We use the details you give us to respond to enquiries and deliver agreed services. We also process limited technical information to run and protect the website. We do not sell personal data or use it for advertising.
Who we are
Smartsec Information Security Ltd (company number 11886578) is the controller for the personal information described in this notice. “SMARTSEC”, “we” and “us” refer to that company, including its Threat Hub services.
You can contact us at hello@smartsec.co.uk or write to Ground Floor, Radley House, Richardshaw Road, Leeds, LS28 6LE, United Kingdom.
For client security testing and threat intelligence work, the contract may set out additional instructions, security controls and retention terms for the information we handle on your behalf.
Information we use and why
| Information | Purpose | UK GDPR lawful basis |
|---|---|---|
| Contact form details: name, email address, selected service and message | Respond to your enquiry and discuss a possible engagement | Legitimate interests in responding to enquiries, or steps requested before a contract |
| Correspondence and business contact details | Communicate with clients and suppliers, deliver and administer services | Contract, legitimate interests, or legal obligation where applicable |
| Project records and information supplied during an engagement | Perform the agreed testing, intelligence or exercise work, report findings and manage the engagement | Contract or legitimate interests, subject to the client agreement and our role in the processing |
| Client platform account details and access records, where a client uses the platform | Provide access to findings and reports and protect the service | Contract and legitimate interests in operating a secure client service |
| Technical data such as IP address, request time and browser information | Operate and protect the website, investigate errors and limit form abuse | Legitimate interests in keeping the website secure and available |
Our contact form also records the IP address and submission time with an enquiry. A hashed IP identifier is used to limit repeated submissions. Please do not send passwords, medical information or details of a live incident through the form; contact us first to arrange a secure channel.
We do not make decisions about people solely by automated means that have legal or similarly significant effects.
How long we keep information
- Enquiries that do not lead to work: normally up to 12 months after our last contact.
- Client and contract administration records: normally for the engagement and six years afterwards, where needed for legal, tax or contractual purposes.
- Testing and project data: for the period agreed with the client, then securely deleted or returned in line with the engagement terms.
- Website server logs: according to the hosting provider's schedule, normally no longer than 90 days. Form rate-limit entries stop being used after one hour and are removed when temporary server storage is cleared.
We may retain particular records longer where a legal obligation or dispute requires it. We review and securely dispose of information when it is no longer needed.
Your rights
Depending on the circumstances, you can ask to access, correct, erase or restrict the use of your personal data, or to receive it in a portable format. You can object to processing based on legitimate interests. Where we rely on consent, you can withdraw it at any time.
To make a request, email hello@smartsec.co.uk. We may need to verify your identity before responding. These rights have legal limits, and we will explain if an exception applies.
Questions and complaints
If you have a question or concern about how we handle information, contact hello@smartsec.co.uk. You can also complain to the Information Commissioner's Office.
We will update this page when our practices change. The date above shows the latest version.