Privacy Policy, Training Use, and Compliance Statement

Cyber Nomad Inc. (“Cyber Nomad,” “we,” “us,” or “our”) is a hybrid organization delivering nonprofit programs and for-profit cybersecurity training and services. We are committed to protecting your information while maintaining high standards of legal compliance, ethical cybersecurity practice, and workforce development integrity.

We may collect:

• Personal Information (e.g., name, email, contact details, payment or donation data)
• Student & Program Data (e.g., enrollment, progress, certifications, participation)
• Technical Data (e.g., IP address, device type, usage analytics, activity within training systems)

We use information to:

• Deliver cybersecurity training, education, and contracted services
• Process payments, donations, and grants in compliance with IRS and funding requirements
• Track program outcomes for workforce, audit, and grant reporting
• Maintain secure, monitored training environments
• Improve services, platform performance, and user experience
• Comply with federal, state (Alaska), and contractual obligations

Cyber Nomad applies FERPA-informed principles to protect participant data:

• Limit collection to what is necessary
• Restrict access to authorized personnel and approved partners
• Maintain confidentiality of student records and performance data
• Use de-identified or aggregated data for reporting whenever possible

Participants may only access assigned systems and perform activities within defined training environments.

Participants may not:

• Access unauthorized systems or external networks
• Use training tools or skills for illegal or unethical purposes
• Attempt to evade monitoring, controls, or safeguards

All training environments may be logged, monitored, and audited to ensure safety, compliance, and instructional integrity.

By participating in Cyber Nomad programs, you acknowledge:

• Cybersecurity training may involve simulated attacks, defensive operations, and controlled system interaction
• There are inherent risks in technical environments, including system errors or unintended disruptions within authorized labs

To the fullest extent permitted by Alaska and federal law:

• You assume all risks associated with participation
• You release and hold harmless Cyber Nomad Inc. and its affiliates from claims arising from participation, except in cases of gross negligence or willful misconduct
• Cyber Nomad is not liable for indirect, incidental, or consequential damages, including misuse of skills learned outside program scope

You accept full responsibility for how you apply cybersecurity knowledge beyond authorized training environments.

Participants agree to:

• Comply with all applicable U.S. laws, including the Computer Fraud and Abuse Act (CFAA)
• Follow responsible disclosure practices
• Maintain confidentiality of systems, labs, and participant data
• Uphold professional cybersecurity and workforce ethics

Cyber Nomad training and operations are informed by:

• NIST cybersecurity principles (risk management, least privilege, audit logging)
• DoD-aligned ethical training standards

We implement safeguards including:

• Role-based access control
• Activity monitoring and audit logging
• Risk-based security practices

We do not sell personal data. We may share information with:

• Trusted service providers (e.g., platforms, payment processors)
• Grantors, auditors, and workforce partners
• Government entities or authorities when legally required

Cyber Nomad aligns with:

• 2 CFR Part 200 (Uniform Guidance)
• Federal and Alaska audit, reporting, and compliance requirements

We ensure:

• Data minimization for program delivery and reporting
• Secure record retention aligned with grant and IRS rules
• Internal controls to prevent fraud, waste, and abuse
• Responsible management of subrecipients and vendors

Data may be disclosed in aggregated or de-identified form for reporting and public impact.

We apply administrative, technical, and organizational safeguards consistent with industry cybersecurity best practices.
No system can guarantee absolute security.

You may:

• Opt out of communications
• Request access, correction, or deletion of your data
• Ask how your data is used in programs, services, or reporting

We are not responsible for third-party privacy practices.

This policy may be updated to reflect legal, regulatory, or operational changes. Updates will be posted with an effective date.

anna.london@cyber-nomad.com