Last updated: August 10, 2026

1.  Introduction

Cyber-Pro Israel Ltd., private company no. 51-612070-6, of 2 Hanofar St., Raanana ("Cyber-Pro", "we", "us" or "our"), provides professional training, instruction, workshops, certification preparation and educational programs, primarily in the fields of cyber and information security (collectively, the "Training Services").

We are committed to protecting your privacy and to ensuring that you have a positive and transparent experience whenever you interact with us. This Privacy Policy (the "Policy") explains how we collect, use, disclose, retain and otherwise process information that relates to an identified or identifiable individual, including information that Cyber-Pro can associate with an individual person ("Personal Data"), in the context of:

• our official pages, profiles and paid advertising campaigns on social media and advertising platforms, including Facebook, Instagram, Messenger, WhatsApp and other services operated by Meta Platforms, Inc. and its affiliates (collectively, "Meta") and LinkedIn Corporation ("LinkedIn") (together, the "Social Platforms"), including any lead generation or "instant" form displayed within them (each, a "Lead Form");
• registration for, and participation in, our courses, trainings, workshops, examinations and certification programs; and
• any other interaction you may have with us, including inquiries and correspondence by telephone, email, SMS, WhatsApp or platform messaging, requests for a proposal, professional events, and participant support.

We do not operate a website of our own. Accordingly, this Policy does not address the collection of Personal Data through a website operated by us, and we do not place cookies or deploy tracking technologies of our own. This Policy is published at [URL at which this Policy is hosted] and is linked from each Lead Form and from our profiles on the Social Platforms. Should we establish a website, a landing page or an online registration environment in the future, we will amend this Policy accordingly before doing so, in the manner set out in Section 15.

This Policy is drafted having regard to the Israeli Protection of Privacy Law, 5741-1981, as amended (including Amendment No. 13 thereto) and the regulations promulgated thereunder (the "Israeli Privacy Law"), the EU General Data Protection Regulation 2016/679 and the UK GDPR (together, the "GDPR") to the extent applicable to us, and the requirements applicable to advertisers under Meta's and LinkedIn's advertising and lead generation terms.

2.  To whom this Policy applies

Depending on the nature of your relationship with us, this Policy applies to you differently:

• Prospective Participants ("Leads") – individuals who express interest in the Training Services, including by submitting a Lead Form on a Social Platform, by responding to one of our advertisements, or by contacting us by telephone, email, SMS, WhatsApp or platform messaging.
• Participants – individuals who register for, attend or complete any of the Training Services, whether on their own behalf or through their employer or another sponsoring organization.
• Business Contacts – representatives, employees and personnel of our corporate customers, resellers, training partners, instructors, suppliers and prospective customers.

Provision of Personal Data is voluntary. You are not under any legal obligation to provide us with Personal Data. You do so of your own free will and with your consent. However, if you do not provide certain Personal Data (in particular your name, email address and telephone number), we will not be able to contact you, register you for a course, or provide you with the Training Services or the information you requested.

3.  Personal Data we collect

3.1  Lead Data collected through Lead Forms and campaigns

When you submit a Lead Form in one of our advertising campaigns on Facebook, Instagram or LinkedIn, or otherwise send us your details in response to one of our advertisements, we collect the following Personal Data (collectively, "Lead Data"):

• your full name;
• your email address;
• your telephone number; and
• where you choose to provide it, optional information such as the organization you work for, your job title, the specific course or training you are interested in, your preferred dates or format, and the content of any free-text message you send us.

Certain fields in a Lead Form may be pre-populated by the Social Platform from the information already held in your platform profile. You choose whether to review, amend and submit that information; the data is transmitted to us only once you actively submit the form.

No sensitive or restricted data. Our Lead Forms are not designed to collect, and you should not submit through them, any sensitive or special-category data, including data concerning health or medical condition, biometric data, genetic data, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sex life or sexual orientation, criminal or administrative records, government-issued identification numbers, financial account or payment card details, or precise geolocation. The collection of such data through a lead generation feature is prohibited under Meta's Lead Ad Terms and Advertising Standards and under the equivalent LinkedIn terms, and we do not request it. If you nonetheless submit such information, we may delete it without using it.

