard Contractual Clauses (SCCs):
| Provider | Service | Country | Transfer basis |
|---|---|---|---|
| Anthropic PBC | AI authoring of training content (offline) | USA | DPF/SCC |
| Brevo (Sendinblue SAS) | Outgoing transactional and notification email (e.g. email verification) | Frankrig | — |
| Cloudflare, Inc. | Network, TLS, and DDoS protection | USA | DPF/SCC |
Hosting takes place on our own infrastructure in Denmark.
If you pay by card, your card details and payment data are processed by our payment gateway QuickPay (QuickPay ApS, Denmark) and the card acquirer Clearhaus (Clearhaus A/S, Denmark) as independent data controllers under payment legislation — not as our data processors. We never receive your full card number. QuickPay's and Clearhaus' own privacy policies apply to that processing.
5. Disclosure
We only share information when it is necessary to provide the service, when required by law, or with your consent. One exception: if you came to us from a Google ad, we send the ad's click ID, the time, and whether the account was created or paid for to Google Ireland Ltd. (Google Ads), so we can see which ads work. We never include your name, email or IP address. Google may transfer the information to Google LLC in the USA. According to Google, this is done on the basis of the EU-U.S. Data Privacy Framework, under which Google LLC is certified, and otherwise on the basis of standard contractual clauses (SCC). We never sell information.
6. Retention and deletion
Specific retention periods are set out in the table in section 2. Accounting records are kept for 5 years from the end of the financial year, in accordance with the Danish Bookkeeping Act. The data is then deleted or anonymised.
7. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection (GDPR art. 15–21). If you have given consent, you can withdraw it at any time with effect for the future. Write to info@weakestlink.io — we will reply no later than one month after receiving your request. If you do not want us to use the ad's click ID (sections 2 and 5), you can object (art. 21) by writing to the same address — we will then delete the click ID and not report anything about your account to Google. If you are an employee of one of our customers, you can also contact your employer, who is the data controller (see Appendix A).
8. Complaints
You can lodge a complaint about our processing with the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, www.datatilsynet.dk. If you are in the UK or Ireland, you can also complain to the ICO (ico.org.uk) or the DPC (Ireland).
9. Cookies
We set two cookies: a session cookie used for logging in and security, and — if you choose a language yourself in the language picker — a cookie that remembers your choice. If you come from a Google ad, we store the ad's click ID in the session on our server so we can tell Google whether the click led to an account (see section 5). The cookie itself contains only a random session ID. We use no other tracking cookies and no third-party cookies, and our visitor statistics (Umami) use no cookies at all.
10. Changes
Material changes to this policy will be announced on weakestlink.io and/or by email.
Annex A — division of roles in employee training
When a company (your employer) uses weakestlink for security training and phishing simulation, the company is the data controller for the employee data, and weakestlink acts as the data processor. Processing takes place per instructions in a data processing agreement entered into at setup. This policy then applies only to the data for which we are ourselves the data controller (the customer's contact and billing data, plus operations).
Phishing simulations are only run on a documented legal basis (consent from your workplace and an approved legitimate-interest assessment). Reports are aggregated and only show figures for groups of at least five people. An individual employee's results (risk score, course progress and simulation events) can only be seen by the workplace's administrator — and by managers if the workplace chooses to turn that on. The purpose is targeted extra training, never exposure or sanctions. The results are kept for the duration of the customer relationship and deleted when it ends, as set out in the data processing agreement. We never store what an employee types into a simulation, only that an incident occurred.