Myrus Privacy Policy

BroadShield Ltd (“we”, “our”, “us”) is committed to protecting your privacy and personal information.

This notice explains how we process personal data through the Myrus platform, which provides learning, performance, competence and apprenticeship management for our customers.

1. Purpose of This Notice

This notice describes how BroadShield Ltd collects, uses and protects personal data processed through Myrus.

It applies to:

Corporate customers and their delegated users – where BroadShield acts as a data processor on behalf of the customer (data controller); and
Individual account holders – where an individual registers directly with BroadShield to use Myrus. In these cases, BroadShield acts as the data controller for that individual's data.

2. Roles and Responsibilities

Corporate Customers (Employers) – determine the purpose and lawful basis for processing their employees' data and are responsible for responding to data-subject rights requests.
BroadShield Ltd – processes data only under the customer's instructions, provides a secure hosted platform, and supports the customer in meeting data-protection obligations.
Users – employees, or learners accessing Myrus either through an employer or individually.

3. Information We Process

The personal data processed in Myrus may include:

Identification: name, email address, job title, department, manager.
Employment details: training records, performance reviews, goals and objectives.
Learning data: courses enrolled and completed, assessments, certifications.
Technical data: IP address, browser type, log-in activity.
Any additional information uploaded by the customer relating to employee development or competence.
Communications and support enquiries submitted through Myrus.
For individual learners: contact preferences and billing information, where required to deliver the service.

4. How We Collect Data

Data is supplied directly by our customers or their authorised users when setting up or managing accounts on Myrus.

Technical data (e.g. IP address, usage logs) is collected automatically to maintain platform security.

We may also receive data via third-party integrations chosen by the customer (for example, HR or email systems).

5. Lawful Basis for Processing

BroadShield processes data only:

To perform our contract with each customer; and
Under our legitimate interests in maintaining, improving and securing the platform.

Customers, as data controllers, are responsible for ensuring they have a valid legal basis for collecting and processing their users’ data.

When BroadShield Acts as Data Controller (Individual Learners)

If you create a Myrus account directly with BroadShield, we process your data as controller based on:

Contract (Article 6(1)(b)) – to provide access to Myrus and related services.
Legitimate Interests (Article 6(1)(f)) – to maintain and improve platform security and functionality.
Consent (Article 6(1)(a)) – for optional communications or marketing preferences, which you can withdraw at any time.

6. Data Retention

Corporate-user data is retained for three months after the customer contract ends or the final invoice is paid, whichever is later.
Customer account information is retained for seven years for legal and audit purposes.
Data is securely deleted or anonymised once retention periods expire.

7. Data Security

BroadShield Ltd uses technical and organisational measures to protect data, including:

Encryption in transit and at rest.
Multi-factor authentication and role-based access control.
Continuous system monitoring and vulnerability management.
Hosting on secure UK-based Microsoft Azure infrastructure.
Staff training on data protection and security best practice.

We do not transfer or store data outside the UK.

8. Your Rights

Under UK GDPR, you have the right to request access, correction, deletion, or restriction of your personal data.

Corporate users – should direct requests to their employer (the data controller).
Individual learners – may exercise their rights directly with BroadShield Ltd by contacting support@broadshield.co.uk.

9. Cookies and Tracking

Myrus uses essential cookies for secure authentication and session management. For information about optional analytics or website cookies, see our Cookie Policy.

10. Contact Us

For questions about this notice or data processed within Myrus, contact:

BroadShield Ltd
Business and Technology Centre
Bessemer Drive, Stevenage, Hertfordshire SG1 2DX

Email: support@broadshield.co.uk

Telephone: 0345 880 1818

June 2024 (Policy BSQP032 issue 1.0)