3.2  Registration, enrolment and participation data

• identification and contact details (name, email, telephone, and where required for certification, national identity number or passport number – collected only where the relevant examination or certification body requires it);
• employment details relevant to the training (employer, department, role, seniority, professional background and prerequisites);
• course-related records: enrolment and attendance records, session participation, assignments, examination and assessment results, grades, completion status, certificates and continuing-education credits;
• accessibility or accommodation requests you choose to share with us, which we process only to accommodate you and only with your consent;
• recordings, chat logs and screen-sharing content where a session is recorded – in which case advance notice will be given before the recording begins.

Registration may be completed by email, by telephone, or through a registration or learning platform operated by a third-party provider on our behalf. Where a third-party platform is used, that provider processes the data on our behalf and under our instructions, as described in Section 6.

3.3  Billing and payment data

Invoicing details, purchase order numbers, transaction records and billing contact details. Where you pay by credit card, payment is processed by a third-party payment services provider and we do not collect or store full payment card numbers.

3.4  Communications data

Information relating to your communications with us, including support and administrative inquiries, correspondence by email, telephone, SMS, WhatsApp or platform messaging, call notes, marketing preferences and records of consents you have given or withdrawn. Where you contact us through a messaging service, we also receive the technical metadata that the service makes available to us, such as your platform display name and profile identifier.

3.5  Campaign measurement data

Because we do not operate a website, we do not collect browsing data and we do not use cookies, pixels, tags or software development kits of our own. In connection with our campaigns, the Social Platforms provide us with measurement and reporting data, which is generally aggregated and does not identify you individually – for example, the number of times an advertisement was displayed, the number of Lead Forms submitted, and aggregated audience characteristics. Where a platform makes available to us the identifier of the campaign or advertisement through which you reached us, we may associate it with your Lead Data in order to understand which campaigns generate genuine interest in our courses.

3.6  Data from third parties

• Social Platforms and advertising partners: the Lead Data you submit through a Lead Form, together with the campaign-level and aggregated measurement data described in Section 3.5.
• Business data enrichment providers: publicly available or commercially available business information, such as company size, industry, professional role or business contact details, used to qualify and contextualize business inquiries.
• Training partners, resellers and referrers: where a partner or a colleague registers you or refers you to us, we rely on that party's representation that it is entitled to share your details with us and has provided any notice or obtained any consent required by law.
• Your employer or sponsoring organization: where it registers you for a training program.

4.  Purposes of processing and legal bases

We process Personal Data for the purposes set out below. Where the GDPR applies, the legal basis is indicated in brackets; where the Israeli Privacy Law applies, we rely on your informed consent and on the purposes notified to you at the time of collection.

• Responding to your inquiry and contacting you by telephone, email, SMS or WhatsApp regarding the training you asked about, including sending course details, dates, syllabus and pricing (consent; and/or steps taken at your request prior to entering into a contract; and/or our legitimate interest in responding to a business inquiry).
• Registering you for, delivering and administering the Training Services, including scheduling, providing access to learning materials and virtual classrooms, tracking attendance, conducting assessments, issuing certificates and providing support (performance of a contract).
• Reporting to your employer or sponsoring organization where it funds or arranges your participation, including attendance and completion status and, where agreed with that organization, assessment results (performance of a contract; legitimate interest of the sponsoring organization; and, where required, your consent).
• Billing, collection and bookkeeping (performance of a contract; compliance with a legal obligation).
• Direct marketing – sending you information about our courses, new training programs, professional content, newsletters and events (your consent; and, where permitted by applicable law, our legitimate interest in marketing to existing customers and business contacts). See Section 5.
• Advertising, measurement and optimization – measuring the performance of our campaigns on the Social Platforms, understanding which campaigns generate registrations, and building or excluding audiences for our advertising (our legitimate interest in operating and measuring our marketing; and your consent where required by applicable law, in particular in respect of the audience activity described in Section 6.3). See Section 6.
• Improving and developing our Training Services, including analyzing feedback and aggregated participation data to improve course content and delivery (legitimate interest). Wherever practicable we use aggregated or de-identified data for this purpose.
• Information security, fraud prevention and integrity of examinations, including preventing unauthorized access to learning environments and verifying the authenticity of certificates (legitimate interest; compliance with a legal obligation).
• Compliance with legal and regulatory obligations, including retention of records required by tax, accounting and consumer protection laws, and responding to lawful requests from competent authorities (compliance with a legal obligation).
• Establishing, exercising or defending legal claims, and protecting our rights, property and personnel (legitimate interest; establishment, exercise or defense of legal claims).

