Privacy notice.

AURMAK Cyber is the cyber and information security practice of AURMAK. For the purposes of UK data protection law, AURMAK is the controller of the personal data described in this notice.

We operate from the United Kingdom and the United Arab Emirates. Contact details are on the contact page, and our security disclosure address is in security.txt.

Through the enquiry form: your name, work email address, organisation name, an approximate headcount band, the reason you selected for getting in touch, and anything you choose to write in the optional message field.

Through the eight questions: nothing that identifies you, unless you choose to give us an email address at the end. Your answers are held in your browser while you complete it. We record anonymous counts of which questions people cannot answer, which cannot be traced back to an individual or an organisation.

Through analytics, and only after you consent: pages viewed, approximate location at country level, device type and referring source. We do not use advertising trackers, we do not build profiles, and we do not share this with data brokers.

We deliberately do not collect more than the above. Where a field is not necessary to reply to you, it is not on the form.

Enquiry data is processed to respond to you and, where it leads to work, to scope and deliver an engagement. The lawful basis is our legitimate interest in responding to a business enquiry you initiated, and where an engagement follows, the performance of a contract.

Analytics data is processed on the basis of your consent, which you give through the cookie banner and can withdraw at any time from any page.

Enquiries that do not lead to an engagement are deleted twelve months after the last contact.

Where an engagement follows, client information is held for the period agreed in the engagement letter. A retention period and a deletion date are agreed in writing at the start rather than left open, and when the date arrives the material is deleted and you are told it has been.

Analytics data is retained for fourteen months.

Enquiry data is accessible only to the people who need it in order to reply to you or deliver your engagement. Access is least privilege and multi-factor authentication is enforced.

We use a small number of processors for hosting, email and calendar booking. We do not sell personal data, we do not share it for advertising, and we do not pass it to any third party for their own purposes.

Delivery, engineering and assurance work is carried out from the United Kingdom and the United Arab Emirates, so your data may be accessed from either country under appropriate safeguards. Where a client has data residency or personnel requirements that restrict this, we agree the arrangement at scoping and record it in the engagement letter.

Encrypted in transit and at rest, held in access-controlled systems, with multi-factor authentication enforced for everyone who can reach it and no client information on personal devices.

Our full position, including how we manage conflicts of interest and how to report a security issue to us, is on the trust page.

You can ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, object to our processing of it, or ask us to restrict that processing. Where processing is based on consent, you can withdraw consent at any time.

Ask through the contact page and we will respond within one month. If you are not satisfied with how we have handled it, you can complain to the Information Commissioner’s Office in the UK, or to the relevant supervisory authority in your jurisdiction.