Privacy Policy

Who we are

JSsec Ltd (company number 15774465), whose registered office is at 3rd Floor, 86-90 Paul Street, London, England, EC2A 4NE, is the controller of the personal data described in this policy ("JSsec", "we", "our", "us"). We operate our website at jssec.co.uk and jssec.com (the "Website") and the customer dashboard at dashboard.jssec.co.uk and dashboard.jssec.com (the "dashboard").

You can contact us about this policy at [email protected].

The two roles in which we handle data

This policy explains how we use personal data as a controller, for visitors to the Website, people who contact us or book a demo, users of the dashboard, and our marketing.

When we detect and act on phishing and brand abuse for a customer, we process personal data as that customer's processor, on their instructions, under the Data Processing Agreement that forms part of our Master Services Agreement. That processing is governed by the DPA, not by this policy.

What we collect

Enquiry and contact data, your name, work email, phone number, job title and company, when you contact us, book a demo, or complete a form on the Website. Website forms are submitted to our CRM (Salesforce) for follow-up.
Account and authentication data, when you access the dashboard, you sign in either with Google or with a one-time "magic link" we email to you; we receive your email address and basic profile.
Report submissions, if you use our report form, the suspect URL(s), the type of abuse, any detail you add, and your email address if you provide one.
Technical data, IP address, browser type and version, device, operating system and time-zone setting.
Usage data, pages visited, time on page and interactions with our content, collected through analytics only where you have consented.
Marketing and communications data, your preferences for receiving marketing from us.
Business contact data we obtain from public sources, the name of a business, its website and domain names, and the name, job title and work contact details of the people at that business who are responsible for security, technology or risk. See "Where we get business contact data" below.

We do not seek to collect special-category data through the Website or dashboard.

Where we get business contact data

Most of the data above you give us directly. We also compile a limited amount of business contact data that does not come from you, so that we can approach organisations we believe we can help.

We obtain it from publicly available sources, including the Companies House register, public DNS and certificate transparency records, company websites, and professional networking and business information sources. It relates to you in your professional capacity, at your employer, and not to you as a private individual.

Where we hold this data we will tell you, at the latest when we first contact you, and you can object at any time by replying to any message or emailing [email protected]. We market by email only to corporate subscribers (companies, limited liability partnerships and similar bodies). We do not send unsolicited marketing email to sole traders or unincorporated partnerships without their consent.

How we use your data, and our legal bases

Under the UK GDPR we rely on the following bases:

Responding to enquiries, providing demos, and managing our relationship with you, our legitimate interests in running and growing the business, and taking steps at your request before entering a contract.
Providing, securing and supporting the dashboard, including sign-in, performance of our contract with your organisation.
Reviewing abuse reports, our legitimate interests in detecting and disrupting phishing and brand abuse.
Analytics to understand and improve the Website, your consent, given through the cookie banner.
Marketing communications to existing business contacts, your consent, or our legitimate interests, in each case with the ability to opt out at any time.
Business-to-business marketing to organisations we have not dealt with before, our legitimate interests in promoting our services to businesses whose security posture suggests they would benefit from them. We have assessed that this does not override your rights, because we contact you in your professional capacity, about a matter relevant to your role, using work contact details, and you can stop it at any time. You have an absolute right to object to direct marketing, and we will act on it immediately.
Meeting our legal and regulatory obligations, compliance with the law.

Cookies

We use cookies and similar technologies on the Website. Analytics and advertising technologies load only after you accept them. Our Cookie Policy at jssec.co.uk/policies/cookie explains each one and how to manage your choices.

We share personal data with service providers who process it on our behalf, including:

Salesforce, CRM; stores enquiries and lead data for sales follow-up.
Stripe, payment processing for customer billing.
SendGrid, marketing email, transactional email, and the sign-in "magic link" emails.
Google, sign-in (Google) for the dashboard.
Google Analytics, website analytics (consent-gated).
Google Ads, LinkedIn, Meta and X, advertising measurement and retargeting; these load only if you accept advertising cookies.
Our hosting and infrastructure providers (including Cloudflare and CustodianDC), to run the Website and dashboard.

We require these providers to protect personal data and to use it only for the purposes we specify. We may also disclose personal data where the law requires it, or to establish, exercise or defend legal claims. We do not sell your personal data.

The sub-processors that support the customer service (as opposed to this controller processing) are listed in, and governed by, the DPA.

International transfers

We hold personal data in the United Kingdom. Where a provider processes personal data outside the UK, we rely on UK adequacy regulations or on the UK International Data Transfer Agreement (IDTA) or UK-approved standard contractual clauses.

How long we keep it

We keep personal data only for as long as we need it for the purposes set out above, or as the law requires. Indicative periods: enquiry and CRM lead data for up to 24 months after our last contact with you; business contact data obtained from public sources for up to 12 months from when we collected it, unless you respond and become an enquiry, or ask us to stop, in which case we keep only what we need to honour that request; dashboard account data for the term of your organisation's contract and up to 90 days afterwards; analytics data per our Google Analytics retention setting; marketing data until you opt out.

Your rights

Under the UK GDPR you have the right to access your personal data; to have it corrected or erased; to restrict or object to our processing; to data portability; and to withdraw consent where we rely on it. You have an absolute right to object to direct marketing at any time; if you tell us to stop, we will, and we will keep a minimal record of your details for the sole purpose of making sure we do not contact you again. Where we rely on legitimate interests you can also ask us for our assessment of them. To exercise any of these, email [email protected]. You also have the right to complain to the Information Commissioner's Office (ico.org.uk), though we would welcome the chance to resolve your concern first.

Data security

We apply appropriate technical and organisational measures to protect personal data, summarised at jssec.co.uk/security. No system can be guaranteed completely secure, but we work to protect your data and to meet our obligations if anything goes wrong.

Children

The Website and our services are provided to businesses and are not directed to children.

Changes to this policy

We may update this policy from time to time. If we make material changes we will post the updated policy on this page with a new effective date.

Contact us

JSsec Ltd
3rd Floor, 86-90 Paul Street, London, England, EC2A 4NE
Email: [email protected]

For other ways to reach us, see our Contact page at jssec.co.uk/contact.