Legal
Privacy Policy
This policy explains what personal information Cyber Auctoritas collects, why, and what you can do about it. It covers this website, our program store at payhip.com/CyberAuctoritas, our email list, and our assessment and advisory services. We collect as little as we can, we do not sell personal information, and we do not use it to profile you.
Who we are
Cyber Auctoritas is an independent cybersecurity practice. For the purposes of data protection law we are the controller of the personal information described here. You can reach us about privacy through our contact form.
What we collect, and why
This website
The site sets no cookies and loads nothing from other companies. It has no forms. If you book a scoping call, you book it on EveryExpert, which handles the booking under its own privacy policy; we receive your name, email and anything you tell us, and use them only to hold the call and follow up on it. Our hosting provider, Cloudflare, processes standard request data, including IP addresses, to deliver the site and protect it from attack.
The program store
Our store runs on Payhip. When you buy or download a product, Payhip collects your email address and, for paid products, payment and tax information. Payments are processed by Payhip's payment providers; we never see your full card details. We receive your email address, what you bought and your country, and use them to deliver your purchase, support you, honour your licence and keep the records tax law requires. Payhip's own handling of your information is described in its privacy policy.
Our email list
If you download a free assessment or subscribe, we may send you useful notes about running a security program and, occasionally, our products. In the European Union and the United Kingdom we only do this with your consent. Every email has a one-click unsubscribe link, and we honour it promptly. Our list is held by Payhip.
Assessments and advisory
When we work with your organization, we hold the contact details of the people we work with and the documents and interview notes you share for the engagement. We use them only to deliver the work and keep them confidential. We never ask for passwords, access to your systems, or live customer data. The AtlasSec platform is in development; this policy will be updated to cover it before anyone can sign in.
Our legal bases
Where data protection law requires a legal basis, we rely on: performing a contract (delivering purchases and services); our legitimate interests (replying to enquiries, securing our services, keeping records); legal obligations (tax and accounting); and your consent (marketing email, where the law requires it). You can withdraw consent at any time.
Who we share it with
We share personal information only with the service providers that run our business on our behalf, under contract: Payhip and its payment providers, EveryExpert for bookings, and Cloudflare, which hosts this website. We may disclose information if the law requires it or to protect our rights. We do not sell or rent personal information, and we do not share it for cross-context behavioural advertising.
International transfers
Some of our providers process information outside your country. Where the law requires it, we rely on recognised safeguards such as the European Commission's standard contractual clauses.
How long we keep it
Enquiries: two years after our last contact. Engagement records: as set out in the engagement agreement, and otherwise three years after the work ends. Purchase and tax records: as long as tax law requires, typically seven years. Email list: until you unsubscribe.
How we protect it
We apply the same discipline we sell: access limited to people who need it, multi-factor authentication, encryption in transit and for sensitive records at rest, and logged access. No system is perfectly secure, and if a breach affects your information we will tell you as the law requires.
Your rights
Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict how we use it, and to withdraw consent. California residents have the right to know, delete and correct, and not to be discriminated against for using these rights. To use any of them, contact us as above. We will verify your request and respond within the time the law allows. You may also complain to your data protection authority.
Children
Our services are for organizations and are not directed to children under 16. We do not knowingly collect their information.
Changes
We will post any change here with a new date, and tell you directly if a change is significant.