Privacy policy

Who we are and what this policy covers

Enuvia Security LLC (“Enuvia,” “we,” or “us”) provides penetration testing services and operates enuviasecurity.com. We are responsible for deciding how the website and business inquiry information described here is used. Where applicable data protection law uses the term, we are its controller.

This policy covers website visits, inquiry forms, and related business correspondence. Information accessed or collected during a security assessment is also subject to the engagement agreement, confidentiality obligations, and any applicable data processing agreement. Where we process that information on a client’s behalf, we follow the client’s authorized instructions and applicable law.

Information we collect

• Inquiry details. Your name, business email, company, service of interest, preferred timing, and the message you submit. We also receive the information you include in follow-up correspondence.
• Technical information. Our hosting and security providers process information such as IP address, requested page, request time, browser and device details, referring page when supplied, and security or error events.
• Verification information. The contact form uses an anti-bot check that processes browser and connection signals and returns a verification result.

You can browse without submitting an inquiry. Providing contact details is voluntary, but we need enough information to respond and discuss your request. The website does not offer visitor accounts, take payments, or accept file uploads.

Please keep inquiries high level. Do not submit passwords, API keys, sensitive personal information, customer records, or confidential vulnerability evidence through the contact form. We agree an appropriate exchange method for assessment materials separately.

How we use information

We use inquiry information to respond, understand your requirements, prepare proposals, and manage the business relationship. Technical and verification information helps deliver the website, prevent spam and abuse, investigate security issues, and troubleshoot failures. We may also retain or use records to meet legal obligations or establish, exercise, or defend legal claims.

Submitting an inquiry does not subscribe you to marketing. We do not sell personal information, share it for cross-context behavioral advertising, or use advertising pixels or website analytics scripts.

Where a lawful basis is required

For ordinary business inquiries and website security, we rely on our legitimate interests in communicating with prospective clients and operating a secure website, balanced against your rights. Where you are personally entering a contract with us, we may process information to take steps you request before that contract or to perform it. We also process information when necessary to meet legal obligations. If a particular use requires consent, we ask separately; you may withdraw it without affecting earlier lawful processing.

Who receives information

We use the following providers to operate this website and deliver inquiries:

Cloudflare

Hosts and delivers the website and provides security services. It processes website traffic and technical information. Cloudflare privacy policy.

Cloudflare Turnstile

Checks whether contact-form traffic is automated. It processes signals including IP address, browser information, and connection characteristics. Cloudflare also uses these signals to improve its bot detection, acting as a controller for that purpose. Turnstile privacy addendum.

Resend

Delivers contact-form messages to our business inbox. It processes the submitted inquiry details, message content, recipient and reply-to addresses, and delivery metadata. Resend privacy policy.

Apple Business

Hosts the business mailbox that receives inquiries and privacy requests. Apple processes received message content, addresses, and related mail information under its business email service. Apple privacy policy.

Apple Business stores received messages and replies. The website does not maintain a separate database of form submissions. Hosting, email delivery, and mailbox services can retain information in their logs, delivery records, or backups.

Information may also be disclosed to professional advisers where needed, to comply with applicable law or valid legal process, or to protect rights and investigate abuse. If our business is reorganized or transferred, relevant records may pass to a successor subject to appropriate confidentiality and applicable privacy obligations. We limit disclosures to the information needed for the purpose.

Cookies and security checks

We do not use cookies for advertising or analytics. Website security services may use necessary cookies or similar technologies to recognize legitimate requests and prevent abuse. Turnstile processes technical signals even when it does not display an interactive challenge; its operation is described in the privacy addendum above.

You can restrict cookies or scripts through your browser. Some settings may prevent verification or form submission. You can use the email address below for privacy requests if the form is unavailable. We do not track your browsing across other websites for advertising.

How long we keep information

Inquiries that do not become client engagements are retained for up to six months after our last substantive communication. After that, we delete them unless a legal obligation, dispute, or documented security investigation requires particular records to be kept longer.

If an inquiry becomes an engagement, the relevant correspondence becomes part of the client record. Assessment evidence and deliverables follow the retention and deletion terms in the engagement agreement. Contract, accounting, and legal records may need to be kept for longer periods required by applicable law.

Technical and security records are retained according to the service involved, its configured retention period, and any active investigation. Providers may keep limited records for their own security or legal obligations. Copies in backups expire under the applicable backup schedule rather than being removed immediately from every backup. Contact us for information about retention affecting your data.

How we protect information

We use technical and organizational measures appropriate to the information, including access restrictions, secure transmission, and controls against abusive submissions. Access is limited to people and providers who need the information for the purposes described here. No website, email service, or storage system can guarantee absolute security.

International processing

Our providers operate internationally, so information may be processed in countries other than where you live, including the United States. Those countries may have different data protection laws.

Where applicable law requires safeguards for an international transfer, we use an applicable adequacy decision or contractual safeguards, such as approved standard contractual clauses and the relevant UK transfer mechanism, as appropriate. You can contact us for information about the safeguards that apply to your information and how to obtain a copy.

Your choices and privacy rights

Depending on applicable law, you may have rights to access or receive a copy of your information, correct inaccuracies, request deletion, restrict processing, or receive certain information in a portable format. These rights are subject to legal conditions and exceptions.

You may also have the right to object to processing based on legitimate interests, including our business inquiry and website-security activities. Tell us about your circumstances so we can consider the request.

Send requests to privacy@enuviasecurity.com. Describe your request and the email address you used to contact us. We may ask for proportionate information to verify your identity or an authorized representative’s authority. Please do not send identity documents unless we specifically request a secure verification method.

We respond within the period required by applicable law and explain if an exception prevents us from fulfilling a request. Where applicable, you may appeal a decision by replying to our response. We do not discriminate against you for exercising privacy rights.

You may complain to your relevant data protection or privacy authority. Where EU or UK data protection law applies, this includes the authority where you live or work, or where the alleged infringement occurred. UK residents can contact the Information Commissioner’s Office.

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Automated spam checks can prevent form submission.

Children, external links, and policy updates

Our website and services are intended for business users, not children. We do not knowingly collect personal information from children under 13. Contact us if you believe a child has submitted information so we can address it.

External websites have their own privacy practices. Linking to them does not make this policy apply to their services.

We may update this policy as our services or data practices change. The date above identifies the latest revision. Where a change requires additional notice or consent under applicable law, we provide that notice or obtain consent before the relevant new use.