Privacy Policy
Last updated: 17 September 2026
Secure Select Ltd ("we", "us") is the controller of the personal data described here. We are registered with the Information Commissioner’s Office, registration number ZC077967. You can reach us at [email protected], by phone on 029 2271 0714, or by post at 4th Floor, 14 Museum Place, City Centre, Cardiff CF10 3BH.
Data we collect
When you use our website or contact us, we may collect your name, email address, company name, phone number, message content, and your responses to our online security assessment. Where you complete the security assessment we also record a one-way hash of your IP address and your browser’s user agent string, which we use to detect abuse of the form.
We do not collect data from your SecureCore appliance. That product is in development, and it is designed so that security data stays on your premises.
If you consent to analytics cookies, we also collect usage data through Google Analytics 4: pages viewed, approximate location derived from your IP address, referring site, and general device and browser information. This is not used to identify you, and it is never collected before you agree. See our cookie policy for the detail and to change your choice at any time.
Why we use it, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Reply to an enquiry and quote for work | Legitimate interests: we cannot run a consultancy without answering the people who contact us, and you would expect a reply to a message you sent |
| Deliver a service you have engaged us for, and invoice for it | Performance of a contract |
| Produce and email your free security check report | Legitimate interests, on the basis that you asked for the report |
| Record an interest in SecureCore or Compliance Autopilot and tell you when they launch | Consent |
| Send marketing email about our services | Consent, or the soft opt-in under PECR where you are an existing client |
| Analytics | Consent |
| Protect the site from abuse and keep accounting records | Legitimate interests, and legal obligation for the accounting records |
Where we rely on legitimate interests we have considered whether our interest is overridden by your rights, and concluded it is not, because the processing is what you would expect from contacting a business and is limited to what that requires. You can ask us for the detail of that assessment, and you can object to it at any time.
We never sell your data, and we do not share it with data brokers.
Who we share it with
We use the following providers to run the business. Each processes personal data only on our written instructions, under contract, and none of them may use it for their own purposes.
| Provider | What it does for us | Where |
|---|---|---|
| Vercel | Hosts this website and its server logs | UK and EU, with US parent |
| Supabase | Database holding security check submissions | EU |
| Resend | Delivers the emails we send you and the notifications we send ourselves | US |
| HubSpot | Our CRM. Enquiries and security check results are recorded here so we can follow them up | EU and US |
| Upstash | Rate limiting, to stop the forms being abused | EU |
| Cloudflare | Public DNS resolver, queried by the free security check to look up the domain you enter | Global |
| Analytics, only if you consent | US and global |
Where a provider processes data outside the UK, we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or on UK adequacy where it applies. We will also disclose data where the law requires it, and to our accountants and insurers where necessary.
One thing worth stating plainly about the free security check: it looks up public records for the domain you enter, using a public DNS resolver and requests to that domain’s own public servers. It reads only information that is already published. Please do not enter a domain you have no connection with.
How long we keep it
| What | How long |
|---|---|
| Enquiry correspondence that does not become work | 24 months from your last contact with us |
| Free security check submissions | 12 months |
| Registered interest in a product | Until it launches or you ask us to remove you, whichever comes first |
| Client records and the work we did | 6 years after the engagement ends, which is the limitation period for contract claims and the period HMRC requires for accounting records |
| Analytics | 14 months |
Do you have to give us your data
No statute requires you to. If you ask us to quote for or deliver a service we need enough information to do it, and without that we cannot help you. Everything else, including analytics and registering interest in a product, is optional and nothing is withheld if you decline.
Automated processing
The free security check scores your answers automatically to produce your report, and that score helps us decide how quickly to follow up. It is not a decision that produces legal or similarly significant effects, and a person reads every enquiry before we act on it. We do not carry out automated decision-making of the kind described in Article 22 of the UK GDPR, and we do not profile you for advertising.
Your rights
Under the UK GDPR you have the right to:
- ask what we hold about you and get a copy of it
- have anything inaccurate corrected
- have it erased, where we have no continuing reason to keep it
- restrict what we do with it while a question about it is resolved
- object to processing we carry out on the basis of legitimate interests, including profiling, and to object to direct marketing at any time, which we will always honour
- receive the data you gave us in a portable format, where we hold it on the basis of consent or a contract
- withdraw consent at any time, as easily as you gave it. Withdrawing does not affect the lawfulness of anything we did before you withdrew
Email [email protected] to exercise any of these. We will respond within one month. There is no charge.
If you are unhappy with how we have handled your data, please tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk, or on 0303 123 1113.