If we intend to process your Personal Data for a purpose that is materially different from and incompatible with the purposes described above, we will provide you with notice and, where required, obtain your consent.

5.  Marketing communications and your right to opt out

We may send you marketing and promotional communications about our courses, professional content and events, by email, SMS, WhatsApp, telephone or through the Social Platforms.

Where required by applicable law – including Section 30A of the Israeli Communications (Telecommunications and Broadcasting) Law, 5742-1982 (which governs the sending of advertising messages by email, SMS, automated dialing systems and facsimile), and the GDPR and applicable electronic-communications rules – we will send such communications only on the basis of your prior express consent, which may be given through the Lead Form or otherwise.

You may withdraw your consent and opt out at any time, at no cost, by:

• clicking the "unsubscribe" link included in any marketing email;
• replying to a marketing SMS, WhatsApp message or email with the word "Remove" / "הסר"; or
• contacting us at info@cyberpro-israel.co.il or at the telephone number set out in Section 14.

We will give effect to your request promptly and in any event within the period required by applicable law. In addition, under the Israeli Privacy Law you have the right to demand in writing that your Personal Data be deleted from a database used for direct mailing purposes, and we will comply with such a demand.

Please note that opting out of marketing does not prevent us from sending you service and administrative messages relating to a course for which you have registered (for example, joining links, schedule changes or certificate delivery).

To honour your opt-out on an ongoing basis, we will retain a minimal record of your contact details on a suppression list, as described in Section 9.

6.  Advertising on Meta and LinkedIn

This Section describes, in accordance with the disclosure obligations applicable to us as an advertiser under Meta's Lead Ad Terms and under the equivalent LinkedIn terms, how your Personal Data is processed in connection with our campaigns.

6.1  Lead Forms – how your data flows to us

Our campaigns on Facebook, Instagram and LinkedIn may include a Lead Form hosted within the platform. When you complete and submit a Lead Form, the platform transmits the information you entered to us, either directly or through our marketing or customer relationship management service providers. From the moment we receive it, we process that Lead Data as an independent controller, for the purposes described in Section 4 and subject to this Policy.

The platform's own processing of your data – including deciding which advertisement to show you, pre-filling the form from your profile, and measuring the performance of the campaign – is carried out by the platform for its own purposes and is governed by its own privacy policy. To the extent the GDPR applies, we and Meta may act as joint controllers in respect of certain lead generation and measurement activity, in accordance with the arrangements set out in Meta's controller addendum; Meta remains responsible for informing you about, and for handling requests relating to, its own processing.

You can review the platforms' privacy policies at:

• Meta Privacy Policy – https://www.facebook.com/privacy/policy
• LinkedIn Privacy Policy – https://www.linkedin.com/legal/privacy-policy

Our undertakings in respect of Lead Data. We will use Lead Data only for the purpose disclosed in the Lead Form and in this Policy. We do not sell Lead Data or any other Personal Data. We will not transfer Lead Data to any third party other than: (i) service providers processing it on our behalf and under our instructions; (ii) a co-hosting, co-branding or training partner expressly identified in the Lead Form, and in that case only for the purpose for which the data was collected; or (iii) as otherwise described in Section 7.

No targeting of minors. Our Lead Forms and campaigns are directed at adults, are not targeted at minors, and we do not knowingly collect Personal Data through them from individuals under the age of 18. See Section 11.

6.2  Measurement, and business tools we do not use

Because we do not operate a website, a landing page or an online registration environment of our own, we do not deploy the Meta Pixel, the Meta Conversions API, the Meta software development kit, the LinkedIn Insight Tag or any comparable tracking or conversion-measurement technology, and we do not transmit to Meta or LinkedIn any information about your activity outside their own platforms. Our measurement of campaign performance is limited to the reporting the platforms themselves provide, as described in Section 3.5.

If in the future we establish a website, a landing page or an online registration environment and deploy any such tool, we will amend this Policy to describe the tool, the information collected and transmitted, and the purposes for which the platform uses it, and we will implement a consent mechanism where consent is required by applicable law, before that tool is activated.

6.3  Custom audiences and similar audiences

We may create custom or matched audiences by uploading contact information (such as an email address or telephone number, which is hashed before transmission or hashed by the platform upon upload) to Meta or LinkedIn, in order to: show our advertisements to you or to individuals with similar characteristics ("lookalike" or "similar" audiences); or exclude you from a campaign (for example, so that you are not shown an advertisement for a course in which you are already enrolled).

