Privacy Policy

The controller responsible for personal data processed in connection with this website is:

We have not appointed a Data Protection Officer. Given the scale and nature of processing described below, none is currently required under Article 37 GDPR. This policy's contact point is the email address above.

This policy covers personal data processed through ittcsec.com: the contact/enquiry form, the careers page and open applications sent by email, the interactive self-assessment tool, and website analytics. It doesn't cover personal data processed during an actual client engagement (e.g. as part of a penetration test or security assessment), which is governed by the separate contractual documents for that engagement. See Terms of Use for how website terms relate to service engagements.

All personal data described here comes directly from you: we don't buy, scrape, or combine it with data from third-party brokers or public records.

Contact and consultation enquiries. If you use the contact form, we collect your name, business email address, company name, optional phone number, company size, the service you're interested in, your preferred contact method, and the description of your security challenge. We also record which page you submitted the form from and, where present, UTM campaign parameters from the link you arrived on.

Open applications and careers. See "Recruitment and open applications" below.

Analytics. See "Analytics and cookies" below.

Technical and security logs. See "Technical and security logs" below.

The self-assessment tool. The interactive tool at /security-assessment processes your answers only in your browser's memory to produce an indicative result. Nothing you enter there is transmitted to us or stored.

Responding to your enquiry (contract/pre-contract, Art. 6(1)(b)). Contact-form data is processed to respond to your enquiry and, where it progresses, to take steps toward a service engagement at your request.

Consent (Art. 6(1)(a)). Submitting the contact form requires checking a consent box confirming you agree to be contacted about your enquiry. Analytics only run after you separately consent via the cookie banner.

Legitimate interests (Art. 6(1)(f)). We rely on legitimate interest for: preventing spam and abuse of the contact form (server-side validation and rate limiting), maintaining the security of our systems (technical logs), and understanding aggregate site usage once you've consented to analytics.

Legal obligation (Art. 6(1)(c)). Where applicable, we may process or retain limited data to comply with a legal obligation (for example, financial administration obligations tied to a client engagement, which fall outside the scope of this website-focused policy).

The careers page doesn't include an application form. An open application is sent as an email you compose and send yourself to hr@ittcsec.com. Once received, we process the contents of that email and any attached CV or profile information to evaluate your application, based on your consent (by sending it) and our legitimate interest and pre-contractual steps in considering candidates. We don't request or expect sensitive special-category data (e.g. health, religion, ethnicity) as part of an application, and ask that you don't include it.

This site uses Google Analytics 4 for aggregate usage analytics, but only after you explicitly consent via the cookie banner, and nothing analytics-related loads before that. Full details of what's used, exact retention, and how to withdraw consent at any time are in our Cookie Policy.

Like virtually any website, standard web server access logs (IP address, request timestamp, requested URL, browser user-agent) are generated by our hosting infrastructure as a routine part of serving the site and protecting it against abuse. We rely on our hosting provider's standard logging for this rather than running a separate logging system, and don't actively mine these logs for anything beyond security troubleshooting and abuse investigation.

We use a small number of processors to run this website. Each only receives the data necessary for its function:

• Supabase: database and backend infrastructure hosting contact-form submissions, hosted in the EU (Ireland).
• Resend: transactional email delivery, used to notify us by email when a new contact-form enquiry is submitted.
• Google (Google Analytics 4): aggregate website analytics, only after you consent.
• Hostinger: web hosting for the static website itself.

We don't sell personal data, and we don't share contact-form or application data with any party outside ITTCsec and the processors above.

Supabase's database for this project is hosted in the EU. Google Analytics may involve transferring data outside the European Economic Area; where it does, Google's own published data processing terms describe the safeguards it relies on (such as Standard Contractual Clauses). We have not independently audited every processor's transfer mechanism in detail, and rely on each provider's own standard contractual terms as a business customer.

We keep contact-form enquiry data for as long as needed to respond to it and for a reasonable period afterwards for our own records, after which it is deleted. We haven't fixed a specific number of months as a blanket policy: you can request earlier deletion at any time (see "Your rights" below). Open-application emails are kept for a reasonable period while a role or your candidacy remains relevant, and deleted or anonymised thereafter unless you ask us to keep them on file for future opportunities.

At a level appropriate for the data involved, without publishing details that would themselves be a security risk:

• Contact-form data is protected by database-level row security: the public website can only insert a new submission, and it cannot read, list, modify, or delete existing entries, even through the same public API.
• The site enforces HTTPS with HTTP Strict Transport Security, and sets a restrictive Content Security Policy limiting which domains can load scripts or receive data from the browser.
• Production changes go through a staged process (development, then production) rather than being edited live.

If you believe you've found a security issue with this website itself, see our Responsible Disclosure policy.

Under the GDPR (and its Dutch implementation, the AVG), you have the right to:

• Access the personal data we hold about you.
• Rectification of inaccurate or incomplete data.
• Erasure of your data, subject to any legal obligation we may have to retain it.
• Restriction of processing in certain circumstances.
• Object to processing based on legitimate interest.
• Data portability, where processing is based on consent or contract and carried out by automated means.
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal. For analytics, see the "Manage / withdraw cookie preferences" control on our Cookie Policy page.

To exercise any of these rights, contact us at info@ittcsec.com. You also have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens.

We don't use automated decision-making or profiling that produces legal or similarly significant effects on you.

This website is intended for business use by professionals acting on behalf of organisations. It isn't directed at children, and we don't knowingly collect personal data from children.

We may update this policy as our processing activities or applicable law change. The current version is always available at this URL, with the "last updated" date above reflecting the most recent substantive revision.

Questions about this policy or your data can be sent to info@ittcsec.com. Full company details are on our Company Information page.