Who we are
This notice explains how Pragmatic Security (“we”, “us”) collects and uses personal information through pragmaticsecurity.co.uk (the “Website”). We are the data controller for that information under the UK GDPR and the Data Protection Act 2018.
Personal information means information that could identify you, such as your name, email address or IP address.
Our principles
- We collect only the minimum information reasonably needed, and keep it only for as long as it is needed.
- We never use your information for marketing or advertising, and never sell it or pass it to anyone else unless the law requires it.
- Where the law allows, we will tell you if we are ever required to disclose your information to a third party.
What we collect
Contact form. If you use our contact form, we receive your name, email address and message, and the IP address you sent it from. The form is handled by the Website’s own server, which emails your message to us through our email provider, Oracle Cloud Infrastructure Email Delivery, in the UK. The form’s spam check (ALTCHA) has your browser solve a short puzzle that our server then checks; it sets no cookies and contacts no other website.
Email. If you email us directly, we receive your email address and whatever you include in your message.
Server and security logs. The server hosting the Website automatically records technical details of each request, including your IP address, the date and time, the page requested and your browser’s user-agent. Our security software also records IP addresses associated with failed logins and blocked or suspicious requests.
The Website has no user accounts, comments, newsletters or analytics.
How we use it, and why
Enquiries are used only to respond to you and, if we go on to work together, to deliver and administer that engagement. The lawful basis is our legitimate interest in responding to enquiries, or taking steps at your request before entering into a contract.
Server and security logs are used only to keep the Website secure and working, for example to diagnose faults and to detect and block attacks. The lawful basis is our legitimate interest in operating a secure website.
Cookies and third-party services
The Website does not set cookies for visitors and uses no analytics, advertising or tracking. WordPress sets strictly necessary cookies only for administrators who log in to manage the site.
The Website loads its fonts and all other files from its own servers and nothing from other websites. Messages sent through the contact form go only to our server and on to us by email, as described above.
Sharing your information
We do not sell, rent or voluntarily share your personal information. We may disclose it only where we believe in good faith that this is reasonably necessary to act on suspected unlawful activity, to comply with legal process such as a court order, or to protect our rights or property or those of others.
How long we keep it
Enquiries are kept only for as long as needed to deal with them, or for the duration of any engagement plus any period required for legal, tax or accounting purposes. Server logs are kept for up to 90 days and security logs for a limited period, after which both are deleted automatically.
Security
We apply appropriate technical and organisational measures to protect the information we hold. No website can remove every risk, but if a breach affecting your information occurs we will notify you and the Information Commissioner’s Office where the law requires it.
Your rights
You have the right to request a copy of the personal information we hold about you, and to ask us to correct it, delete it, restrict how we use it or object to our using it. To exercise any of these rights, please get in touch using our contact page.
If you are unhappy with how we have handled your information, you can complain to the Information Commissioner’s Office at ico.org.uk, although we would appreciate the opportunity to put things right first.
Changes to this notice
We may update this notice from time to time and will revise the effective date when we do. This version is effective from 24 October 2026.