Legal
Privacy policy
How BastionWolf collects, uses and retains the information you send through this website.
Template notice. This policy is a working draft written for a business contact website. Items marked Review require real company details or legal review before publication. Have it checked by a qualified adviser for your jurisdiction.
Who we are
BastionWolf provides secure software development and offensive security services. This policy explains what information this website collects and how it is handled.
ReviewInsert the registered company name, registered address and, where applicable, the data protection contact or representative.
Information we collect
We collect only the information you choose to send us through the contact form: your name, business email address, company, optional phone number, the service you are interested in, the project or assessment type, your message and your preferred contact method.
The IP address of the submitting device is recorded alongside the message. It is used solely to detect and limit automated abuse of the form.
This website does not use advertising or analytics cookies. A session cookie and a CSRF token cookie are set to keep the contact form secure and functioning.
How we use your information
To respond to your enquiry, scope the work you have asked about and communicate with you about a potential or active engagement.
To maintain records of business enquiries and to protect the website from automated abuse.
We do not sell your information, and we do not use it for unrelated marketing.
Legal basis
Where the UK GDPR or EU GDPR applies, we rely on legitimate interests (responding to business enquiries and securing our systems) and, where you have given it, your consent.
ReviewConfirm the applicable legal bases and jurisdictions with legal counsel before publishing.
Retention
Contact form submissions are retained for as long as needed to respond and to keep a record of business enquiries, after which they are deleted.
ReviewSet a specific retention period (for example 24 months) that matches your internal policy.
Sharing and processors
Information submitted through this site may be processed by our hosting and email providers acting on our instructions.
ReviewList the hosting provider, email provider and any other processors, along with the countries in which data is processed.
Your rights
Depending on where you live, you may have the right to request access to, correction of, or deletion of the information we hold about you, and to object to or restrict certain processing.
To exercise these rights, contact us using the details on the contact page.
Engagement data
Information gathered during a security assessment is governed by the engagement contract and any accompanying non-disclosure agreement, not by this website policy. Assessment evidence is stored securely, access is limited to the engagement team, and it is returned or destroyed according to the contract.
Security of this website
This site enforces HTTPS, sets a restrictive content security policy, protects forms with CSRF tokens and validates all submitted input on the server.
If you believe you have found a security issue affecting our systems, please follow the responsible disclosure guidance on our security page.
Changes to this policy
We may update this policy as our services or obligations change. The date of the most recent revision is shown at the top of this page.
Contact
Questions about this policy, or requests relating to information we hold about you, can be sent through our contact page or by email to [email protected].
ReviewAdd the registered company name, registered address, and the supervisory authority a complaint can be made to in your jurisdiction.