This notice covers this website, cmsinfosec.com, and the email you send us through the addresses published on it.
It does not cover our products. Cyber Made Simple and CMS SecureMe each process personal data in ways this site does not, and each has its own privacy notice. Those are the documents that govern your data when you use a product, and they are linked from the legal index.
Who we are
CMS InfoSec Ltd is the controller for the personal data described in this notice. We are registered in England & Wales and operate from the United Kingdom.
Privacy questions and requests: privacy@cmsinfosec.com. General enquiries: hello@cmsinfosec.com.
What this website collects
Nothing that identifies you, by design.
This site is a set of static files served from a content delivery network. It sets no cookies, runs no analytics, embeds no third-party fonts, scripts, pixels or trackers, and has no forms. There is no account to create and nothing to log in to.
We took the trouble to self-host the two fonts this site uses rather than linking them from a font service, because a linked stylesheet would send your IP address to a third party before you had agreed to anything.
What our hosting provider records
Our host, Microsoft Azure Static Web Apps, records ordinary server request logs in order to serve the site and to protect it from abuse. These include IP address, timestamp, the page requested, and the user-agent string your browser sends. We do not use these logs to build a profile of you, we do not combine them with anything else, and we do not have a mechanism to identify an individual from them.
Lawful basis: our legitimate interest in operating a working, available website and defending it against attack.
When you email us
If you write to one of the addresses on this site, we process your email address, your name if you give it, and whatever you choose to put in the message. We use it to answer you.
Lawful basis: our legitimate interest in responding to people who contact us, or performance of a contract where you are already a customer.
We keep correspondence for as long as it is useful for the matter it concerns and for our own records, and no longer than three years after the last message in a thread. Some subjects need longer, such as a legal claim or a security report we are still acting on.
Email reaches us through Microsoft 365, which stores and processes it on our instructions.
Who we share data with
We do not sell personal data and we do not share it for anyone else’s marketing.
For this website, the recipients are:
| Recipient | What they receive | Why |
|---|---|---|
| Microsoft Azure (Static Web Apps) | Request logs, including IP address | Hosting and delivering this site |
| Microsoft 365 | Email you send us | Receiving and storing correspondence |
We may also disclose information where we are required to by law, or where it is necessary to establish, exercise or defend a legal claim.
International transfers
We aim to keep data in the UK or the European Economic Area. Where a provider processes data outside the UK, we rely on the UK International Data Transfer Addendum to the European Commission’s standard contractual clauses, or on UK adequacy regulations where they apply.
Your rights
Under the UK GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have data erased in certain circumstances;
- restrict or object to our processing, including any processing based on legitimate interests;
- receive data you gave us in a portable format; and
- complain to the Information Commissioner’s Office.
To exercise any of these, write to privacy@cmsinfosec.com. We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive.
You can complain to the Information Commissioner’s Office at ico.org.uk, by phone on 0303 123 1113, or in writing at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. We would rather you raised it with us first, but you do not have to.
Security
We report vulnerabilities in our own products the way we would want ours reported to us. If you find a security problem in this site or any of our products, write to security@cmsinfosec.com.
Changes
If this notice changes substantively we will change the “Last updated” date shown at the top of this page in the same revision. That date moves when the wording moves, and not otherwise.