Privacy Policy

This website is informational. Contact is by email. We do not operate an account system or on-site payment form.

Information you may send during inquiries

If you email us, we receive the content of your message, your email address, and any attachments you choose to include. Assessment inquiries may also include sector context, system descriptions, or other non-credential details you elect to share for scoping.

Please do not send passwords, credentials, full payment card numbers, or large volumes of personal files in an initial inquiry.

How we use inquiry information

• To respond to assessment, disclosure, or privacy inquiries
• To scope a potential engagement when requested
• To maintain professional records of correspondence

Assessment evidence and minimization

When an engagement involves evidence of data exposure, we apply evidence minimization and limited handling as described in our Responsible Disclosure page. We retain what is needed to support findings and verification, and we avoid unnecessary copies of personal, financial, medical, or authentication data.

We do not use client evidence as public marketing material. Public example materials on this website are sanitized and fictionalized.

Retention principles

We do not publish a single fixed calendar retention period for all materials. In practice:

• Inquiry email is kept as needed for professional correspondence and engagement records.
• Assessment evidence is retained only as long as required for the engagement, verification, or related professional obligations, then deleted or reduced under evidence-minimization practice.
• Website server logs are kept for security and operations and rotated under ordinary hosting practice.

Access, correction, and deletion

Where applicable, you may request access to, correction of, or deletion of personal information you have sent us, subject to legal or professional retention requirements. Send privacy requests to the contact below. We will respond within a reasonable time.

Website logs

Our hosting environment may record standard web server logs (for example IP address, user agent, requested URL, and timestamp) for security and operations. These logs are used for site reliability and abuse detection.

When we send professional email that includes a link to this website, we may use a short same-site path so server logs can show whether that link was fetched. Those paths do not include your email address. We do not use third-party marketing trackers or invisible open-tracking images in that mail.

Sharing

We do not sell personal information. We may share information with service providers who process email or hosting on our behalf, or when required by law.

Legal identity

Compliance Bureau is operated by Cyber Space Solutions (Registration No. 2023/283634/07). See Legal.

Privacy contact

Accountable privacy contact: desk@compliance-bureau.org (subject: Privacy).

This policy may be updated from time to time. It is not legal advice.