Privacy Policy

Who we are

Secvura Limited is registered in England and Wales, company number 17292680, registered office 167-169 Great Portland Street, Fifth Floor, London W1W 5PF. We are the data controller for the personal data described in this policy. You can contact us about your data at privacy@secvura.com.

What this policy covers

This policy explains how we handle personal data collected through this website, mainly the enquiry form, and personal data we hold about people we contact about our services. Personal data we process while delivering a security review for a client is governed separately by the engagement contract and data processing agreement we put in place with that client.

What we collect

When you submit the enquiry form we collect your first name, last name, job title, company name, email address, and anything you choose to add in the optional message field. To help protect the form against spam and abuse, we also collect and store, as part of that enquiry record, your IP address and your browser's user-agent string, and your IP address is included in the notification email we receive about your enquiry. Our hosting provider additionally processes limited technical information such as your IP address and request details as part of serving the website.

Where we contact you about our services and you have not contacted us first, we hold your name, job title, employer, work email address, a link to your public professional profile, and publicly reported information about your company such as funding announcements or news coverage. We obtain this from publicly available sources, including company websites, professional networking sites, Companies House and published news, and from business contact databases. If you would like to know the specific source for your record, email us and we will tell you.

How we use it and our lawful basis

We use the details you provide through the enquiry form to respond to your enquiry, arrange a scoping call, and follow up about the services you asked about. Our lawful basis is our legitimate interest in replying to and following up on business enquiries, and, where relevant, taking steps at your request before entering into a contract. We do not use enquiry details to send marketing without your separate consent.

Where we contact you about our services and you have not contacted us first, we use your details to send a small number of individually written business emails. Our lawful basis is our legitimate interest in reaching organisations that may need our services, weighed against your own interests and rights. We write only to people in business roles at registered companies, at their work address, about matters relevant to their job.

We have carried out a legitimate interests assessment for this processing. Email privacy@secvura.com if you would like a summary of it.

How long we keep it

We keep enquiry details, including the IP address and user-agent information described above, for up to 24 months from your last contact with us, after which we delete them, unless you become a client, in which case we keep the engagement records described in our engagement terms for six years, and then delete them.

If we have contacted you about our services and you do not reply, we keep your details for up to 12 months and then delete them. If you ask us to stop, we keep your name, employer and email address on a suppression list for as long as we send business emails, so that we do not contact you again by mistake.

Who we share it with

We do not sell your data. We share it only with service providers that help us run our website and communicate with you, acting on our instructions under a data processing agreement. Our providers change from time to time and we keep this list current:

• Vercel, website hosting, delivery, and cookieless analytics and performance monitoring
• Supabase, database storage of website enquiries
• Resend, delivery of enquiry emails to us and of the acknowledgement email we send back to you
• Google (Google Workspace), sending, receiving and storing email
• Upstash, rate limiting on our website forms, which involves short-lived processing of information derived from your IP address

Some tools we use to find business contact details are independent data controllers rather than our service providers. We obtain information from them; we do not share your information with them.

We may also disclose data where we are legally required to.

Personal data in our clients' systems

When we carry out a security review for a client, we may be given access to systems that hold personal data belonging to that client's own users. We are a processor for that data, not a controller. We act only on the client's written instructions under a separate data processing agreement, we avoid access to live personal data wherever practicable by using test accounts and non-production data, and the client's own privacy notice applies to those individuals rather than this one.

Where your data is processed

Some of these providers are based outside the United Kingdom, including in the United States, so your data may be processed outside the UK. Where it is, we rely on appropriate safeguards recognised under UK data protection law, such as the UK International Data Transfer Agreement or the UK addendum to the standard contractual clauses.

How we protect it

We take appropriate technical and organisational measures to protect personal data, including access controls and encryption where appropriate. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your data and to respond appropriately if a problem occurs.

Your rights

Under UK data protection law you have the right to access the personal data we hold about you, to ask us to correct it, to ask us to delete it, to restrict or object to our processing, and to data portability where it applies. You have the right to object to any processing we carry out on the basis of legitimate interest, including our handling of your enquiry. To exercise any of these rights, email privacy@secvura.com.

You can object at any time to us contacting you about our services, and we will stop. Reply to any email from us saying so, or email privacy@secvura.com.

Complaints

If you are unhappy with how we have handled your personal data, contact us at privacy@secvura.com and we will look into it and respond. You also have the right to complain to the supervisory authority, currently the Information Commissioner's Office, at ico.org.uk, although we would welcome the chance to address your concern first.

Cookies and analytics

This website does not set cookies. We do not use advertising or tracking cookies. To understand how the site is used and how it performs, we use privacy-friendly, cookieless tools (Vercel Web Analytics and Vercel Speed Insights) that measure aggregate, anonymous traffic and page-performance metrics. They set no cookies, do not collect personal data, and do not track you across other websites.

Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last changed.

Contact

Questions about this policy or your data can be sent to privacy@secvura.com.