Cyberscout Cyber Services Privacy Notice
Privacy Notices
PrintThis notice was last modified on and has an effective date of September 20, 2026.
This privacy notice provides information about how we use and share personal data when providing our cyber support services in Europe.
These services may be provided directly to you or made available to you as part of a product, policy, benefit or other arrangement offered by an insurer, bank, employer, benefits provider or other organisation.
This privacy notice also describes your data protection rights, including a right to object to some of the processing which Cyberscout carries out. More information about your rights, and how to exercise them, is set out in section 9 below.
| In Brief |
We use your personal information to provide our cyber support services to you. These services are designed to help individuals respond to and recover from cyber or fraud-related incidents and may include support relating to payment fraud, identity theft, account compromise, identity restoration, reimbursement processes and other remediation activities.
To provide these services, we may use personal data such as your contact details, information confirming your entitlement to use the service, information about a cyber incident, fraud event or account compromise, communications with you, and documents or information you provide so that we can provide you with support and assistance.
We may share your data with trusted service providers who help us deliver the services, with other companies in our group where needed to support service delivery, with the organisation that has arranged access to the service where this is necessary, and with regulators, law enforcement or other third parties where required or permitted by law. Your data may also be processed outside the UK and Europe, and we put safeguards in place to protect it.
|
You have the right to object to our use of your personal data. Please see section 9 to find out more.
This privacy notice covers the following topics:
- Who are we and how can you contact us?
- What do we use personal data for?
- What kinds of personal data do we use, and where do we get it from?
- How long is the personal data kept for?
- What is our legal basis for handling personal data?
- Who do we share the personal data with?
- Where is the personal data stored and sent?
- Is the personal data used to make decisions about you or to profile you?
- What are your rights?
- Who can you complain to if you are unhappy about the use of your personal data?
1. WHO ARE WE AND HOW CAN YOU CONTACT US?
About us
In this Privacy Notice, references to "CyberScout", "we", "us" or "our" mean the applicable CyberScout entity identified below:
If you are resident in the UK: CyberScout Limited, a company registered in England & Wales with company number 08865780. Our registered office address is at One Park Lane, Leeds, England, LS3 1EP.
If you are resident in a country which is a member of the European Union: CyberScout Ventures, Ltd, a company registered in Ireland with company number 548258. Our registered office is at Block 1, 2nd Floor, GFSC, Moneenageisha road, Galway, Ireland H91 N8KK.
CyberScout is the controller of the personal data processed in connection with the services described in this notice.
Joint controllers
We sometimes act jointly with one or more of our other group companies when making decisions about your personal data. In particular, we make joint decisions when we and another CyberScout company are sharing personal data with each other.
Our members of staff work across our CyberScout companies so, where our group companies make decisions jointly, those members of staff will ensure that each company involved complies with data protection rules. You can contact our Consumer Services Team if you want to enquire about any of our group companies or exercise any of your rights in respect of your personal data.
Contact details
You can contact us about issues relating to personal data, including the contents of this notice, by emailing privacy@sontiq.com.
2. WHAT DO WE USE PERSONAL DATA FOR?
This section explains the purposes for which we use personal data about you. More detail about the types of personal data that we use for these purposes can be found in section 3 below.
Providing our Cyber Services to you
We use personal data to provide and manage our cyber services. These services are designed to help individuals respond to and recover from cyber or fraud-related incidents, including identity theft, payment fraud and account compromise.
| Example: Cyber Services |
Where we provide Cyber Services to you, we may use your personal data to understand the nature and circumstances of the cyber or fraud-related incident, assess its potential impact, communicate with you about the support available, maintain records of the assistance provided and provide support and guidance in connection with the incident, and, where appropriate, coordinate or arrange support from specialist third-party service providers.
Depending on the circumstances, this may include support relating to payment fraud, account compromise, identity theft, identity restoration, reimbursement processes and other remediation activities designed to help individuals respond to and recover from cyber or fraud-related incidents.
Where we have been appointed by an insurer to provide administrative support in connection with a potential insurance claim, we may collect and organise information relating to the incident and facilitate the submission of that information to the insurer. We do not assess, determine, investigate or decide insurance claims.
|
Verifying your entitlement to use the service
We may use personal data, together with information provided by the organisation that has arranged access to the service to verify that you are entitled to receive the services under the relevant insurance policy, benefit programme or other arrangement
Legal and regulatory purposes and consumer queries
We may use your personal data for legal and regulatory purposes. For example, this might include responding to complaints or enquiries from you or a regulator about how we have used your personal data.
