Privacy Policy

[Company Name] is a [legal entity type, e.g. Limited Company, LLC] registered at [Registered Address]. We provide cybersecurity, software engineering, cloud infrastructure, and DevSecOps services to business clients worldwide.

For questions about this policy, contact us at: [Contact Email].

We may collect the following categories of personal data:

We do not collect special category data (such as health, biometric, or racial data), and we do not knowingly collect data from individuals under 16 years of age.

We use the personal data we collect for the following purposes:

• To respond to your enquiries and assess whether we can work together
• To manage and deliver our contractual services to you
• To send service-related communications (project updates, invoices, handover documentation)
• To improve our website and understand how visitors engage with it (analytics)
• To comply with our legal and regulatory obligations
• To protect our legitimate business interests and legal rights

We do not sell your personal data to third parties. We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.

For individuals in the EU/EEA and United Kingdom, we process your data on the following legal bases under the GDPR / UK GDPR:

• Contract (Article 6(1)(b)): Processing necessary to fulfil a contract with you or to take steps at your request before entering a contract
• Legitimate interests (Article 6(1)(f)): Responding to enquiries, website analytics, improving our services, and protecting our business interests — where these interests are not overridden by your rights
• Legal obligation (Article 6(1)(c)): Where processing is required to comply with applicable law
• Consent (Article 6(1)(a)): Where you have clearly opted in — for example, to receive marketing communications (we do not currently send marketing emails)

We retain your personal data only for as long as necessary for the purpose for which it was collected:

• Enquiry and contact data: up to 12 months if no engagement follows, or for the duration of the engagement plus 6 years thereafter (to meet legal and accounting obligations)
• Contract and project data: 6 years from the end of the engagement (in line with standard commercial limitation periods in most jurisdictions)
• Analytics data: as determined by our analytics provider (Vercel Analytics); please refer to Vercel's privacy documentation

After these periods, data is securely deleted or anonymised.

Depending on your location and applicable law, you may have the following rights regarding your personal data:

• Right of access — to obtain a copy of the personal data we hold about you
• Right to rectification — to correct inaccurate or incomplete data
• Right to erasure — to request deletion of your data in certain circumstances
• Right to restriction — to limit how we process your data
• Right to data portability — to receive your data in a machine-readable format
• Right to object — to object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent — where processing is based on consent

To exercise any of these rights, contact us at [Contact Email]. We will respond within 30 days. We may ask you to verify your identity before fulfilling your request.

If you are located in the European Economic Area, the General Data Protection Regulation (GDPR) (EU) 2016/679 applies to your personal data.

If you are located in the United Kingdom, the UK GDPR and the Data Protection Act 2018 apply to your personal data. Your rights mirror those under the EU GDPR (see Section 6).

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) applies to your personal data.

To exercise your rights, contact us at [Contact Email]. We will respond within 45 days.

Note: Other US states (Virginia, Colorado, Texas, Connecticut, and others) have enacted privacy laws with similar rights. We honour data subject requests from residents of all US states in good faith.

Your personal data may be stored and processed in countries outside your own, including countries that may not provide the same level of data protection as your home jurisdiction.

Where we transfer personal data from the EU/EEA or the UK to a country not recognised as providing an adequate level of protection, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) or equivalent mechanisms approved under applicable law.

For more information about the safeguards in place, contact us at [Contact Email].

We do not use advertising networks, social media pixels, or third-party remarketing tools on this website.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include encryption in transit (TLS), restricted access controls, and regular security reviews.

However, no method of transmission over the internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security.

We may update this privacy policy from time to time to reflect changes in our practices, technology, or applicable law. When we do, we will update the “Last updated” date at the top of this page. We encourage you to review this policy periodically.

Material changes will be communicated to existing clients by email where we hold your contact information.

To exercise your data rights, ask a question about this policy, or raise a concern, contact us at:

If you are not satisfied with our response, you have the right to complain to your local data protection supervisory authority (see Sections 7 and 8 for EU and UK authorities).