In short: we collect only what we need to run your audit and reply to you. We never sell personal data. You can ask to see, correct or delete what we hold at any time. The detail is below.
1. Who we are
Unavoidably Secure is a trading name of Unavoidable Studio Ltd, a company registered in England and Wales (company number 17367981). Our registered office is 152 Osmondthorpe Lane, Leeds, LS9 9EG.
We are the controller of the personal data described in this notice. If you have a question about your data, email support@unavoidablysecure.com or call 07749 941111.
2. What we collect
When you request a free audit. Your name, your organisation's name and your email address, plus your phone number, website and any notes if you choose to give them. We also record the date and time of the request and the IP address it came from, so we can spot misuse of the form. When you submit the form we run our instant email security check on your website's domain (see below) and include the result in our confirmation to you. Your request is saved in our customer records system, Unavoidable CRM, so Andrew and the team can follow it up.
When you use the free email security check. You type in a website or email domain. We look up that domain's public DNS records (SPF, DKIM, DMARC and mail servers) and show you the result. We keep a log of the domain checked, the time and the overall result, which tells us nothing about you personally. To stop the tool being misused, we keep a scrambled (hashed) form of your IP address for up to one hour. The check never connects to your website or systems.
When you book a call. Calls are booked through our booking page on unavoidablecrm.com, which is run by Unavoidable CRM, also part of Unavoidable Studio Ltd. You give your name, contact details and the time you choose.
When you email or phone us. Whatever you choose to tell us, and our replies.
When we carry out an audit.
- The free external audit looks only at information anyone on the internet can see about your organisation's website and email set-up, such as DNS records, certificates, and the pages and cookies your website serves. It can pick up personal data your organisation has published, such as staff names or email addresses on your website.
- In a paid audit you may give us policies, records and evidence, including evidence produced by your IT provider. These can contain personal data about your staff or other people. We handle that data on your behalf, as your processor, under our data processing addendum.
When you visit this website. Our web server keeps standard technical logs: IP address, browser type, the pages requested and the time. Our pages load typefaces from Google Fonts, so your browser sends your IP address to Google when a page loads.
Analytics, only if you agree. We use Google Analytics 4 to understand how many people visit, which pages they read and where they came from, so we can improve the site. It runs only after you accept analytics cookies. If you do not accept, no analytics code loads and no analytics cookies are set. When it runs, Google collects information such as the pages you view, your approximate location (country or city), your device and browser, and how you arrived. We do not use Google Analytics for advertising, we have turned off Google signals and data sharing for advertising, and we never send Google your name, email address or anything you type into our forms. We do not use advertising or social media tracking tools.
3. Why we use it, and our lawful basis
- To carry out the free audit you asked for and send you the results. Lawful basis: taking steps at your request before a contract, and our legitimate interest in responding to enquiries.
- To deliver a paid engagement. Lawful basis: performance of a contract.
- To follow up about your audit or an engagement you have with us. Lawful basis: legitimate interests. If we send you information about our services, you can opt out at any time by replying or emailing us, and we will ask for your consent first wherever the law requires it.
- To keep accounting and tax records. Lawful basis: legal obligation.
- To keep our website and systems secure and prevent misuse of our forms and the email check. Lawful basis: legitimate interests.
- To measure how our website is used (Google Analytics). Lawful basis: your consent, which you can withdraw at any time.
We do not make decisions about you by automated means alone.
4. Who we share it with
We do not sell personal data. We share it only where we need to:
- BitHoarders Ltd, our web host, which runs our servers in the UK and stores our website and the records of form submissions.
- Postmark, run by ActiveCampaign, LLC in the United States, which delivers the emails our booking form sends.
- Unavoidable CRM, part of Unavoidable Studio Ltd, which holds our records of audit requests and enquiries, and runs our call booking page.
- Google (Google Ireland Limited and Google LLC), which provides the typefaces on this site and, only if you accept analytics cookies, Google Analytics.
- The providers of the email and office software we use to read and reply to your messages.
- Your IT provider, or anyone else, only when you ask us to.
- A CREST-registered penetration testing partner, only if you ask us to introduce you, and only with your agreement.
- Our professional advisers, such as our accountant, solicitor and insurer, under a duty of confidentiality.
- The police, a regulator or a court, where the law requires it.
5. International transfers
Most of the personal data we hold stays in the UK. Postmark is based in the United States, and Google may serve fonts and process analytics data outside the UK. Where personal data leaves the UK, we rely on a lawful safeguard, such as the UK-US data bridge for certified organisations or the UK International Data Transfer Agreement.
6. How long we keep it
- Free audit requests and enquiries that do not become paid work: 24 months from our last contact, then deleted.
- Audit reports and supporting evidence: 7 years from the end of the engagement, so we can answer questions about our work and deal with any claim.
- Accounting and invoice records: 6 years, as HMRC requires.
- Website server logs: a short period for security purposes, normally no more than 90 days.
- Email security check log (domain, time and result, no personal details): 12 months. The hashed IP address used to prevent misuse: up to one hour.
- Google Analytics data: 14 months, then deleted automatically by Google.
7. Your rights
Under UK data protection law you can ask us, free of charge:
- for a copy of the personal data we hold about you;
- to correct anything that is wrong;
- to delete your data where we no longer have a good reason to keep it;
- to restrict how we use it in certain circumstances;
- for a copy in a portable format;
- to stop using it where we rely on our legitimate interests, including for any service information we send you;
- to withdraw your consent, where consent is our lawful basis.
Email support@unavoidablysecure.com and we will reply within one month. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.
8. Cookies
This website does not need cookies to work, and we do not use advertising or social media tracking cookies.
If you accept analytics cookies, Google Analytics sets these:
- _ga: tells one visitor from another. Expires after 13 months.
- _ga_<ID>: keeps track of your current visit. Expires after 13 months.
They are not set unless you accept, and you can change your mind at any time by clearing cookies for this site in your browser, after which we will ask again. Our booking page on unavoidablecrm.com has its own privacy notice.
9. How we protect it
Every page on this site is served over HTTPS, and browsers are told never to connect without it. Records of form submissions are stored outside the public part of our web server, and the keys our systems use to talk to each other are kept there too, never in the website's public files. Access to personal data is limited to the people who need it for your audit, and reports are sent only to the people you name.
10. Children
Our services are for organisations and are not aimed at children.
11. Changes to this notice
We will update this notice when the way we handle personal data changes. The date at the top shows when it last changed. If a change affects you significantly and we have your email address, we will tell you.
12. Contact
Email support@unavoidablysecure.com, call 07749 941111, or write to Unavoidable Studio Ltd, 152 Osmondthorpe Lane, Leeds, LS9 9EG.