Quality assurance, training and service improvement
We may record and review telephone calls and emails, monitor the quality of the services we provide, and contact you following completion of a Cyber Services case to request feedback about your experience. We use call recordings, email correspondence, quality assurance reviews, customer feedback and survey responses to monitor service quality, investigate complaints, support staff training, assess performance, identify areas for improvement and improve our services.
3. WHAT KINDS OF PERSONAL DATA DO WE USE, AND WHERE DO WE GET IT FROM?
We obtain and use information from various different sources. These are summarised in the following table.
Contact Information
Type of information
| Description
| Source
|
|---|---|---|
| Contact Information | Information used to identify and communicate with you, such as your name, email address, telephone number, postal address and other contact details. | A combination of provided by you and any organisation providing access to the service (such as insurers or employers). |
| Information used to identify and communicate with you, such as your name, email address, telephone number, postal address and other contact details. | A combination of provided by you and any organisation providing access to the service (such as insurers or employers). | |
| Verification and eligibility information | Information used to verify your entitlement to use the service and manage access, such as email address and policy or membership information. | A combination of provided by you and any organisation providing access to the service (such as insurers or employers). |
| Cyber Incident Information | Information relating to a cyber or fraud-related incident, including details of the incident, how and when it occurred, the accounts, devices, services or individuals affected, correspondence and the impact of the incident on you
| Provided by you |
| Case Management Information | Information relating to the support and assistance provided by us, including records of interactions with you, details of the issues raised, actions taken, guidance provided, recommendations made, referrals made to third-party specialists, and records relating to insurer notifications or claim support activities, and the progress of your case. | Provided by you or generated by us and based on information provided by you. |
| Supporting Evidence and Documentation | Information and documents provided to help us understand or support your case. This may include correspondence, emails, text messages, screenshots, reports, claim documentation, responses from financial institutions, insurers, credit reference agencies or other organisations, and other supporting materials relating to the incident. | Provided by you |
| Insurance Notification and Claims Support Information | Information relevant to supporting the notification of an incident or potential claim to an insurer, including details of financial losses, affected accounts, reimbursement requests, claim-related information, correspondence, supporting evidence and information required to submit or support a notification to an insurer. Where we provide this service, our role is limited to supporting the administration and notification of the matter to the insurer. | Provided by you. |
| Contact and query Information | Information you provide when you contact us, make an enquiry, submit a complaint, exercise your data protection rights or otherwise communicate with us, including the content of your communication and any personal data included within it. | Provided by you. |
| Call Recording and Quality Assurance Information | Audio recordings of telephone calls, customer feedback, survey responses, quality assurance reviews and related information used to monitor service quality, investigate complaints, support staff training and improve our services. | Provided by you. |
You are free to choose whether or not you give us your personal data. However, we might not be able to provide you with our service if you do not give us the information we need in order to do so.
4. HOW LONG IS THE PERSONAL DATA KEPT FOR?
We keep personal data only for as long as necessary for the purposes described below. The retention periods set out below reflect our standard approach.
| Type of information | Retention period |
|---|---|
| Information relating to the provision of the Cyber Services | Retained while the relevant Cyber Services case remains active.
Following closure of the case, retained for up to 5 years to manage complaints, legal or regulatory obligations and dispute resolution requirements, after which it is deleted or anonymised.
|
| Call Recording and Quality Assurance Information | Retained for up to 5 years following creation and used for quality assurance, training, complaint handling and service improvement purposes, after which it is deleted or anonymised. |
| Contact and Query Information | Retained for as long as necessary to handle your enquiry, complaint or request and for a reasonable period afterwards to manage follow-up communications. |
5. WHAT IS OUR LEGAL BASIS FOR HANDLING PERSONAL DATA?
This section explains the legal basis on which we process your personal data.
Legitimate interests
The data protection law in the UK and European Union allows the use of your personal data where necessary for legitimate purposes provided that this is not outweighed by the impact on you. This is known as the “legitimate interests” condition for processing personal data.