We do this only where we are legally permitted to do so and, where required by law, on the basis of your consent. Under the platforms' custom audience terms, the platform is permitted to use the identifiers we upload only for the purpose of matching them against its own users and is required to delete them following the matching process, other than as permitted under those terms. Where you object to or withdraw consent for this activity, we will remove you from the relevant audiences. You may also manage how Meta and LinkedIn use your information for advertising directly with them, including through Meta Ad Preferences (https://www.facebook.com/adpreferences), the controls in the Meta Accounts Center, and the advertising data controls in your LinkedIn account settings.

6.4  Our pages and messaging on the Social Platforms

If you visit, follow, like or comment on our official pages, or contact us through Messenger, WhatsApp, Instagram direct messaging or LinkedIn messaging, we will receive the content you send us together with the profile information the platform makes available to us. The platform may also provide us with aggregated, non-identifying insights about our page audience. Your use of the platform itself remains subject to the platform's own terms and privacy policy.

7.  Disclosure of Personal Data

We do not sell Personal Data. We disclose Personal Data only as described below:

• Advertising and social media platforms, including Meta and LinkedIn, as described in Section 6.
• Instructors, training partners, examination and certification bodies, where necessary to deliver a course or to administer an examination or issue a certificate – for example, transferring your name and email address to the body that issues the certificate. Where such a body acts as an independent controller, its own privacy policy will apply to its processing, and we will identify it to you before the transfer where practicable.
• Your employer or sponsoring organization, where it registers, funds or arranges your participation, as described in Section 4.
• Professional advisors, such as legal counsel, auditors, accountants and insurers, where necessary for them to provide their services to us.
• Competent authorities, courts and regulators, where we are required to do so by applicable law, court order or lawful request, or where necessary to establish, exercise or defend legal claims, to prevent fraud or to protect the rights, property or safety of any person.
• Any other recipient with your consent or at your direction.

8.  International transfers of Personal Data

We are established in Israel. Accordingly, your Personal Data may be transferred to, stored in and processed in a country other than your own, whose data protection laws may differ from those of your jurisdiction.

Where we transfer Personal Data from Israel to a country that is not subject to an adequacy decision, we implement an appropriate transfer mechanism, together with supplementary measures where required. Transfers of Personal Data out of Israel are made in accordance with the Israeli Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001. You may request further information about the safeguards we apply by contacting us as set out in Section 14.

9.  Retention of Personal Data

We retain Personal Data only for as long as reasonably necessary for the purposes for which it was collected, and thereafter as required to comply with our legal and contractual obligations or to protect ourselves against potential disputes. In particular:

• Lead Data where no engagement follows: retained for up to [12 / 24] months from your last interaction with us, after which it is deleted or irreversibly anonymized – unless you have consented to continue receiving marketing communications, in which case it is retained until you withdraw that consent.
• Participant records: retained for the duration of your participation and thereafter for [7] years, in order to comply with tax, accounting and bookkeeping requirements, to enable verification of certificates and completion records, and to defend potential claims within the applicable limitation period.
• Billing and financial records: retained for the period required under applicable tax and bookkeeping law.
• Marketing consents and opt-out (suppression) records: retained for as long as necessary to demonstrate compliance and to give continuing effect to your opt-out.
• Session recordings: retained for 12 months, unless a longer period is agreed with the sponsoring organization.
• Correspondence and call records: retained for 12 months from the last communication, or for longer where required in connection with a contract or a potential claim.

In determining the appropriate retention period we consider the volume, nature and sensitivity of the data, the potential risk of harm from unauthorized use or disclosure, the purposes of processing, whether those purposes can be achieved by other means, and applicable legal requirements.

10.  Data security

We implement systems, applications and procedures designed to secure Personal Data and to minimize the risks of theft, damage, loss, or unauthorized access to or use of information, including access controls and role-based permissions, encryption of data in transit and, where appropriate, at rest, network and endpoint protection, logging and monitoring, personnel confidentiality undertakings and privacy and security training, vendor due diligence, and periodic review of our controls. We maintain these measures in accordance with the Israeli Privacy Protection (Data Security) Regulations, 5777-2017, at the security level applicable to our databases.

