Privacy Policy
Last updated: September 9, 2026
This policy explains how Malvik Security collects, uses, shares and protects personal information when you visit our website, take our courses or contact us. It also explains your privacy choices and how to reach us with questions.
Who we are
Malvik Security is based in Ontario, Canada and teaches purple teaming through offensive and defensive cybersecurity techniques. This policy covers our website at www.malviksecurity.com, our online school and related communications. Our school also uses the addresses malvik.learnworlds.com and academy.malviksecurity.com.
Our Privacy Lead handles privacy questions, requests and complaints. Contact info@malviksecurity.com and indicate that your message concerns privacy.
Information we collect and how we use it
The information involved depends on how you use the school:
| Activity | Information involved | Why we use it |
|---|---|---|
| Registering directly with the school | Last name, email address and the password you set are required; first name is optional. | Create and administer your account and authenticate access. |
| Using social sign-in | Sign-in information made available by the provider you choose, according to the permissions involved. Our school lists Google, Facebook, LinkedIn and Apple as sign-in options. | Authenticate your access through that provider. |
| Buying a course | Our billing form requires name, address, city, postal code and country. Business Tax ID is optional. Purchase and payment records are also associated with your enrollment. | Administer purchases and enrollment, address payment or refund issues and maintain business records. |
| Learning and participating | Information you submit through learning activities and assessments, records of course participation, and content you choose to contribute to discussions or learner messages. | Deliver the course, support learning and enable school interactions. |
| Contacting us or requesting updates | Your email address when signing up for course updates; contact details and message contents you provide when contacting us; and your communication preferences. | Respond to you, provide requested information and manage communications. |
| Using the website and platform | Technical information involved in operating the service, such as browser or device information, sign-in activity and cookie identifiers. | Operate and secure the website and learning platform. |
If you do not provide information needed for an account, purchase or request, we may be unable to provide that part of the service. Optional choices are separate from the information needed to deliver it.
Payments are processed by Stripe. Malvik Security does not process your credit-card payments directly. This does not mean that we hold no financial information: billing and purchase records are used for the purposes described above. See Stripe’s Privacy Policy for its practices.
Who receives information
LearnWorlds is our primary system for learner information and provides the website and online school, including learning activities, community features, learner messaging and platform notifications. Stripe handles payments. We use Microsoft 365 for support and information emails. These providers receive information relevant to the services they provide. We remain responsible for personal information entrusted to providers acting on our behalf and require appropriate protection for that work.
If you choose social sign-in, the sign-in provider also handles information under its own privacy notice. Our site links to LinkedIn, YouTube, X and Discord; following a link takes you to a service with its own privacy practices. A provider’s notice does not replace our responsibilities for our own handling of your information.
The school community is available to logged-in users, including those who have not purchased a course. Contributions to community spaces or discussions can be seen by other participants with access to those spaces. Messages are intended for their recipients; school administrators and service providers may also need access to operate the service, address support issues or meet legal obligations. Avoid posting confidential information or personal information about others without an appropriate basis.
We may disclose information when applicable law requires or permits it, including in response to a valid legal demand or to address fraud or a security incident. Information involved in a business sale, merger or similar transaction is subject to applicable legal conditions, safeguards and notification requirements.
Processing across borders
Our providers operate internationally, and personal information may be processed outside Canada. Information processed in another country may be accessible to its courts, law-enforcement agencies or other authorities under that country’s laws. Contact our Privacy Lead for information about processing arrangements and applicable safeguards.
Cookies and communications
The website and learning platform use cookies and similar technologies for functions such as sign-in and preferences. Our cookie banner offers “Reject all” and individual preferences. It identifies Necessary cookies separately from Functional, Analytics and Marketing categories; the optional categories are initially unselected in the guest preferences. You can review these choices before submitting a selection.
You can also manage cookies through your browser; blocking some cookies may affect site functions. Contact us if you need help with cookie choices. Browser settings do not replace any consent or choice we must provide under applicable law.
We use contact information for account, purchase, course and support communications. The account-signup form offers a separate, initially unchecked choice for promotional updates. We send promotional communications only on an applicable lawful basis, including consent where required. You can ask us to stop marketing emails at info@malviksecurity.com, or use the unsubscribe option in a marketing message. We honor opt-outs without delay and within the period required by applicable law. Necessary service communications may continue, subject to that law.
This privacy policy does not itself provide marketing permission. Continuing to use the website does not automatically authorize materially new uses of your personal information.
Retention and protection
We retain personal information only as long as reasonably needed for the purposes described in this policy, including providing account and course access, responding to requests, keeping required business records and resolving disputes. We consider the information’s purpose, relevant legal requirements and whether a specific issue or legal hold requires continued retention. We review information for deletion or anonymization when it is no longer needed.
Closing an account does not necessarily result in immediate deletion of every related record. Some information may need to be retained for a lawful reason or remain in backups until their applicable retention cycle ends. We explain relevant limits when handling a deletion request.
We take reasonable administrative, technical and organizational steps to protect personal information, proportionate to its sensitivity. These include limiting access to people who need it for their work and handling information with appropriate care. No online service can guarantee absolute security. We assess suspected privacy incidents and provide notifications where required by applicable law.
Your privacy requests and complaints
Email info@malviksecurity.com to request access to your personal information, correction of inaccurate information, account closure, deletion or withdrawal of consent. Describe your request and the account or interaction concerned. We may ask for information reasonably needed to verify your identity and locate the records. Please do not email passwords, complete payment-card details or unrelated identity documents.
We handle requests without charge in the ordinary course. If a fee is legally permitted and proposed, we explain it beforehand. Access requests governed by Canada’s PIPEDA normally receive a response within 30 calendar days. If a lawful extension or exception applies, we provide the explanation and notice required by law. Deletion and withdrawal requests are subject to applicable legal requirements and limits; we explain the outcome.
Depending on the law applicable to your information, you may also have rights to restrict processing, obtain a portable copy of information or object to particular processing, including direct marketing. We handle these requests within the applicable deadlines. You may withdraw consent for processing based on consent without affecting processing that was lawful before withdrawal.
Contact our Privacy Lead if you are concerned about our response or handling of information. You may also complain to the Office of the Privacy Commissioner of Canada or another privacy regulator with jurisdiction, including the UK Information Commissioner’s Office where applicable. Where EU/EEA data-protection law applies, you may complain to a competent supervisory authority, including where you live or work or where the alleged infringement occurred.
Younger learners
Our courses are designed primarily for adults, and older teenagers may also be interested in learning. Young learners and their parents or guardians can contact us to discuss enrollment and privacy questions. We do not treat an account registration as proof of age or parental permission. We explain privacy matters in language appropriate to the learner and obtain any additional consent required by applicable law.
Changes to this policy
We update the date above when this policy changes.
We communicate material changes through an appropriate channel, such as an account email or a prominent website notice, and obtain additional consent before applying new uses where required by law.
FEATURED LINKS
Built for security professionals, by security professionals.