Updated 17 October 2026
Who is responsible
BlueTeam Academy is owned and operated by Atlant Security. We provide cybersecurity education to companies and their authorised learners.
Svoboda 27-69Sofia 1231, Bulgaria
VAT BG205426422
Academy enquiries: sales@blueteam.academy
Legal and privacy contact: alexander@atlantsecurity.com
Atlant Security is responsible for the operation of this website and the handling of academy enquiries. Company administrators determine their learner invitations, assignments and access to company learning records. If your request concerns employer-assigned training, you can also contact your company administrator.
Data, cookies and retention
What this service stores
When you register, we store your name, verified email address, organisation, workspace membership, training assignments, deadlines, lesson confirmations, assessment attempts and security events in Cloudflare D1. Workspace administrators can see their members’ progress, roles and groups.
With your consent in Cookie settings, the website and portal remember your selected interface language and the last course you selected in this browser. Without that consent, language and course navigation still work through the URL. These preferences do not contain account credentials and are not sent to a translation service.
Contact enquiries
The contact form sends your name, company, work email, training interest, preferred language and message through Cloudflare Email Service to our academy team. Replies go to the work email you provide. Enquiries are handled in our email mailbox; the website does not save a separate copy of your message in its database. Contact us to request deletion of your correspondence.
Cloudflare Turnstile checks browser and network signals to prevent automated submissions. We check the email domain against a local list of free and disposable providers and use Cloudflare DNS to check that it accepts email. Rate-limit counters use hashed identifiers and expire automatically. These checks do not verify ownership of the mailbox or enrol you in marketing communications.
Signing in
Cloudflare delivers one-time sign-in emails. Links expire after 15 minutes. Essential secure cookies bind links to your browser and keep administrators and company owners signed in for up to seven days, and learners for up to eight hours. Signing out revokes all of your active sessions.
Company demos
Domain lookup sends the company domain to Microsoft’s public discovery service. We store the resolved Entra tenant ID, company domain and demo start and end dates. The 30-day demo starts after work-email verification. No card or payment details are collected, and no automatic subscription is created. After expiry, training is paused and existing records remain accessible.
Company accounts
A workspace owner can configure Microsoft 365 or Google Workspace sign-in and selected group sync. Provider credentials are encrypted. Company sign-in is linked explicitly to your verified account; email domains alone do not grant company access. Directory group sync reads selected groups and matches existing workspace members.
Retention and requests
Expired links, sessions and rate-limit counters are removed daily. Workspace audit events are kept for one year. Learning and account records currently remain until an administrator handles a deletion request. Contact sales@blueteam.academy for access, correction, export or deletion requests. You can download your own account and learning data from My account, and revoke individual sessions there. Automated account deletion and tenant retention controls are not yet available.
Programme evidence
We also store your declared professional role, module decision answers and written reflections, completion certificate snapshots, company learning context, refresher history and workshop participation records. You and authorised administrators of your company can access your programme evidence. Written reflections are retained but are not automatically assessed for professional quality. Company workshop records are administrator attestations. Certificate snapshots preserve the details at issue even if your profile later changes.
Learning records
The signed-in portal stores your learning progress in your workspace. The public catalogue links to these courses. Sample course results are not accredited certificates or proof of regulatory compliance. No advertising analytics are installed.
Course completion records include per-slide listening or caption-reading time, required narration duration, study mode, course start and assessment completion times. Your authorised company administrators can review these records to check training completion. This required learning evidence is separate from optional website analytics.
Service providers and processing
Cloudflare provides hosting, application data storage, email delivery and anti-abuse checks. Our business mailbox handles enquiries. Microsoft or Google process the sign-in and directory requests associated with a company’s chosen integration. These providers may process information across countries; this page does not promise that all processing occurs only within the European Economic Area. Contact us for the processing arrangements relevant to your company.
Prepared narration comes from Academy-authored teaching scripts. Some recordings were created with ElevenLabs; newer recordings are generated on our own device. Playing these files does not send your written exercises to a speech-generation service. Course previews do not count as learner completion evidence. Local preview responses are temporary; signed-in superadministrator rehearsal work for draft courses can be saved.
Stripe processes card payments and subscription billing, including the billing details and tax information entered at checkout. The academy stores Stripe customer and subscription identifiers, purchased courses, payment status and renewal dates. We do not store full card numbers. Atlant Security issues customer invoices manually in Zoho Invoice using the billing information required for invoicing. There is no automated connection between the academy and Zoho.
Your requests and rights
We use account and learning information to provide the requested company service, and use enquiry and security information for legitimate interests in responding to business requests and protecting the platform. Contractual and legal obligations may also require particular records. Ask us for the purposes, legal basis and retention relevant to a particular record.
Depending on the applicable conditions, you may request access, correction, erasure, restriction or portability of personal data and object to processing based on legitimate interests. Send requests to alexander@atlantsecurity.com. We may need to verify your identity. You may complain to a data protection supervisory authority, including Bulgaria’s Commission for Personal Data Protection.