Privacy notice

INKASEC Ltd operates Security Questionnaire Response ("we", "us"). This notice explains what personal data we hold and how we handle it. How we process the documents you upload, including processor obligations, residency and retention, is set out in full in our Terms & DPA (clause 10). This notice is a separate document and does not form part of the Terms; where it and clause 10 differ as to our data-handling obligations to you, clause 10 prevails.

Personal data we collect

Information that could identify you, including your name, company, email address, telephone number, and IP address. The documents you upload are your business information; to the extent they contain personal data, you are the controller and we act as your processor under the Terms.

How we use your data

• To provide the service you request and deliver your results.
• To send important service information, such as confirmations, invoices and policy updates.
• To associate your email with your account for support purposes.
• To secure, operate and improve the service, including preventing misuse, fraud and abuse (for example, detecting repeated attempts to probe the service without proceeding).

Lawful bases

• Contract: to perform our obligations in providing the service to you.
• Legitimate interests: to provide quality support, and to secure, operate and improve the service, where this is not overridden by your rights.
• Legal obligation: to retain financial and transaction records as required by law.

Sharing your data

We do not sell your data. We may share personal data with sub-processors and service providers (including our cloud and payment providers), our professional advisers and auditors, and courts or authorities where required by law or to protect vital interests. Sub-processors are engaged only on terms consistent with this notice and the DPA.

International transfers and residency

Your Customer Materials are stored and processed within the EU (Ireland) region of our cloud infrastructure and do not leave the UK/EEA except where a lawful transfer mechanism is in place. We will tell you if we propose any such transfer.

Retention

• Customer Materials (your questionnaire and supporting documents) and the data we derive from them: after a job is delivered you choose whether we keep them for reuse (a rolling twelve months, renewed by continued use, with two-factor authentication required on your account) or remove them; if you make no choice they are deleted within 30 days of completion, and we delete them immediately on request. Full detail is in the Terms & DPA (clause 10.6).
• Account and transaction records: retained for as long as your account is active, and financial records for the period required by law.
• Operational and security logs and abuse-prevention signals (which may include IP addresses): retained to secure the service and prevent misuse, for up to 90 days, then deleted automatically.
• Enquiries you send us through the contact form: kept for up to 12 months so we can respond and follow up on your enquiry, then deleted automatically.

Your rights

You have the right to be informed, to access your data, to rectification, to erasure (where applicable), to restrict or object to processing, to data portability, and to opt out of direct marketing. To exercise any of these, contact us using the details below.

Cookies

We do not use analytics or tracking cookies on this site.

Security

We maintain appropriate technical and organisational measures to protect your data, including encryption and access restricted to authorised personnel on a need-to-know basis. We require third parties who process data on our behalf to apply equivalent safeguards.

Contact and complaints

To exercise your rights or ask a question, email info@inkasec.co.uk. We are registered with the Information Commissioner's Office (registration ZA284049). If you are unhappy with how we handle your data you may complain to the ICO: helpline 0303 123 1113, ico.org.uk, Wycliffe House, Water Lane, Wilmslow, SK9 5AF.