Privacy Policy — Open Data Security

Controller identity: Open Data Security is a product and trading brand of Itson Group Ltd (Company Number NI718987). For the purposes of UK data protection law, Itson Group Ltd is the data controller for personal data collected through this website and pre-contract enquiry workflows.

Registered office: Office 517, 92 Castle Street, Belfast, BT1 1HE, Northern Ireland.

Contact for privacy matters: use the Get in Touch form and mark your request as a privacy query.

1. Scope of This Policy

This policy explains how we collect, use, store, disclose, and protect personal data when you use the Open Data Security website, submit an enquiry, communicate with us about services, products, research initiatives, or otherwise interact with us in a professional capacity. It applies to website users, business contacts, potential clients, client representatives, suppliers, and professional counterparties.

2. Categories of Personal Data We Process

Depending on your interaction with us, we may process the following categories of personal data:

Identity and contact data: name, business email, telephone number, job role, and organisation details.
Enquiry data: service interest, project context, timeline, and message content submitted via our contact workflows.
Commercial interest data: areas of interest selected or stated in contact workflows (for example service pathway, ODS Labs briefing, or product discussion context).
Technical usage data: IP address, browser metadata, request timing, basic session and security logs generated during website access.
Communication records: correspondence history and operational notes relevant to service scoping or account management.
Contract and billing data: where services are engaged, commercial and legal contact details required to administer the relationship.

3. Purposes and Lawful Bases

We process personal data only where we have a lawful basis under UK GDPR. Typical legal bases are:

Legitimate interests: responding to business enquiries, operating and securing our website, preventing abuse, and maintaining service quality.
Contract: preparing for, entering into, and performing service agreements with clients and suppliers.
Legal obligation: compliance with regulatory, accounting, tax, fraud-prevention, and legal process requirements.
Consent: where required by law for a specific activity (for example, optional communications), with the right to withdraw at any time.

4. How We Collect Personal Data

Data is collected directly from you (for example, contact forms and email communication), automatically through website interactions (security/session logs), and from professional third parties where relevant to service delivery (for example, authorised client stakeholders).

5. Use of Data in Security Service Contexts

Where we provide offensive security services, data handling is contract-led and scope-specific. Engagement information, findings, and communication records are processed strictly for authorised service delivery, reporting, quality assurance, and legal compliance. We do not use client-sensitive engagement data for unrelated purposes.

For ODS Labs and product-related enquiries, personal data is used only to manage legitimate pre-contract discussion, product or research briefings, and related follow-up communication.

6. Disclosure of Personal Data

We may share personal data only where necessary with:

internal personnel and authorised contractors on a least-privilege basis;
trusted service providers supporting hosting, communications, and operational infrastructure;
professional advisers (legal, accounting, insurance) where required;
regulators, law enforcement, courts, or public authorities where legally required.

We do not sell personal data.

7. International Transfers

Where data is transferred outside the UK, we implement appropriate safeguards such as adequacy mechanisms, contractual protections, and proportionate technical controls, consistent with UK GDPR requirements.

8. Security Measures

We apply technical and organisational controls proportionate to risk, including access control, logging, authentication controls, encrypted transport where appropriate, environment hardening, and restricted operational handling. No transmission or storage environment is risk-free, but we review and update controls continuously.

9. Data Retention

We keep personal data only as long as required for the purpose collected, including follow-up, contractual administration, legal/regulatory requirements, dispute resolution, and record-keeping. Retention periods vary by data type and legal context; when no longer required, data is deleted or anonymised.

10. Your Rights

Subject to law, you may have rights to access, rectify, erase, restrict, object, and request portability of your personal data. You may also request details of our processing and recipients of your data. To exercise your rights, submit a request via our Get in Touch form and include "Data Rights Request" in your message.

11. Complaints and Supervisory Authority

If you believe your data has been handled unlawfully, please contact us first so we can investigate and resolve the issue quickly. You also have the right to complain to the UK Information Commissioner's Office (ICO): ico.org.uk.

12. Policy Updates

We may update this policy to reflect legal, regulatory, or operational changes. The latest version is always published on this page with the effective date shown above.