Privacy notice

Who we are

This website is operated by CISO Advisory Group Limited (company number 16785256, Registered in England & Wales), which is the controller of personal data collected through it.

Questions about this notice or your data: cisoadvisorygroup@gmail.com.

What we collect, and why

Enquiries

When you use the contact form we collect your name, email address and, if you provide them, your organisation, role, areas of interest and message. We use this to respond to your enquiry and, where relevant, to discuss an engagement. Our lawful basis is our legitimate interest in responding to business enquiries and, where applicable, taking steps at your request before entering into a contract.

The tollgate diagnostic

Your diagnostic answers are processed in your browser. They are not sent to us unless you choose to email yourself a summary or follow the link to request a full assessment. To let you resume and share your result, your answers are stored in your browser’s local storage and in the part of the page address after the “#”, which browsers do not send to our servers.

If you ask us to email your summary, we collect your email address, any name and organisation you provide, and your results. We use them to send your summary and relevant follow-up. Our lawful basis is your consent, which you can withdraw at any time.

Product waitlist

If you join the CAG Agent Assurance waitlist, we collect your email address and any name, organisation, role and interests you provide, and use them to send product updates. Our lawful basis is your consent, which you can withdraw at any time.

Booking a call

Our “Book a call” links take you to Calendly, which processes your booking under its own privacy policy. We receive the details you enter there to hold the meeting.

Website hosting

Our hosting provider processes technical data such as IP addresses and request details in server logs, to deliver and secure the website. Our lawful basis is our legitimate interest in operating a secure website.

Cookies and tracking

This website sets no cookies and uses no analytics or advertising trackers. The only browser storage used is local storage to remember your diagnostic progress, which is strictly necessary for a feature you have asked to use. You can clear it at any time through your browser settings or by retaking the diagnostic.

Who we share data with

We do not sell personal data. We use the following service providers, acting on our instructions:

• Formspree — processes website form submissions and forwards them to us.
• Netlify — hosts this website.
• Google (Gmail) — stores the emails we receive and send.

Some of these providers process data outside the UK, including in the United States. Where they do, we rely on the safeguards set out in each provider’s data processing terms, such as the UK Extension to the EU–US Data Privacy Framework or the UK International Data Transfer Addendum.

How long we keep it

We keep enquiry and diagnostic correspondence for two years after our last contact with you, and waitlist details until you unsubscribe or the waitlist closes, unless a longer period is required by law or for an ongoing engagement.

Your rights

Under UK data protection law you have the right to access, correct or delete your personal data, to restrict or object to its processing, to data portability and to withdraw consent at any time. To exercise any of these rights, email cisoadvisorygroup@gmail.com. We will respond within one month.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk. We would appreciate the chance to put things right first.

Security

We apply the controls we recommend to our clients: encrypted connections, strict content security policies, least privilege access to the data we hold and no third-party scripts on this website.

Changes

We will update this notice if our practices change. The date at the top shows when it was last revised.