Legal & Compliance:
Privacy Notice Under Article 14 of the GDPR
This Privacy Notice was last updated on July 2026.
PRIVACY NOTICE UNDER ARTICLE 14 OF THE GDPR
You should download a copy of this Privacy Notice for future reference.
PLEASE READ CAREFULLY THE CONTENTS OF THIS PAGE.
THIS PRIVACY NOTICE EXPLAINS WHEN, WHY, AND HOW WE PROCESS PERSONAL DATA ABOUT YOU THAT WE OBTAIN FROM THIRD-PARTY SOURCES. THIS PRIVACY NOTICE SUPPLEMENTS ANY OTHER PRIVACY INFORMATION OR NOTICES WE MAY PROVIDE TO YOU AND SHOULD BE READ TOGETHER WITH THEM.
Hack The Box or Company
Hack The Box Ltd a company registered in England and Wales (registration number 10826193). Our registered office is located at 38 Walton Road, Folkestone, Kent, CT195QS. Our VAT number is GB272830402. (also referred to as “we,” “us,” “our,” and “HTB”)
Data Protection Legislation
The following legislation to the extent applicable from time to time: (a) the General Data Protection Regulation 2016/679 (“GDPR”) as amended or replaced and in force from time to time and as transposed into Member-state legislation, which is retained in the United Kingdom (UK) as “UK GDPR”; (b) any applicable national law, regulation and guidelines from the competent data protection authority; and (c) any applicable successor texts or other similar national data protection law;
Data Controller
The entity that determines the purposes and means of the Processing of Personal Data.
Data Subject
The identified or identifiable natural person;
Personal Data
Any information that identifies or can be used to identify a user, directly or indirectly, including, but not limited to, first and last name, date of birth, email address, occupation or other demographic information.
Data Processor
An entity that processes Personal Data on behalf of the Controller.
Process or Processing
Any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Special Category Data
Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.
Data Controller:
Hack The Box Ltd. a company registered in England and Wales (registration number 10826193). Our registered office is at 38 Walton Road, Folkestone, Kent, CT195QS. Our VAT number is GB272830402
Contact Details:
Address: 38, Walton Road, Folkestone, Kent, UK, CT19 5QS.
Email: privacy@hackthebox.com.
Online: Contact Page
Data Protection Officer:
Ioannis Kaffes, dpo@hackthebox.com
We received your personal data from Let’s Defend LtD as a result of the asset purchase agreement and corporate transition.
The categories of data subject to processing, the purpose and legal basis for such processing, as well as the retention period applied by the Company in its capacity as Data Controller, are set out in detail below in accordance with each specific processing activity:
Service Migration and Provision of Platform Services
In general, we do not carry out automated decision-making, including profiling, within the meaning of Article 22 of the GDPR. Where technological tools are used to support internal processes, any decisions affecting you are always subject to meaningful human involvement and are not taken solely by automated means.
To ensure relevant advertising, we may use categorisation involving automated processing of your personal data. This may also include predictions about your demographics (e.g., age, gender) or preferences. These processes will not have legal or similarly significant effects; the only result is that you may receive advertisements better aligned with your interests.
Within Hack The Box, your personal data is accessible only to employees who need it in order to perform their professional duties. We ensure that data is disclosed strictly on a need-to-know basis, for specified purposes, and only where permitted by law.
We may share your personal data with Hack The Box subsidiaries and with authorised third parties acting as processors, who provide services necessary for delivering the Services. In these cases, we disclose only the minimum data required and ensure that contracts are in place obliging processors to use your data solely for providing services to us, in line with our privacy standards.
We may disclose personal data to law enforcement agencies, administrative authorities, courts, or other competent public bodies, but only to the extent required by law.
In the event of a merger, acquisition, change of ownership, or investment, we may disclose limited personal data to the acquiring company, its advisers, or potential investors, for due diligence or regulatory disclosure purposes. In such cases, we will share only the minimum necessary information and will consider anonymisation where possible.
We do not share your personal data with third parties to promote their products on our platform. However, we may share aggregated and non-identifiable information about advertising performance with third-party partners.
In all cases when we transfer your Personal Data or instruct our Processors to transfer your Personal Data outside of the UK or European Economic Area (EEA), we make sure that your information receives a similar level of protection by:
● Only sending information to countries that have been formally recognized by the European Commission as having an adequate level of protection for personal data or
● Using Standard Contractual Clauses approved by the European Commission to ensure appropriate safeguards are in place.
● Applying additional appropriate safeguards, whenever necessary.
You may acquire a copy of our Standard Contractual Clauses and additional safeguards by submitting a relevant request by e-mail to privacy@hackthebox.com.
We have implemented generally accepted standards of technology and operational security to protect Personal Data from loss, misuse and unauthorized access, disclosure, alteration and destruction, taking into account the risks involved in the processing and the nature of the Personal Data.
We are certified with and apply ISO 9001, 27001 and 27701 standards. For further information with regard to our security measures, please see our Technical & Organisational Security Measures list that can be accessed at https://resources.hackthebox.com/hubfs/Legal/DSM.pdf.
If there is a breach of security which has affected your personal data and we are the Data Controller, we will notify the competent Authority within the statutory deadline and keep you informed (where required under data protection legislation).
We do our best to keep your data accurate and up to date, to the extent that you provide us with the information we need to do so. If your data changes (for example, if you have a new email address), then you are responsible for notifying us of those changes.
You have the following rights:
● Right of Access: You have the right to request access to your personal data processed by Hack the Box as well as to information pertaining to their processing (source of data, purposes of processing, categories of recipients, data retention period). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
● Right to Rectification: You have the right to request the rectification of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
● Right to Erasure: You have the right to request the erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for their further processing by Hack the Box. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing, where we may have processed your information unlawfully or where we are required to erase your personal data to comply with law.
● Right to Object: You have the right to object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and you feel such processing impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
● Right to Restrict Processing: You have the right to request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data’s accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to retain the data even if we no longer need it but you require it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
● Right to Data Portability: You have the right to request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format.
● Right to file Complaints: You have the right to file a complaint at any time: For the EU Users: before the Hellenic Data Protection Authority Postal Address: Data Protection Authority Offices: 1-3, Kifissias Avenue, PC 115 23, Athens, Greece, Call Centre: +30-2106475600 Fax: +30-2106475628 E-mail: contact@dpa.gr. For the UK Users: before the UK Information Commissioner’s Office. HackTheBox is registered with the Information Commissioner’s Office, the UK regulator for data protection matters under number ZA827838.
You may exercise the above rights directly by contacting the privacy contact at: privacy@hackthebox.com. We will make our best efforts to respond to any request within a month. You will not have to pay in order to exercise your rights. We may request further information from you to confirm you are the owner of the data.
If you have any complaints about this notice or the way in which we handle your Personal Data or in case you notice a misuse of your Personal Data you should immediately inform us at privacy@hackthebox.com so we can immediately take the necessary actions.