Privacy policy.

01Information we collect

• Contact form data — your name, email, company, optional contact details, selected service and the request you submit.
• Assessment delivery data — your email address, optional organization name, selected readiness states, report-request identity, delivery consent, optional follow-up preference and delivery status when you request an emailed PDF. Assessment Studio requests also include the selected track and questionnaire/schema versions.
• Correspondence — the content and routing metadata of emails or messages you send.
• Session attribution — the first landing path, bounded source and UTM campaign fields, a referrer without query parameters, and the current form path. These values are kept in browser session storage and accompany only a form or assessment request you choose to submit.
• Service metadata — hosting and email providers may process ordinary request, security and delivery logs under their own service terms.

Local assessment mode — unsent assessment answers and the optional organization name stay in the current page memory. They are not automatically saved to browser storage or submitted to the reporting service. Local JSON downloads and print/save-PDF actions happen on your device when you choose them; keep resulting files private. Normal hosting requests still occur, and session attribution is separate from assessment-answer storage.

Security workbench and programme planner — non-sensitive draft fields and imported JSON are processed in the current page, without automatic storage, email or upload. Import only a draft you trust and inspect it before use. Exporting JSON, CSV or a printable record creates a file on your device; sharing that file is your decision. These tools do not collect evidence or connect to a system.

A separate local preference records dismissal of the cookie notice; it contains no assessment answers and can be cleared through browser settings.

We do not use advertising trackers, analytics cookies, fingerprinting or third-party advertising pixels in this implementation. Session attribution expires with the browser session; it is not a cross-site behavioural profile.

02How we use it

We use this information to:

• Respond to and triage the request you initiated.
• Generate and ask the email provider to deliver an assessment PDF when you explicitly request it.
• Contact you about a scoped evidence review when you select the separate optional follow-up choice on an assessment form.
• Understand which professional content or campaign produced a genuine request.
• Protect the forms from abuse and troubleshoot delivery.
• Prepare scoping and contractual records if an engagement proceeds.

03Legal basis

Where GDPR or equivalent regulations apply, the relevant basis may include consent for the assessment report you request and any separately selected assessment follow-up, legitimate interests in responding to and securing a business request you initiated, and steps toward or performance of a contract where an engagement proceeds.

04Data processors and routing

Netlify hosts the website, processes contact forms and runs the assessment function. Resend processes requested assessment-report email delivery. Operational notifications and assessment copies are currently routed to the founder's Gmail / Google inbox as recorded in the active configuration. Zoho Mail hosts the public @abzsecure.com business mailboxes; ordinary Zoho alias mail is a separate route and is not represented as automatic Gmail forwarding. Providers process data under their own terms and security commitments.

05How we protect it

• Forms use HTTPS in normal production operation; do not submit passwords, secrets, regulated records or sensitive production evidence.
• Assessment requests are validated server-side and subject to application and hosting-layer rate limits.
• Access to request data is limited to the accounts used to operate the service.
• Client evidence handling, access channels and retention must be agreed in writing before an engagement begins.

06Retention

Form, email and delivery records remain subject to the configured retention of Netlify, Resend, Gmail/Google and Zoho, and may be retained for correspondence, security, contractual or legal needs. ABZSECURE reviews and deletes records when they are no longer reasonably needed. Engagement-specific retention must be agreed in the relevant contract.

07Your rights

Depending on your jurisdiction, you may have the right to access, correct, export or delete personal data, and to object to or restrict processing. To make a request, email contact@abzsecure.com. Identity verification may be required before account records are disclosed or changed.

08Changes to this policy

We may update this notice to reflect changes in practice, providers or law. The last-updated date above identifies the current published version.

09Contact

Questions about privacy or your data: contact@abzsecure.com.