Document Summary

General Data Protection Regulation (GDPR)

Download PDF
Our approach to security and privacyOur approach to security and privacy
Back to Trust Center

General Data Protection Regulation (GDPR)

The General Data Protection Regulation (“GDPR”) is the European privacy regime that has replaced the EU Data Protection Directive (“Directive 95/46/EC”). The GDPR strengthens the security and protection of personal data in the EU.

To whom does the GDPR apply?

The GDPR applies to all organizations operating in the EU and processing “personal identifiable data” of EU residents. Personal data is any information relating to an identified or identifiable natural person.

Secure Code Warriors Commitment to GDPR Compliance

Secure Code Warrior has made information security and data privacy foundational principles of everything we do, and we recognize the importance of adhering to regulations to advance information security and data privacy for citizens of the EU.

We appreciate that our customers have requirements under the GDPR that are directly impacted by their use of our Services. Below are several GDPR initiatives that have been implemented across our Services:

  • Investment in security – We’ve increased our investment in security. This includes implementing vulnerability detection throughout the software delivery life cycle, improved auditing and logging across all services, updated internal security policies, maintaining ISO 27001 certification, staff security training, improved password and secret management, 2FA enforcement, and more.
  • Employee training – We ensure our teams are trained in handling customer data and personal information, and that they maintain the confidentiality and security of that data.
  • Privacy policy updates – We have updated our Privacy Policy to clearly indicate what information we collect from website visitors and platform users.
  • Data Processing Addendum – We support the EU’s Standard Contractual Clauses through a Data Processing Addendum.
  • Data subprocessors – We list all of our third party Data subprocessors and share information on the support each subprocessor provides, and where they are located.
  • Data Subject Access Request procedure – We will  assist with any "data subject access requests" raised by the end-user. Most of these requests can be handled by the end-users themselves, via our portal or api (for example: right to correct data, data portability). Others are handled through emailing our privacy team -

Our Security

We appreciate that we are entrusted with valuable and sometimes sensitive user research data, which is why we have built security into every layer of our architecture, pursuing a ‘privacy by design’ approach to the design and development of our Services.

Our application is built on world-class, modern cloud infrastructure designed to ensure the safety of your data. We have carefully selected to work with  proven third party cloud providers with a great security track record.  We employ best practices including regular backups, data encryption, sanitized logging, and common attack prevention.

Download a copy of our Whitepaper for more information about our security practices.

International Data Transfers

Secure Code Warrior  offers customers a robust international data transfer framework as a part of our Data Processing Agreement (“DPA”). The DPA ensures that our customers can lawfully transfer personal data to our Services outside of the European Economic Area by relying on the Standard Contractual Clauses. Our DPA also contains specific provisions to assist customers in their compliance with the GDPR.

Data Portability and Right To Correct Data

We help customers meet obligations under the GDPR ‘data portability’ and ‘right of rectification’ Below are some support articles that can help you with these requirements.

Right To Be Forgotten

We help customers meet obligations under the GDPR ‘right to be forgotten’ (or ‘right to erasure’) clause by making it easy to request the deletion of personal data from the SCW Platform. 

Below is a support article that customers can use to delete user profiles from the SCW Platform.

Once the above process is done, customers should email our Privacy team - to confirm data from the Secure Code Warrior Learning Platform has been removed as well as any other processing systems.

Privacy and Consent

Your privacy is important to us, and so is being transparent about how we collect, use, and share your information. In our Privacy Policy and Cookie Policy we share what information we collect, how we use and store that data, and how you can access and control your information.

What is Secure Code Warriors purpose for processing personal data?

The SCW Platform provides training to developers of the Customer to think and act with a security mindset as they build and verify their skills . The SCW Platform allows developers to solve various security puzzles and tracks developer progress through the puzzles.

Is Secure Code Warrior a Controller or Processor?

What are "processors" and "controllers"?

A processor is an entity that only processes, or uses, stores, transmits, etc, personal data in accordance with the instructions of a controller. The majority of the time, third-party service providers processing personal data on your behalf are processors. For example, customer relationship management platforms would likely be processors.  

A controller, by contrast, is an entity that determines the purposes and the means of the processing. In other words, the controller decides why and how to process personal data.  Determining what personal data is to be used for, whether to disclose the data (and, if so, to whom), and how long to retain the data are all decisions that can only be made by a controller.

An organization doesn't have to be just a controller or just a processor though: it can fulfill different roles in respect to different data.

Consider, for example, a cloud hosting provider. It may be a processor of the data it hosts for its customers but will be a controller of data about its own employees and it may be a controller of certain kinds of account data about its customers.

How does this apply to Secure Code Warrior?

Being a Software as a Service provider, Secure Code Warrior acts as either a processor and a controller, depending on the circumstances. Specifically:

  • Secure Code Warrior is a processor with regard to the personal data that our customers (the controller) provide to us through the use of the Secure code Warrior learning platform.
  • Secure Code Warrior is, by necessity, a controller of personal data that it collects and for which it determines the purposes for which and the manner in which the personal data is to be processed. For example, as visitors to our website, we may collect personal data with your consent that we then use for marketing communications or data analytics to provide additional services to our customers and improve our product.

What data does Secure Code Warrior collect through its platform service and website?

Secure Code Warrior collects contact information (Full Name/Email), website tracking, and product usage information. Refer to our Privacy Policy for additional information.

Additional Resources

The following resources might prove useful:

Contact us

If you have any questions, please email us at -

Looking for something else?

Our approach to security and privacy

Visit our Trust Center to learn more about the security and privacy practices that safeguard our information assets, and those of our customers, against misuse, abuse or compromise.

Trust Center