Privacy Policy (UK GDPR & Data Protection Act 2018)
How HackGuardX Ltd collects, processes, protects, and respects personal data across our website and security platform.
- We act as a Data Controller for account, billing, and marketing interactions, and as a Data Processor for customer-authorised scan telemetry.
- Customer data is hosted in UK and European Union data centres encrypted with AES-256 at rest and TLS 1.3 in transit.
- We never sell personal data to third parties or use private source code to train external models.
1. Identity of the Data Controller & UK Regulatory Scope
This Privacy Policy explains how HackGuardX ('we', 'us', 'our') processes personal data in accordance with the United Kingdom General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
For visitors to hackguardx.com, prospective customers running a passive Exposure Check, and registered workspace administrators, HackGuardX acts as the Data Controller.
2. Categories of Personal Data We Collect
We collect only the minimum personal data required to deliver our cybersecurity services, respond to enquiries, and maintain platform security:
- •Account & Identity Data: Full name, business email address, job title, company name, and authentication metadata.
- •Passive Exposure Check Telemetry: Publicly resolvable domain names submitted for check, public DNS records, public HTTP response headers, and requester IP address (processed strictly for rate-limiting and abuse prevention).
- •Billing & Transaction Data: Billing address, VAT registration number, and payment status processed via Stripe (we never store full payment card numbers on our servers).
- •Technical & Usage Logs: Browser user-agent, timezone, UTM campaign attribution parameters, and audit logs of security scans initiated by authorised users.
3. Lawful Bases for Processing (Article 6 UK GDPR)
We rely on the following lawful bases under Article 6(1) of the UK GDPR:
- •Performance of a Contract (Art. 6(1)(b)): Delivering continuous vulnerability monitoring, cloud posture reviews, and executive reports under your selected subscription plan.
- •Legitimate Interests (Art. 6(1)(f)): Operating safe passive domain checks requested by users, preventing automated bot abuse, and securing our own infrastructure.
- •Consent (Art. 6(1)(a)): Sending optional cybersecurity threat briefings, product newsletters, and placing non-essential analytics cookies.
- •Legal Obligation (Art. 6(1)(c)): Retaining VAT invoices, tax records, and statutory compliance logs under UK law.
4. Data Retention, Sub-Processors & International Transfers
Primary platform telemetry and customer account databases are hosted in the United Kingdom and European Economic Area (EEA). Where any vetted sub-processor processes data outside the UK/EEA, we enforce the UK International Data Transfer Agreement (IDTA) or UK Addendum to EU Standard Contractual Clauses.
Passive exposure check snapshots are retained for 30 days unless linked to an active workspace. Customer workspace findings are retained for the duration of your subscription and purged within 30 days of account termination.
5. Your Rights Under UK Data Protection Law
Under the UK GDPR, you have the right to access your personal data, request rectification or erasure, restrict or object to processing, and request data portability. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.
To exercise any of your data rights, contact our privacy team at privacy@hackguardx.com.