The legitimate interests we are pursuing are:
| Legitimate Interest | Explanation |
|---|---|
| Providing and operating Cyber Services | We have an interest in providing Cyber Services designed to help individuals understand, respond to and recover from cyber or fraud-related incidents. This may include maintaining case records, communicating with individuals, providing support and guidance, and assisting with remediation activities relating to payment fraud, identity theft and account compromise. |
| Verifying eligibility and entitlement | We have an interest in ensuring that Cyber Services are provided only to individuals who are entitled to receive them. This may include verifying eligibility where access is provided through an insurer, employer, benefits provider or other organisation. |
| Quality assurance, training and service improvement | We have an interest in monitoring service quality, reviewing customer feedback, supporting staff training, investigating complaints and improving our services. |
| Managing and responding to queries, complaints and operational issues | We have an interest in handling customer queries, complaints, data protection requests and operational issues associated with the services. |
| Administering services provided through organisations | We have an interest in administering services provided through insurers, employers, benefits providers and other organisations. This may include sharing information about service uptake, utilisation and outcomes and supporting the ongoing operation and management of those services. |
Legal obligations
We may process your personal data where this is necessary to comply with legal or regulatory requirements.
Special category data and information relating to children and vulnerable individuals
You may choose to provide certain types of personal data when using our services (for example, health information or other sensitive information contained within incident-related evidence or supporting documentation). In some circumstances, information relating to children or other vulnerable individuals may be provided where it is relevant to the incident or support being sought.
You do not have to provide this information. However, in some circumstances, we may be unable to provide support in relation to an incident without the relevant information.
Where we process special category data, we will ensure that an appropriate condition under applicable data protection laws applies.
We will only use this information to provide, administer or support the relevant service described in this notice.
6. WHO DO WE SHARE THE PERSONAL DATA WITH?
Our group companies
We may share your personal data with other companies within the TransUnion group where this is necessary to support the delivery of the service (for example, technical support or system administration, customer support, operational support or case management activities). If we do so, then use of the data by those companies will be governed by this privacy notice. A list of relevant companies is set out below, although the list may be updated from time to time:
| Group company | Main trading address (or registered office) |
|---|---|
| Sontiq, Inc | 555 West Adams Street, Chicago, IL 60661 |
| CyberScout Limited | One Park Lane, Leeds, LS3 1EP, United Kingdom |
| CyberScout Adjusting, Inc | 555 West Adams Street, Chicago, IL 60661, United States |
| TransUnion Global Technology Center LLP | 9th Floor, Block 2,DLF IT/ITES Special Economic Zone Shivaji Gardens, Moonlight Stop, Manapakkam Saidapet Tamil Nadu 600089 |
| TransUnion Global Capability Centre Africa (Pty) Ltd | G floor, 9 & 10 floor,11 Alice Lane, Sandton, 2196, Gauteng, Johannesburg, South Africa 2197 |
| TransUnion Global Capability Center Costa Rica Limitada | San Jose-Escazu San Rafael, Trejos Montealegre, De Escazu Village, Three Hundred Meters to the West, Banco General Building, Sixth Floor |
| TransUnion LLC | 555 West Adams Street Chicago, IL 60661 United States |
Our clients
Where your access to the service is provided by an organisation (such as an insurer or employer), we may share limited information with that organisation about the use of the service, such as overall uptake, engagement utilisation and service outcomes.
Where we have been appointed by an insurer to provide support services in connection with an incident, we may share information that you ask us to pass to the insurer, or information reasonably required to notify the incident to the insurer and support any related insurance process.
Our clients have their own privacy notices which will provide more information about how they use any data made available to them.
Service providers
We may provide your information to third parties who help us use it for the purposes described in section 2.
For example, we may use third party service providers to support the delivery of our services. This includes providers of case management, customer support, telephony, communications, language translation services, document management and related technology services.
These service providers are not allowed to use your personal information for their own purposes or on behalf of other organisations, unless you agree otherwise.
Business transfers
If we sell our business to a third party, or go through a corporate reorganisation, we will transfer personal data to the company that acquires the business.
Regulators and law enforcement
Personal data may be shared with government authorities and/or law enforcement officials if required for the purposes above, if required by law, or if required for the legal protection of our legitimate interests in compliance with applicable laws. For example, we may sometimes need to pass personal data to a regulator such as a data protection authority.
