Who we are
Kurosec is the trading name of Haroon Mahmood, an independent information security consultant. Haroon Mahmood is responsible for deciding why and how the personal information described here is used. In data protection terms, he is the controller. In this notice, “we” and “us” mean Haroon Mahmood trading as Kurosec.
For privacy questions or requests, contact Haroon at info@kurosec.io.
Personal information handled on a client’s behalf during consultancy work is covered by the relevant engagement and data-processing arrangements.
What we use, and why
When you browse
Our hosting provider, Vercel, processes technical information such as your IP address, browser details, requested pages and request times. This supports delivery of the website, fault diagnosis and protection against misuse.
Our legal basis is our legitimate interest in operating a reliable, secure website.
When you get in touch
We use your name, email address, business details and the information you send to answer your enquiry, discuss potential work and manage our business relationship. You provide this directly, or a colleague may introduce you.
Our legal basis is our legitimate interest in responding to business enquiries and managing business contacts. If you personally ask us for a quotation or engage us as an individual, our legal basis is taking steps you request before entering into a contract, or performing that contract.
When you book a call
Cal.com collects your name, email address, appointment time, time zone and any information you choose to add. We use these details to arrange the call, send meeting information and follow up on your enquiry. Our legal basis is our legitimate interest in organising and responding to business enquiries.
You choose whether to contact us or book. We need enough contact information to reply or arrange the appointment. Please keep initial messages brief and avoid sending passwords, sensitive personal information or confidential client material.
Enquiring or booking does not sign you up to a marketing mailing list. We do not sell personal information or use these enquiries for automated decisions with legal or similarly significant effects.
Who helps us provide the service
We use Vercel to host the website and Cal.com to manage appointments. Email, calendar and meeting providers process the information needed to deliver correspondence, invitations and calls. A booking can be added to the calendar used for that appointment; it does not give visitors access to our other calendar entries.
Cal.com processes booking information for us and also handles some information for its own service administration and security. Provider privacy information explains those activities:
These services operate internationally, so information may be processed outside the UK, including in the United States. Their privacy information describes their transfer arrangements, including applicable adequacy frameworks and contractual safeguards. Contact us for details about transfers relevant to your information.
We may also share relevant information with professional advisers or authorities where needed for advice, legal claims or a legal obligation. We limit this to what is needed for that purpose. Where the law requires this, our basis is legal obligation. Otherwise, it is our legitimate interest in obtaining advice and protecting our legal rights.
Cookies and the booking calendar
We do not add advertising pixels or visitor analytics scripts to the main website. Fonts and website assets are served from our own site.
Opening the booking page loads Cal.com’s embedded calendar automatically. Your browser connects to Cal.com and its supporting services even if you do not complete a booking. They receive technical request information and can use cookies or browser storage for security and booking functions, as well as service diagnostics.
You can manage cookies and site storage in your browser, although blocking them may affect the calendar. You can always email us instead. If you follow links to other websites, their own privacy information applies.
How long we keep information
We keep enquiry and booking information while responding, arranging the call and completing relevant follow-up. If a business relationship follows, relevant correspondence becomes part of that relationship’s records.
Retention then depends on whether the information is still needed for agreed work, an outstanding question or complaint, or a specific legal or record-keeping requirement. We remove information when those reasons no longer apply. Information needed to establish or defend a legal claim may need to be kept longer.
Technical logs and backup copies follow the relevant provider’s retention and deletion processes. Contact us if you would like to know what we hold about you or ask for it to be deleted.
Your rights and choices
You can ask for access to your personal information and for inaccurate information to be corrected. Depending on the circumstances, you can also ask for deletion, restricted use or a portable copy. These rights have legal limits; we will explain if one applies.
You can object to processing based on our legitimate interests. Tell us about your situation so we can consider your request.
If we ask for consent for a separate use, you can withdraw it at any time without affecting the lawfulness of earlier use. Send requests to info@kurosec.io. We normally respond within one month and will explain any permitted extension or information needed to verify your identity.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator. You do not have to contact us first, although we welcome the chance to help.
Keeping this notice up to date
We update this notice when the way we handle information changes. The date above shows the latest revision. If a change materially affects how we use information you have already provided, we will bring it to your attention where appropriate.