Privacy Policy
The short version
- This website sets no cookies, uses no analytics or advertising trackers, and loads no third-party resources.
- We collect personal data only when you choose to send us an enquiry.
- Enquiry details are used to respond to you and for nothing else. They are deleted automatically after 90 days.
- We do not sell or share your data for advertising.
- You can ask us to show, correct, or delete your data at any time: info@hackstrut.com.
- 1. Who we are
- 2. What we collect
- 3. What we do not collect
- 4. How and why we use it
- 5. How long we keep it
- 6. Who processes it
- 7. International transfers
- 8. How we protect it
- 9. Your rights
- 10. Children
- 11. Links to other sites
- 12. Changes to this policy
- 13. Contact
1. Who we are
This policy explains how Hackstrut (“Hackstrut”, “we”, “us”) handles personal data collected through the website at www.hackstrut.com. Hackstrut decides why and how that data is used, which makes it the data controller (or the equivalent role under your local law) for the website.
Our postal address is Hackstrut, 8457 Reformatory Way, Lorton, VA 22079, USA. You can reach us at info@hackstrut.com.
This policy covers the website only. Data handled within Hackstrut products or services is governed by the agreement between Hackstrut and the customer concerned.
2. What we collect
Enquiries you send us
When you submit the enquiry form, we collect what you enter:
| Data | Required | Why we need it |
|---|---|---|
| Full name | Yes | To address our reply |
| Work email address | Yes | To reply to you |
| Company | Yes | To understand the context of your enquiry |
| Area of interest | Yes | To route your enquiry to the right person |
| Message | No | To answer what you asked |
| Consent record | Yes | The fact that you agreed to be contacted, the version of the consent wording and of this policy, and the time you submitted |
Please do not include passwords, credentials, or sensitive details about your systems, or special categories of personal data, in the message field. We do not need them to respond.
If the form says that enquiries are not open yet, nothing you type is sent or stored.
Technical data needed to deliver the site
Like every website, ours cannot be delivered without your device’s IP address and basic request details such as browser type and the page requested. Our hosting and infrastructure providers process this data to serve pages, keep the service secure, and limit abuse. We do not combine it with enquiry details, and we do not use it to identify or profile you.
The service that receives enquiries keeps operational logs for 14 days. Those logs are written without the content of your enquiry or your contact details.
3. What we do not collect
- No cookies. The website does not set cookies and does not store anything in your browser’s local storage. That is why you see no cookie banner.
- No analytics or advertising trackers. We do not run analytics scripts, tracking pixels, session recording, or fingerprinting.
- No third-party resources. Fonts, scripts, and styles are served from our own domain, so visiting the site does not send your IP address to other companies’ font or script servers.
- No automated decisions. We do not use your data for profiling or for decisions made without human involvement.
The form contains one hidden field that people never see. It exists only to detect automated spam; submissions that fill it in are discarded without being stored.
4. How and why we use it
| Purpose | Data | Legal basis (where one is required) |
|---|---|---|
| Responding to your enquiry and any follow-up conversation you ask for | Enquiry details | Your consent, given by ticking the box on the form. Where you ask about buying our services, also taking steps at your request before entering into a contract. |
| Keeping a record that you consented | Consent record | Our legal obligation to be able to demonstrate consent |
| Delivering the site, protecting it, and preventing spam and abuse | Technical data | Our legitimate interest in running a secure, reliable website |
We do not use enquiry details for marketing lists or newsletters. If we ever want to send you marketing, we will ask you separately first.
5. How long we keep it
- Enquiries: 90 days from the day you submit, after which the record is deleted automatically. Automatic deletion normally completes within a few days of that date.
- Backups: our database keeps recovery backups for up to 35 days. A deleted enquiry can therefore persist in backups for up to 35 days before it is gone for good. Backups are used only to recover from failures.
- Operational logs: 14 days.
- Ongoing conversations: if your enquiry turns into a continuing business relationship, the correspondence is kept for as long as that relationship needs, under the terms we agree with you.
You can ask us to delete your enquiry sooner. See Your rights.
6. Who processes it
We do not sell personal data, and we do not share it for advertising. Enquiry details are seen only by the Hackstrut staff who need them to respond.
We use Amazon Web Services (AWS) as our cloud infrastructure provider to receive and store enquiries. AWS acts on our instructions as a processor and is bound by a data processing agreement. Our website hosting provider also processes the technical data described above in order to deliver pages.
We may disclose personal data if the law requires it, or if it is necessary to establish, exercise, or defend legal claims. If Hackstrut is involved in a merger, acquisition, or sale of assets, enquiry data may transfer to the successor, which will remain bound by this policy.
7. International transfers
Our providers may process data in countries other than the one you live in. Where the law requires it, for example for data from the European Economic Area, the United Kingdom, or Switzerland, we rely on a recognised transfer mechanism such as an adequacy decision or standard contractual clauses.
8. How we protect it
- The website and the enquiry service are available only over encrypted connections (HTTPS).
- Stored enquiries are encrypted at rest.
- The service that receives enquiries can only add new records. It cannot read, change, or delete existing ones.
- Access to stored enquiries is limited to the staff who need it.
- Every submission is validated on the server, only the fields listed above are stored, and requests are rate limited.
No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authority as the law requires.
9. Your rights
Depending on where you live, you have some or all of these rights over your personal data:
- to know whether we hold data about you and to receive a copy of it;
- to have inaccurate data corrected;
- to have your data deleted;
- to withdraw your consent at any time, which does not affect what we did before you withdrew it;
- to restrict or object to how we use your data;
- to receive your data in a portable format;
- to complain to your data protection authority.
To use any of these rights, email info@hackstrut.com from the address you used in your enquiry, or tell us that address so we can find your record. We do not charge for requests, we will not treat you differently for making one, and we aim to respond within 30 days. We may need to confirm your identity before acting.
Region-specific notes
- European Economic Area, United Kingdom, Switzerland: the rights above are provided under the GDPR, the UK GDPR, and the Swiss FADP. You can complain to the supervisory authority where you live or work.
- California and other US states: we do not sell personal information and do not share it for cross-context behavioural advertising. You have the rights to know, correct, and delete, and the right not to be discriminated against for using them.
- India: under the Digital Personal Data Protection Act, 2023 you may access, correct, and erase your data, withdraw consent, and raise a grievance with us at the address below. If we do not resolve it, you may escalate to the Data Protection Board of India.
10. Children
This website is intended for people acting in a professional capacity. It is not directed at children, and we do not knowingly collect their data. If you believe a child has sent us personal data, contact us and we will delete it.
11. Links to other sites
The website links to resources published by other organisations, such as OWASP and NIST. Those sites have their own privacy practices, which this policy does not cover.
12. Changes to this policy
If we change how we handle personal data, we will update this page and change the effective date and version at the top. If a change materially affects data we already hold about you, we will tell you before it takes effect where we are able to.
13. Contact
Privacy questions, requests, and grievances: info@hackstrut.com.
By post: Hackstrut, 8457 Reformatory Way, Lorton, VA 22079, USA.