Legal Policies & Data Governance
Entity: SmartCyberShield
Address: 411 01 Östra Björredsvägen 3, Göteborg, Sweden
Contact: [email protected] · +46 72 415 68 93
Last Revised: September 2026 · Effective Immediately
Schedule A — Privacy Policy
Data handling lifecycle · GDPR (EU) 2016/679 · SmartCyberShield, Göteborg
1. Data We Collect
SmartCyberShield collects contact and engagement data that you voluntarily submit through our website, contact forms, or direct correspondence with [email protected]. This includes your name, email address, phone number, organization name, and any security briefings or project details you choose to share.
2. Purpose of Processing
We process personal data solely to respond to your inquiries, deliver contracted cybersecurity services, maintain client communication records, and fulfill statutory accounting and tax obligations under Swedish and European Union law. We do not sell, rent, or broker personal data to third-party advertisers.
3. Legal Basis
Processing is based on your consent where you submit inquiry forms, on legitimate interest for maintaining secure business operations, and on contractual necessity when performing active client engagements under an executed statement of work.
4. Data Retention
General inquiry correspondence is retained for a maximum of 24 months from the last interaction. Active client engagement records are retained for the duration of the contract plus 7 years, in line with Swedish bookkeeping requirements (Bokföringslagen). Security audit evidence is retained per the contractual schedule agreed at engagement kickoff.
5. Client Rights
Under the GDPR you have the right to access, rectify, erase, restrict, or port your personal data, and to object to processing based on legitimate interests. Requests can be directed to [email protected]. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten).
6. Security Controls
SmartCyberShield applies encryption in transit (TLS 1.3), encrypted storage for engagement artifacts, role-based access control, and continuous monitoring consistent with ISO/IEC 27001 practices. Our Göteborg operations desk operates under documented incident-response procedures.
Schedule B — Terms of Service
Engagement terms · SmartCyberShield · 411 01 Östra Björredsvägen 3, Göteborg
1. Scope of Services
SmartCyberShield provides cybersecurity consulting and managed defense services, including proactive threat hunting, automated intrusion containment, compliance audit perimeters, penetration testing, zero-trust architecture design, incident response, SOC monitoring retainers, and security awareness training. Exact scope, deliverables, and timelines are defined in each engagement's written proposal or statement of work.
2. Engagement Process
Every engagement follows the three-step workflow published on our website: (1) Initial Audit, (2) Containment Protocol, and (3) Final Outcome. Kickoff briefs submitted through our contact page are triaged by our Göteborg operations desk. Final pricing and start dates are confirmed in writing before any work begins.
3. Client Responsibilities
Clients must provide timely access to necessary systems, accurate environment documentation, and authorized points of contact. Failure to provide required access may delay delivery and does not constitute a breach by SmartCyberShield.
4. Payment Terms
Invoices are issued according to the agreed schedule (fixed fee, milestone-based, or monthly retainer). Payment is due within 14 days of invoice date unless otherwise stated in the statement of work. Late payments may suspend active work until settled.
5. Intellectual Property
Upon full payment, SmartCyberShield assigns to the client all rights in custom deliverables produced specifically for that engagement, excluding pre-existing frameworks, tooling, playbooks, and methodologies developed by SmartCyberShield independently of the engagement.
6. Confidentiality
Both parties agree to keep engagement-related information confidential. This obligation survives termination for a period of five years. Security findings discovered during testing will be disclosed exclusively to authorized client stakeholders under agreed disclosure timelines.
Schedule D — Refund Policy
Commercial settlement · SmartCyberShield billing · Göteborg, Sweden
1. Fixed-Fee Engagements
For fixed-fee service milestones (e.g., Threat Hunting, Compliance Audit, Penetration Testing), full payment is due before work begins or per the milestone schedule in the statement of work. Refunds are not issued after work has commenced, because analyst time and tooling are allocated to your engagement immediately.
2. Cancellation Before Start
If you cancel in writing before the engagement start date stated in the proposal, any advance payment covering unstarted work will be refunded in full within 14 business days to the original payment method.
3. Monthly Retainers
SOC-as-a-Service and continuous monitoring retainers are billed monthly in advance. Cancellations take effect at the end of the current billing cycle; partial-month refunds are not provided. Any unused onboarding work completed before cancellation will be invoiced pro-rata only if that fee was not already prepaid.
4. Quality Disputes
If you believe a deliverable does not match the agreed scope in the statement of work, notify [email protected] within 14 days of delivery. SmartCyberShield will review the discrepancy in good faith and, where validated, remediate at no additional cost or issue a partial refund for the unmet portion of scope.
5. Payment Processor
Payments initiated via the Pay action in our navigation are processed on a third-party secure payment page. Refunds for such payments are issued through the same processor and typically appear on the client's statement within 5–10 business days after SmartCyberShield authorizes them.
6. Contact for Billing
All refund and billing inquiries should be directed to SmartCyberShield at [email protected] or +46 72 415 68 93, referencing the invoice number and engagement identifier.