Cyber72 (“we”, “us”) is the offensive security division of Internet Solutions, based in Tel Aviv-Yafo, Israel. We run penetration tests, red-team engagements, incident response, and managed security for enterprise and government clients. We do not operate a hosted product: there are no accounts, no seats and no subscriptions, and we do not run software on your traffic.
This policy explains what personal data we handle, why we handle it, how long we keep it, and what you can ask us to do about it. In short:
- We are the controller of our website, enquiry and client-relationship data.
- On an engagement we act as a processor, on the client’s written instructions.
- We never sell or rent personal data.
- Findings, exploits and reports are your confidential information. We do not publish them and we do not use them in marketing without your written consent.
- You can review the data we hold and ask us to correct it. We answer within 30 days.
- EEA clients keep their GDPR rights. Israel holds an EU adequacy decision.
Effective 23 October 2026.
Overview and scope
This policy covers cyber72.com and the personal data we handle in the course of business contact and client engagements. It is written to the Protection of Privacy Law, 5741-1981, as amended by Amendment No. 13 (in force 14 August 2025), and to the Protection of Privacy (Data Security) Regulations, 5777-2017. Where a visitor or a client contact is in the European Economic Area, the GDPR also applies to that processing and we honour the rights it gives.
Cyber72 is owned and operated by Vadim Leviev, trading as Internet Solutions, a sole proprietorship registered in Israel. The database controller is Vadim Leviev, trading as Internet Solutions, Alon Tower 2, 94 Yigal Alon Street, Tel Aviv-Yafo, Israel. Contact: [email protected], +972-3-375-1193.
Information we collect
We collect the categories below and nothing beyond them. We ask for the least data that lets us do the work, and we do not build profiles of visitors.
| Category | Examples | Source | Retention |
|---|---|---|---|
| Enquiry data | Name, work email, phone, company, role, the message you send us | You | 24 months from last contact |
| Client relationship data | Contact details of your staff, engagement correspondence, scope, rules of engagement and scheduling records | You and your team | Engagement + 7 years |
| Engagement material | Configuration and system data, logs, screenshots, captured credentials, proof-of-exploit artefacts and findings we receive or generate during a test, which may incidentally contain personal data | Your systems, with your written authorisation | Returned or destroyed per the engagement agreement |
| Incident-response material | Forensic images, memory captures, event logs and timeline evidence collected during a live incident | Your systems, with your written authorisation | Per the engagement agreement, default 90 days after the final report |
| Billing data | Company name, company or VAT number, invoice and payment records | You and your bank | 7 years (Israeli tax law) |
| Website data | IP address, browser and device data, pages viewed, cookie identifiers | Automatically | Up to 13 months |
We do not ask for data of special sensitivity as defined in section 3 of the Protection of Privacy Law, or for special-category data under Article 9 of the GDPR. We ask clients not to place such data in engagement material unless the work genuinely requires it and a separate written data processing agreement covers it.
How we use your information
We use personal data for these specific purposes, and not for others:
- Answer enquiries sent through our contact form, by email or by phone, and prepare proposals and statements of work.
- Scope, plan and deliver the engagement set out in a signed statement of work, and report our findings to you.
- Operate the 24/7 incident-response hotline and respond to a live incident under a retainer.
- Issue invoices and keep the accounting records Israeli tax law requires.
- Send messages about a live engagement: scheduling, access arrangements, findings, retests and reports.
- Send occasional updates about our services to business contacts who asked to receive them, with an opt-out in every message.
- Keep our own website and working systems secure, and investigate misuse of them.
- Establish, exercise or defend legal claims.
Under Israeli law this processing rests on your consent and on the purposes determined for our database under section 8(b) of the Protection of Privacy Law. Where the GDPR applies, the legal bases are Article 6(1)(b) for pre-contractual steps and delivering the engagement, Article 6(1)(c) for tax and accounting retention, Article 6(1)(f) for business updates to business contacts, site security and defence of claims, and Article 6(1)(a) where you consent to non-essential cookies or to a mailing list. We do not make decisions about you by automated means.
Data sharing and service providers
We share personal data only with service providers that process it for us under a written agreement, and with professional advisers and authorities where a specific matter or a lawful order requires it. We do not disclose your data to anyone for their own purposes. Below are the categories of recipient we use.
| Category of recipient | What they receive | Purpose |
|---|---|---|
| Cloud hosting and website infrastructure | Website data, form submissions | Running cyber72.com and storing our records |
| Business email, file storage and collaboration tools | Correspondence, engagement documents | Day-to-day delivery of the engagement |
| Accounting and invoicing services | Billing and company details | Issuing invoices and filing tax returns |
| Website analytics | Cookie and usage data, only where you consent | Measuring how the site is used |
| Professional advisers: lawyers, accountants, auditors, insurers | Only what a specific matter requires | Legal and financial advice, audit, claims |
| Authorities and courts | Only what the law compels us to give | Complying with a lawful order or statutory duty |
Security and data handling
We handle client material in our own business systems and treat all of it as confidential. We apply technical and organisational measures appropriate to the risk: personal data is encrypted in transit over public networks and remote access is authenticated; access is limited to the operators working on the engagement, under named individual credentials; engagement material is kept separate from general company files and deleted on the schedule set out below; portable devices and removable media are controlled; and security incidents are documented and reviewed. The Protection of Privacy (Data Security) Regulations, 5777-2017 require a database definitions document, a written data security procedure and controls matched to the security level a database falls into. We work to those requirements for the personal data we hold.
