Legal
Privacy Policy
How we handle personal data collected through this website and in the course of providing security consulting services.
1. Who we are
INLD Limited("INLD", "we", "us") is the data controller for personal data described in this policy. We are a company registered in England and Wales under company number 12040493, with a registered office at Redhill Marina, Ratcliffe-on-Soar, Nottingham, England, NG11 0EB.
Questions about this policy, or any request relating to your personal data, should be sent to privacy@inld-ltd.com.
Where we process personal data on behalf of a client during a security engagement, the client is the controller and INLD acts as a processor under the terms of the engagement agreement. This policy describes our own processing as a controller.
2. What personal data we collect
Data you give us
- Enquiry data. When you submit the contact form we collect your name, company, business email address, country and the content of your message, together with the record of your consent.
- Correspondence. Emails and other communications you send us, and our replies.
- Engagement data. During a consulting engagement we hold contact details for the client personnel involved, including names, roles and business contact information.
Data collected automatically
- Server logs. Our hosting provider records IP address, request time, requested URL, HTTP status, user agent and referrer for each request. These records support service delivery, abuse prevention and security monitoring.
- Cookies. This website sets no analytics, advertising or profiling cookies. See our Cookie Policy for detail.
We do not knowingly collect special category data through this website, and we ask that you do not include it — or any credentials, secrets or production data — in an enquiry.
3. Why we process it, and on what lawful basis
| Purpose | Data | Lawful basis |
|---|---|---|
| Responding to an enquiry | Enquiry data, correspondence | Legitimate interests (responding to a request made to us) and, where you have given it, consent |
| Scoping, delivering and administering an engagement | Engagement data, correspondence | Performance of a contract, or steps taken at your request before entering one |
| Security monitoring and abuse prevention | Server logs | Legitimate interests (protecting our systems and our clients' data) |
| Meeting legal, regulatory and accounting obligations | Engagement and billing records | Legal obligation |
| Establishing, exercising or defending legal claims | Any of the above, as relevant | Legitimate interests |
We do not send marketing communications from this website and we do not build marketing profiles. If we introduce a mailing list in future it will operate on separate, explicit consent with an unsubscribe mechanism in every message.
4. Who we share it with
We do not sell personal data and we do not share it for third-party marketing. We share personal data only with:
- Infrastructure and communications providers that host this website and carry our email, acting as processors under written terms.
- Professional advisers — accountants, auditors, insurers and legal advisers — where necessary and under a duty of confidentiality.
- Authorities where we are required to disclose by law, or where disclosure is necessary to establish, exercise or defend legal claims.
5. International transfers
Our service providers may process data outside the United Kingdom. Where that happens we rely on an adequacy decision covering the destination, or on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment. Details of the safeguards applying to a specific transfer are available on request from privacy@inld-ltd.com.
6. How long we keep it
- Enquiries that do not lead to an engagement: up to 24 months from the last contact, then deleted.
- Engagement records, including reports and evidence: the period agreed in the engagement letter, normally 12 months after completion, unless a longer period is agreed in writing.
- Financial and accounting records: six years from the end of the accounting period, as required by law.
- Server logs: up to 90 days, other than records retained for the investigation of a specific security incident.
7. How we protect it
We apply the technical and organisational measures appropriate to the sensitivity of the data: encryption in transit and at rest, access on a least-privilege basis with multi-factor authentication, separation of client engagement data, logging of administrative access, supplier due diligence, and secure destruction at the end of the retention period. Assessment evidence containing client data is handled under the additional controls set out in the engagement agreement.
8. Your rights
Under the UK GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- have inaccurate data corrected;
- have data erased where we no longer have a lawful basis to keep it;
- restrict processing while an objection or accuracy question is resolved;
- receive data you provided to us in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible;
- object to processing carried out on the basis of legitimate interests;
- withdraw consent at any time, where processing is based on consent.
To exercise any of these rights, email privacy@inld-ltd.com. We respond within one month and will tell you if we need to extend that period. There is no charge unless a request is manifestly unfounded or excessive.
9. Complaints
If you are not satisfied with how we have handled your personal data you may complain to the Information Commissioner's Office, the UK supervisory authority for data protection. We would prefer the opportunity to resolve the matter first, but that preference does not affect your right to complain.
ICO registration reference: our entry in the ICO register of fee payers will be published here once confirmed. If you need it before that, request it from privacy@inld-ltd.com.
10. Changes to this policy
We update this policy when our processing changes. The date at the top of this page records the most recent revision. Material changes affecting people who have already contacted us will be communicated directly where we hold contact details for that purpose.