Privacy notice
This notice explains what happens to information you share with CISO Peak through this website. It is written to be read, not to be survived.
The short version
- The site asks for information in two places: the contact form, and the optional send-the-picture step on the needs check.
- The needs check itself runs in your browser. Those answers are not sent anywhere unless you choose to send the picture.
- What you send is used to reply to you, to scope the work you asked about, and - for needs-check replies - to see which gaps keep coming up. Nothing else.
- It is never sold, rented, or shared for advertising.
- The site sets no cookies and runs no advertising or social tracking scripts.
What is collected
Contact form. Your name, work email address, the message you write, what prompted the enquiry, and optionally a rough company size. You choose what to include - please do not put sensitive details about a live security incident into a web form. If something is urgent, say so briefly and we will move to a secure channel.
Needs check. Five questions about what is in front of you, who owns security, which basic controls are already true, what is hardest, and what would help. You may also leave an optional note. The picture you see is computed in your browser from those answers. Nothing from the check is transmitted until you use “Send the picture” and include a name and work email - at which point the answers, the computed picture, and optionally a company size are sent the same way as a contact-form enquiry. Please do not put incident details, passwords, or customer data into the optional note.
Server logs. The hosting provider records standard technical information for every request: IP address, timestamp, page requested, browser user agent. This is ordinary web server operation and is used for security and troubleshooting.
Analytics. This site runs no analytics. There is no tracking script, no advertising pixel, and no cookie banner - because there are no cookies to consent to. Visitor numbers are not measured at all beyond the hosting provider's own server logs.
Why it is used
To respond to your enquiry, to prepare a scope and quote if you want one, and to keep a record of our correspondence. Needs-check replies are also read in aggregate so I can see which gaps owners keep naming - that is how the check stays useful, not a profile of you. If we work together, engagement information is handled under the terms of the agreement we sign, which takes precedence over this notice for that work.
Who else sees it
Two parties, both of them ordinary infrastructure. The hosting provider serves these pages and keeps the server logs described above. The email provider that receives [email protected] holds your message once it arrives.
The contact form and the needs-check send step do not currently pass through a third-party form service. Submitting either composes a message in your own email client, addressed to me - so what you write goes from your mail provider to mine, and nowhere else. If that ever changes, this section will name the service before it goes live.
Beyond those service providers, your information is not shared with anyone unless you ask, or unless the law requires it.
How long it is kept
Enquiries that do not lead to an engagement are deleted after twelve months. Records connected to a signed engagement are kept for as long as that agreement, and the tax and insurance obligations attached to it, require - and then they are deleted too. Nothing is kept indefinitely on the theory that it might be useful one day.
Your choices
You can ask what information is held about you, ask for it to be corrected, or ask for it to be deleted. Depending on where you live you may also have the right to object to processing, to request a copy in portable form, or to complain to a data protection authority.
Where you live may give you those rights by statute rather than by my choosing - the UK and EU GDPR, and California's CCPA and CPRA, all do. Those rights apply in addition to everything above, including the right to complain to your local supervisory authority. You do not need to cite a law to ask; an email is enough.
Security
The site is served over HTTPS. Contact-form and needs-check submissions travel encrypted in transit. Access to the mailbox that receives them is protected with multi-factor authentication. No system is perfect, which is rather the point of this business - if you spot a problem with this site, please tell me.
What this notice does not cover
The public website is separate from the practice’s signed-in workspace (the practice desk). That workspace is not linked from this site, is not in the sitemap, and is not used to collect visitor enquiries. Client records kept there are handled under the engagement agreement, not this notice.
Contact
Questions about this notice, or a request about your information, go to [email protected].
For data protection purposes the controller is CISO Peak, reachable at the address above. A postal address and registered entity details are available on request, and appear on every engagement agreement and invoice.
Back to the site