During an engagement we ask for the narrowest access that lets us do the work, prefer test accounts and non-production copies where the scope allows it, and do not extract real personal data from your systems beyond the minimum needed to demonstrate a finding. Credentials recovered during a test are used only to prove the finding, are never reused outside the agreed scope, and are reported to you so you can rotate them.
Your rights
Your rights over the data we hold as controller are set out below. Where we hold data as a processor for a client, send your request to that client and we will support them in answering it.
- Review. Section 13: ask for the personal data we hold about you. We provide it in Hebrew, Arabic or English.
- Correct. Section 14: if data is incorrect, incomplete, unclear or outdated, ask us to correct it.
- Delete. Section 14 also lets you ask us to erase data that is incorrect, incomplete, unclear or outdated.
- Stop marketing. Section 17F: ask to be removed from our direct-marketing list. We act on it and confirm in writing.
- Withdraw consent. Withdraw consent to cookies or marketing at any time. It does not affect processing carried out before you withdrew.
- EEA rights. In the EEA you also have GDPR rights: access, rectification, erasure, restriction, portability and objection.
To exercise a right, email [email protected] or call +972-3-375-1193. We verify who you are before we answer. Our deadlines under Israeli law: we enable review within 30 days of your request; if we refuse a review request we tell you within 21 days; we answer a correction or erasure request within 30 days. Each period can be extended by a further 15 days only by the Head of the Privacy Protection Authority. The regulations allow a nominal fee for a review request; we do not charge one. For a request under the GDPR we answer within one month, extendable by two further months for a complex request, and the first request is free.
Cookies and tracking
We use cookies to run the site, remember your preferences and understand how the site is used. Non-essential cookies are set only after you actively opt in. Continued browsing is not consent, we do not use pre-ticked boxes, and you can change your choice at any time in the cookie settings.
- Strictly necessary. Required for the site to work – security, form submission, load balancing and remembering your cookie choice. These cannot be switched off and are set without consent.
- Analytics. Tell us which pages are read and where visitors arrive from, so we can improve the site. Set only after you opt in, and switched off again the moment you withdraw consent.
- Functional. Remember preferences such as your accessibility settings. Optional and consent-based; accessibility preferences are stored on your own device, not on our servers.
We do not run advertising or cross-site tracking cookies on this website.
Data retention
We keep personal data only as long as the purpose requires, then delete it or strip it of anything that identifies a person. Where a period is set by law we follow that period; where it is not, we use the criteria stated below.
| Data | Retention period |
|---|---|
| Enquiry and proposal data | 24 months from your last contact with us |
| Client relationship and engagement records | Duration of the engagement + 7 years, to answer questions about the work and defend claims |
| Engagement material from client systems | Returned or destroyed within the period set in the engagement agreement, with written confirmation |
| Incident-response evidence | Per the engagement agreement, by default 90 days after the final report, unless you ask us to hold it for a legal or regulatory matter |
| Billing and accounting records | 7 years (Israeli tax law) |
| Marketing contact data | Until you opt out; we then keep only the minimum record needed to keep you off the list |
| Website analytics | Up to 13 months |
International transfers
We are established in Israel and our work is carried out from Israel. Personal data we hold is processed here and, where a service provider hosts data abroad, in the countries where that provider operates.
From the EEA to us. The European Commission decided in 2011 that Israel provides an adequate level of protection for personal data (Decision 2011/61/EU), and confirmed that decision in its review of 15 January 2024. The decision is in force. A transfer of personal data from the EEA to us therefore needs no Standard Contractual Clauses and no further authorisation. Two limits are worth stating: the decision does not cover transfers that are and remain purely manual, or law-enforcement data exchanges, and the Commission can amend, suspend or repeal it. We do not present adequacy as permanent. Where a transfer falls outside the decision, or where a client requires it contractually, we will sign Standard Contractual Clauses.
From us to a provider abroad. Where we send personal data to a service provider outside Israel we follow the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001: we transfer to countries whose law gives protection no lower than Israeli law, or we rely on the recipient’s written undertaking to apply adequate measures and not to pass the data on. Where such a transfer carries EEA-origin personal data onward to a country the Commission has not found adequate, that onward transfer gets its own safeguard.
Children’s privacy
We work with organisations. Nothing on this site and nothing in our services is directed to children, and we have no reason to collect their data. We do not knowingly collect personal data about children. If you believe we hold data about a child, write to us and we will delete it.
Changes to this policy
We update this policy when our practices or the law change. We post the revised version here with a new effective date. If we add a purpose that this version does not cover, we highlight the change rather than adding it quietly, and where the new purpose needs your consent we ask for it before we start. Earlier versions are available on request.
Contact
Questions about this policy, or a request about your data? Write to us. Vadim Leviev, trading as Internet Solutions is the database controller and answers within the deadlines set out above. None of the four triggers in section 17B1 of the Protection of Privacy Law applies to our activity, so we have not appointed a Data Protection Officer, and we do not claim to have one.
- Email: [email protected]
- Phone: +972-3-375-1193
- Post: Vadim Leviev, trading as Internet Solutions, Alon Tower 2, 94 Yigal Alon Street, Tel Aviv-Yafo, Israel
This policy is provided by Vadim Leviev, trading as Internet Solutions, a sole proprietorship registered in Israel, owner and operator of the Cyber72 brand · Effective 23 October 2026.