Nevertheless, and although we make substantial efforts to protect your privacy, no system is impenetrable and we cannot guarantee that our systems, our learning environments or the Training Services will be immune from wrongdoing, malfunction, unlawful interception or access, or other forms of abuse or misuse. Where we become aware of a security incident affecting your Personal Data, we will notify you and the competent authorities where and as required by applicable law.

11.  Minors

The Training Services and our advertising campaigns are directed at adults. We do not knowingly collect Personal Data from individuals under the age of 18 through our Lead Forms or our campaigns, and our Lead Forms are not targeted at minors. If you believe that a minor has provided us with Personal Data, please contact us as set out in Section 14 and we will delete it.

Where we deliver Training Services to minors under an agreement with an educational institution or other organization, the relevant Personal Data is processed on behalf of, and in accordance with the instructions of, that institution, which is responsible for providing notice to, and obtaining any consent required from, the minor's parent or guardian.

12.  Your rights

Subject to applicable law, you have the following rights in respect of your Personal Data:

• Access and review – to receive confirmation as to whether we hold Personal Data about you and to review that data (Section 13 of the Israeli Privacy Law; Article 15 GDPR).
• Correction – to request that inaccurate, incomplete, unclear or outdated Personal Data be corrected or updated (Section 14 of the Israeli Privacy Law; Article 16 GDPR).
• Deletion / erasure – to request the deletion of your Personal Data, including in the circumstances in which a right of deletion is available under the Israeli Privacy Law and Article 17 GDPR.
• Deletion from a direct mailing database – to demand in writing that your Personal Data be deleted from any database used for direct mailing purposes.
• Withdrawal of consent – to withdraw, at any time, any consent you have given, including consent to marketing communications and to the audience activity described in Section 6.3, without affecting the lawfulness of processing carried out before withdrawal.
• Objection and restriction – to object to, or request restriction of, processing based on our legitimate interests, and to object at any time to processing for direct marketing purposes (Articles 18 and 21 GDPR).
• Portability – to receive Personal Data you provided to us in a structured, commonly used, machine-readable format and to have it transmitted to another controller, where technically feasible (Article 20 GDPR).
• Not to be subject to solely automated decision-making having legal or similarly significant effects (Article 22 GDPR). See Section 13.

How to exercise your rights. Please contact us at info@cyberpro-israel.co.il or as otherwise set out in Section 14. We may need to verify your identity before responding, and may request additional information for that purpose only. We will respond within the period required by applicable law. There is no charge for exercising your rights, save where permitted by law in respect of manifestly unfounded or excessive requests, or where a fee is prescribed by the Israeli Privacy Law.

Complaints. If you are dissatisfied with our response, you may lodge a complaint with the Israeli Privacy Protection Authority (https://www.gov.il/en/departments/the_privacy_protection_authority). If you are protected by the GDPR, you may also lodge a complaint with the supervisory authority in your country of residence, place of work or the place of the alleged infringement.

13.  Automated processing

We do not take decisions producing legal effects concerning you, or similarly significantly affecting you, based solely on automated processing. We may use automated tools to prioritize and route inquiries, to identify which courses may be of interest to you, and to segment audiences for marketing purposes. Where such processing is carried out and you wish to object or to request human review, please contact us as set out in Section 14.

14.  Contacting us

If you have any question, comment or concern regarding this Policy or the Personal Data we hold about you, or if you wish to exercise any of your rights, please contact us:

• Cyber-Pro Israel Ltd., [full registered address]
• Email: info@cyberpro-israel.co.il
• Telephone: 058-7782341
• Privacy Protection Officer / Data Protection Officer: [name], [email] [delete if no officer has been appointed]

15.  Changes to this Privacy Policy

We may update this Policy from time to time. Laws, regulations and industry standards evolve, which may make such changes necessary, and we may also change our business practices – including, in particular, if we establish a website, a landing page or an online registration environment. We will publish the amended version at the address at which this Policy is made available and update the "Last updated" date at the top of this Policy. If we make changes that we believe materially alter your privacy rights, we will provide prior notice, for example by email to the address you provided to us. Your continued interaction with us after the notice period will be deemed acceptance of the amended Policy, save where your consent is required by applicable law, in which case we will obtain it.

16.  Third-party platforms and services

Our advertisements, communications and learning materials may refer or link to third-party platforms, content and services that we do not operate or control, including the Social Platforms themselves and the platforms of examination and certification bodies. This Policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to review the privacy policy of any third-party platform or service before providing it with Personal Data