How we handle your data.

Tutelis Aegis is a passive website security scanning service operated by Mat Nash. We are a UK/EU-based sole trader providing external security review services to clients across the UK, Europe, and worldwide.

If you have any questions about this policy or how your data is handled, you can contact us at hello@tutelis.co.uk.

When you submit an enquiry through our contact form, we collect the following personal data:

• Name — used to address you correctly in our communications.
• Email address — used to respond to your enquiry and send you the scan report.
• Domain to scan — the website you are asking us to review (this is not personal data, but is included as context for your request).
• Message — any additional context you choose to provide about your enquiry.
• Consent record — we record that you explicitly consented to this processing when you submitted the form.

We do not collect cookies, tracking identifiers, IP addresses (beyond what is necessary for website operation), or any browsing behaviour data.

Under Article 6(1)(a) of the UK GDPR and EU GDPR, we process your personal data based on your explicit consent. You give this consent by ticking the consent checkbox on the contact form before submitting your enquiry.

You have the right to withdraw your consent at any time (see section 8 below). If you withdraw consent, we will delete your personal data and will not process it further.

Your personal data is used exclusively for the following purposes:

• To respond to your scan enquiry and communicate with you about the scope, timeline, and delivery of the security review.
• To send you the completed scan report via email.
• To maintain a record of our business correspondence for legitimate business purposes.

We do not use your data for marketing, profiling, automated decision-making, or any purpose other than responding to your enquiry.

We do not sell, rent, or share your personal data with third parties for any purpose.

Your data is transmitted via email through our email service provider (Gmail / Google Workspace). Google is certified under the EU-US Data Privacy Framework and processes data in accordance with GDPR requirements. We have appropriate data processing agreements in place with our service providers.

We may disclose your personal data if required to do so by law or in response to a valid legal request from a regulatory authority.

We retain your personal data only for as long as is necessary to fulfil the purpose for which it was collected:

• If you proceed with a scan: your data is retained for the duration of the engagement plus 6 months for record-keeping purposes, after which it is deleted.
• If you do not proceed with a scan: your data is deleted within 6 months of your last communication.
• If you withdraw your consent: your data is deleted immediately upon receiving your withdrawal request.

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include:

• Encrypted email communication via TLS.
• Access to your data is limited to the operator (Mat Nash) only.
• All accounts are protected by strong, unique passwords and multi-factor authentication.

Under UK GDPR and EU GDPR, you have the following rights regarding your personal data:

• Right of access — you can request a copy of the personal data we hold about you.
• Right to rectification — you can ask us to correct any inaccurate or incomplete data.
• Right to erasure (right to be forgotten) — you can ask us to delete your personal data.
• Right to restrict processing — you can ask us to limit how we use your data.
• Right to data portability — you can request a copy of your data in a commonly used format.
• Right to withdraw consent — you can withdraw your consent at any time by contacting us.
• Right to object — you can object to the processing of your personal data.

To exercise any of these rights, contact us at hello@tutelis.co.uk. We will respond to your request within one month.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) in the UK, or your local data protection authority in the EU.

We may update this privacy policy from time to time. When we do, we will update the "Last updated" date at the top of this page. If we make significant changes, we will notify you by updating the notice on our website.

We encourage you to review this policy periodically to stay informed about how we are protecting your data.