Privacy Policy

1. About this policy

The Boring CISO (the "Site") is operated by Ekya Konnect Limited, a company registered in England and Wales under company number 15769563. For the purposes of UK data protection law, Ekya Konnect Limited is the "controller" of any personal data processed through the Site.

This policy explains what personal data we process, why, and what rights you have. The Site is a free publication. You do not need an account to read it, and we deliberately keep our data collection to a minimum.

2. Changes to this policy

We may update this policy from time to time, for example if we add a feature that changes how data is handled (such as a newsletter or contact form). When we do, we will update the version number and effective date above. Please check back periodically.

3. What we collect, and what we don't

We do not ask you to create an account, we do not run any advertising, we do not carry out cross-site or behavioural tracking, and we do not operate a contact form. We do offer an optional email newsletter, delivered for us by a third-party provider (see section 7), and you share data with it only if you choose to subscribe. In normal use, the personal data we process is limited to the following:

• Server-log information. Like every website, our hosting provider automatically records standard technical information when your browser requests a page: your IP address, browser type and version, the pages you request, and the date and time of each request. This is used to operate and secure the Site.
• Correspondence. If you email us, we process your email address and the contents of your message so that we can read and respond to it.
• Newsletter subscription. If you choose to subscribe to our newsletter, you provide your email address, and your name if you enter it. Your details are handled by our newsletter provider (see section 7), and you can unsubscribe at any time using the link in every email we send.

We do not knowingly collect any special-category data (such as health, biometric, or political data) and we ask that you do not send us any.

4. Cookies and tracking

The Site sets no cookies. We use Cloudflare Web Analytics to count page views. It is a privacy-preserving tool: it stores nothing on your device and reads nothing from it, it uses no fingerprinting, and it does not build a profile of you across sites or over time. Because nothing is stored on or read from your device unless you deliberately start a video (see below), there is no cookie banner on the Site.

We run no advertising, and no third-party tracking scripts beyond the video player described next. Our fonts are self-hosted rather than loaded from a third-party network.

Some articles include a companion video. Where they do, we embed the player from youtube-nocookie.com, Google's privacy-enhanced mode. No cookies are set when the article loads. If you press play, YouTube receives your IP address and may store playback information on your device, under Google's own privacy policy, which we do not control. You never have to press it: every article is complete as written, and the video only covers ground the text already covers.

Our newsletter signup form is served from this Site and loads no third-party scripts. When you submit it, your email address is sent directly to our newsletter provider (see section 7) to complete your subscription. The form itself sets no cookies on this Site. Our provider processes your email under its own privacy policy, which we do not control.

5. Lawful bases for processing

Under the UK GDPR, we rely on the following lawful bases:

• Legitimate interests: to operate, maintain, and secure the Site (server logs), and to respond to you when you get in touch. We have considered your rights and interests and consider this processing proportionate and expected.
• Consent: where you subscribe to our newsletter, we process your email address, and your name if you provide it, on the basis of your consent. You can withdraw that consent at any time by unsubscribing.
• Legal obligation: where we are required to retain or disclose information to comply with the law.

6. How we use your data

We use the limited data described above only to:

• deliver the Site's pages to your browser and keep it running reliably;
• protect the Site against misuse, abuse, and security threats;
• respond to any query or message you send us; and
• comply with our legal and regulatory obligations.

7. Sharing and third parties

We do not sell your personal data. We share data only in these limited ways:

• Hosting provider. Our hosting provider processes server-log information on our behalf in order to serve the Site.
• Email provider. Our email provider processes the contents of messages you send us, and our replies, so that we can receive and respond to correspondence.
• Newsletter provider. If you subscribe to our newsletter, your email address, and your name if you provide it, are processed by our newsletter provider, which stores your details and delivers our emails on our behalf. You can unsubscribe at any time.
• Sponsors and affiliate links. Some Content may be sponsored, and some links may be affiliate links. If you click through to a third-party site, that site processes your data under its own privacy policy, which we do not control. We do not receive personal data about you from affiliate clicks beyond aggregate reporting.
• Legal and regulatory disclosure. We may disclose information where required by law, or to a regulator, law-enforcement body, or court.

8. International transfers

Our hosting provider and any linked third-party services may process data outside the United Kingdom. Where personal data is transferred outside the UK, we (or the relevant provider) rely on an appropriate safeguard recognised under UK data protection law, such as a UK adequacy regulation or the International Data Transfer Agreement / standard contractual clauses.

9. Data retention

We keep personal data only for as long as necessary. Server logs are retained by our hosting provider for a limited period for security and operational purposes. Correspondence is kept for as long as needed to handle your query and for a reasonable period afterwards, and then deleted, unless we are required to keep it longer to meet a legal obligation.

10. Your rights

Under the UK GDPR, you have the right to:

• request access to the personal data we hold about you;
• ask us to correct inaccurate or incomplete data;
• ask us to erase your data in certain circumstances;
• ask us to restrict how we process your data;
• object to processing based on our legitimate interests;
• request portability of data you have provided to us; and
• withdraw any consent you have given, at any time.

To exercise any of these rights, contact us at contact@theboringciso.com.

11. Children's privacy

The Site is intended for security professionals and other adults. It is not directed at children, and we do not knowingly collect personal data from anyone under the age of 13. If you believe a child has provided us with personal data, please contact us and we will delete it.

12. Security

We take reasonable technical and organisational measures to protect personal data. Because the Site is served as static pages with no user accounts, databases, or payment processing, its attack surface is small by design. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

13. Complaints

If you have a concern about how we handle your personal data, please contact us first at contact@theboringciso.com so we can try to resolve it. You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority, at ico.org.uk.

14. Contact

Privacy questions and requests can be sent to contact@theboringciso.com.

Ekya Konnect Limited
Registered in England and Wales, company number 15769563
Registered office: The Granary, Hermitage Court, Hermitage Lane, Maidstone, ME16 9NT, United Kingdom