Sharing of anonymised data with third parties
We may share anonymised information with other third parties, but only where the information cannot realistically be identified as relating to you.
7. WHERE IS THE PERSONAL DATA STORED AND SENT?
Within Europe
We are based in the UK and Ireland and will access your information from here. However, we also have operations elsewhere in Europe and personal data may be accessed from there too. In these cases, the use of the information in those locations is protected by European data protection standards.
Elsewhere
We also send information elsewhere in the world. For example:
We make use of service providers (see section 6 above) located outside of Europe and we may need to send them your information in order to allow them to perform their services.
We make use of TransUnion group service companies (referred to as Global Capability Centres, or GCCs) located in India, South Africa, Costa Rica and the United States.
When one of our other overseas group companies or branch offices based overseas needs to use the information in accordance with this notice.
Where we (or our service providers) use cloud-based technology or a data centre or backup facility overseas. People in other countries may also need to access that database for purposes such as technical support or system development and testing.
While countries within the UK and European Union all ensure a high standard of data protection law, some parts of the world may not provide the same level of legal protection in relation to personal data. As a result, when we do send personal data overseas, we will make sure that suitable safeguards are in place to protect the information when required.
For example, these safeguards might include:
Putting in place a contract with the recipient containing terms which have been approved by the authorities as providing a suitable level of protection.
Sending the information to an organisation which is a member of a scheme which has been approved by the authorities as providing a suitable level of protection. One example is the Data Privacy Framework that has been agreed between the UK, European and US authorities.
If your information has been sent overseas like this, you can obtain further information about the safeguards used by contacting us using the details set out in section 1 above.
8. IS THE PERSONAL DATA USED TO MAKE AUTOMATED DECISIONS ABOUT YOU OR TO PROFILE YOU?
Our Cyber Services involve support and assistance provided by appropriately trained personnel and do not involve automated decision-making or profiling.
9. WHAT ARE YOUR RIGHTS IN RELATION TO THE PERSONAL DATA THAT WE HOLD ABOUT YOU?
You have several different rights in relation to the personal data that we hold about you. These are briefly described below. You can exercise your rights using the links below, where available, or by contacting us using the details in section 1. Some rights may only be exercised by contacting us directly
Instructions for Rights Requests Web Form
In the selected Form when choosing the State Field please select the “Other” option from the dropdown menu. In the Request Details Field please copy the following subject line on the top –
“SUBJECT: NON-US DATA SUBJECT REQUESTS”
- Click here to submit a Processing Restriction Request.
- Click here to submit an Access Request.
- Click here to submit a Deletion/Erasure Request.
- Click here to submit a Rectification Request.
Access: You have a right to find out what personal data we hold about you, and certain other information such as how we are using it.
Rectification: If the information that we hold about you is inaccurate or out of date, you have a right to ask us to correct it.
Objection to legitimate interests: If you disagree with us relying on the legitimate interests legal basis for using your personal data (see section 5 above), you can object to us doing so. We will then reassess the extent to which we can continue to use the data in light of your particular circumstances.
Erasure: In certain circumstances you can ask us to delete your personal data from our systems. However, this usually won’t apply to all of your data because we might have good reason for needing to keep some of it.
Restriction: In some circumstances you can ask us to restrict the ways in which we use your personal data.
Portability: In some circumstances you have the right to receive some limited kinds of information in a portable format.
10. WHO CAN YOU COMPLAIN TO IF YOU ARE UNHAPPY ABOUT THE USE OF YOUR PERSONAL DATA?
We aim to provide a high level of service and take any concerns seriously. If you have a complaint about how we use your personal data, please contact us so that we can investigate your concerns at privacy@sontiq.com. You can also contact our Data Protection Officer by addressing an email to them at privacy@sontiq.com.
You also have the right to lodge a complaint with your local data protection regulator or supervisory authority at any time.
If you are located in Ireland, you can contact the Data Protection Commission (DPC), which acts as our lead supervisory authority in Europe, at www.dataprotection.ie.
If you are located in the United Kingdom, you can contact the Information Commissioner’s Office (ICO) via their website, by telephone on 0303 123 1113, or by writing to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF.
We would, however, appreciate the opportunity to address your concerns before you contact a regulator.
Information for Good®.
Connect with us
