Privacy Notice

1. Data Controller

Cyphertech Consultancy Services
Colorado Springs, CO, United States
Email: privacy@cyphertechconsultancyservices.com
Phone: +1 (786) 772-6740

We are the data controller responsible for your personal data. This means we determine how and why your data is processed.

2. Legal Basis for Processing

We process your personal data based on the following legal grounds under GDPR:

• Consent: When you explicitly agree to provide your information (e.g., job applications, contact forms)
• Contract: To fulfill our contractual obligations when providing services to you
• Legitimate Interest: To improve our services, prevent fraud, and maintain security
• Legal Obligation: To comply with applicable laws and regulations

3. Data Collection and Use

CypherTech Consultancy Services collects only the personal data necessary to respond to inquiries and provide requested services. This may include your name, email address, phone number, organization details, and any information you voluntarily submit through our forms.

4. What We Collect

• Email address: Required for account creation and communication
• Full name: Optional, for personalization
• Phone number: Optional, stored with your consent (including country code in E.164 format)
• Company information: For business accounts
• Message history: Your submissions and communications with us
• File attachments: Documents you choose to upload (e.g., resumes, CVs)
• Authentication data: Encrypted passwords, session tokens
• Technical data: Browser type, device information (collected by our hosting provider)

5. Infrastructure Data Collection

Our website is hosted on Vercel, a third-party cloud platform. As part of standard web hosting operations, the following technical data may be temporarily logged by our hosting provider:

• IP addresses: Temporarily logged for security, abuse prevention, and performance optimization
• Request timestamps: For infrastructure monitoring
• HTTP headers: User agent and referer information
• Performance metrics: Page load times and resource usage

Important: We do not actively collect or store IP addresses for tracking, profiling, or marketing purposes. This data is processed by our hosting provider and is subject to their privacy policy. We do not directly access or use this data for user profiling or behavioral analysis.

We do NOT collect:

• Behavioral tracking or analytics cookies
• Third-party advertising cookies
• Cross-site tracking identifiers
• Sensitive data (racial/ethnic origin, political opinions, religious beliefs, health data, biometric data)

6. Data Retention

We retain your personal data only as long as necessary for the purposes outlined in this policy:

• Account data: Retained while your account is active and for 90 days after deletion (for recovery)
• Job applications: Retained for 2 years after application submission for recruitment records
• Contact form submissions: Retained for 1 year for customer service purposes
• Email communications: Retained as long as necessary for business continuity
• File uploads: Retained until you delete your account or request removal
• Legal obligations: Some data may be retained longer to comply with legal, accounting, or regulatory requirements

When you delete your account, all associated data is permanently removed from our systems within 90 days, except where we are legally required to retain it.

7. Your Rights Under GDPR

Under the General Data Protection Regulation (GDPR), you have the following rights regarding your personal data:

• Right to access: Request a copy of all personal data we hold about you
• Right to rectification: Update or correct inaccurate or incomplete information
• Right to erasure ("right to be forgotten"): Request complete deletion of your personal data
• Right to data portability: Receive your data in a structured, commonly used format (JSON/CSV)
• Right to restrict processing: Limit how we use your data in certain circumstances
• Right to object: Object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent: Withdraw your consent at any time where processing is based on consent
• Right not to be subject to automated decision-making: We do not use automated decision-making or profiling

You may exercise these rights at any time through your account profile or by contacting us at privacy@cyphertechconsultancyservices.com. We will respond to your request within 30 days.

8. Third-Party Service Providers

We use the following third-party service providers to process your data:

• Supabase (PostgreSQL & Storage): Database and file storage hosting (Data Processing Agreement in place)
• Vercel: Website hosting and deployment
• Gmail API / Resend: Email delivery services

All third-party processors are GDPR-compliant and have appropriate data processing agreements in place. They only process your data on our instructions and for the purposes described in this policy.

9. International Data Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States. When we transfer data internationally, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data Processing Agreements with all processors
• Adherence to the EU-U.S. Data Privacy Framework principles

All data transfers comply with GDPR requirements to ensure your data receives the same level of protection as within the EU.

10. Cookies and Tracking

We use minimal cookies for essential website functionality:

• Authentication cookies: To keep you logged in (strictly necessary)
• Session cookies: For security and session management (strictly necessary)

We do not use analytics, advertising, or third-party tracking cookies. You can control cookies through your browser settings, but disabling strictly necessary cookies may affect website functionality.

11. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

• Encryption of data in transit (HTTPS/TLS) and at rest
• Secure password hashing using industry-standard algorithms
• Role-based access controls and Row Level Security (RLS)
• Regular security assessments and updates
• Limited data access on a need-to-know basis

While we strive to protect your data, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.

12. Data Breach Notification

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours of becoming aware
• Notify affected individuals without undue delay if the breach poses a high risk
• Provide details about the nature of the breach and measures taken
• Offer recommendations to mitigate potential adverse effects

13. Children's Privacy

Our services are not intended for individuals under the age of 16. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately, and we will delete such information.

14. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority if you believe we have processed your personal data unlawfully or violated your rights under GDPR.

EU Data Protection Authorities:
You can find your local data protection authority at: https://edpb.europa.eu/about-edpb/about-edpb/members_en

We encourage you to contact us first so we can address your concerns directly.

15. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. For significant changes, we will provide additional notice (such as email notification). Your continued use of our services after changes constitutes acceptance of the updated policy.

16. Contact Us

If you have any questions about this privacy notice or wish to exercise your data rights, please contact us: