Privacy policy

Who we are

This website is operated by Sutherland Cyber Ltd, a company registered in England and Wales (Company No. 17249876). Sutherland Cyber Ltd is the data controller for personal data collected through this site. You can contact us about anything in this policy at kyle@sutherlandcyber.co.uk.

What data we collect and why

Contact form enquiries

When you send an enquiry through the contact form we collect your name, email address, your message, and optionally your business name and phone number if you provide them. We also record basic technical information sent by your browser (such as the browser type) to help identify spam.

This data is used solely to reply to your enquiry and, if you become a client, to set up our work together. The lawful basis is our legitimate interest in responding to business enquiries you have chosen to send us. Your enquiry details are never sold or shared for marketing. We only add you to our mailing list if you actively choose to, as explained below.

Website security check

When you use our free website security check, we send your domain to our server, which reads the publicly visible security settings of that website and its public DNS records. We store the result so we can show it to you and, if you ask us to, email it to you. If you enter your email address to receive the report, we store your email address, the domain you checked, and the resulting grade so we can send the report and follow up if you would like help fixing any issues. The lawful basis is our legitimate interest in offering and improving this service, and consent where you have asked us to email you. You can ask us to delete this data at any time.

Chat assistant

Every page offers a chat assistant. It is automated, it says so, and it is not a person: it answers questions about our services from a fixed description of what we offer, and points you at the contact form when a person is needed. Nothing is sent anywhere until you type a message, and nothing at all is stored on your device - the conversation exists only in your browser while the page is open, and is gone when you close or reload it. We do not keep chat transcripts. The lawful basis for processing the messages you send is our legitimate interest in answering questions from people who have chosen to ask them.

Replies are generated by an AI model. Your messages go to our own server, which passes them to OpenRouter, a US company that routes them to an AI model host to generate the reply. We instruct OpenRouter to use only hosts that do not keep messages or use them to train AI models, and message logging is switched off on our account, so your conversation is processed to answer you and not retained. This involves a transfer outside the UK, covered by the safeguards described below. Even so, please treat chat as you would any message to a business: do not send passwords, card details or anything else sensitive - the assistant will never ask for personal details, and anything that matters belongs in the contact form or an email.

Marketing emails

The contact form includes an optional tick box to receive occasional marketing updates and cyber security insights. We only add your email address to our mailing list if you choose to tick that box, so it is entirely opt-in and never a condition of getting a quote. The lawful basis is your consent. We use Resend to store the mailing list and send these emails. Every message includes an unsubscribe link, and you can opt out at any time through that link or by emailing us. Unsubscribing does not affect how we deal with any enquiry you have already sent.

Data we do not collect

This site does not run advertising, does not use tracking or analytics cookies, and does not profile visitors. See the cookie policy for the full position on cookies (in short: browsing this site stores nothing on your device, chat included).

Who we share data with

We use a small number of service providers to run this site:

• Resend (email delivery and mailing list): contact form submissions are delivered to us by email through Resend, which processes the content of your enquiry for that purpose. If you opt in to marketing emails, Resend also stores your email address as part of our mailing list and delivers those emails.
• Cloudflare(hosting and content delivery): the site is served from Cloudflare's global network, which processes standard server logs (such as IP addresses) to operate and secure the service.
• OpenRouter (the chat assistant): messages you send in chat are passed to OpenRouter, which routes them to an AI model host to generate the reply. We instruct OpenRouter to use only hosts that do not keep messages or use them to train AI models, and message logging is off on our account. The chat itself runs on our own server, so only the message content reaches OpenRouter.

Where a provider processes data outside the UK, transfers are protected by recognised safeguards such as the UK International Data Transfer Agreement or Addendum, or an adequacy decision.

Where your data is held

Your website is served from Cloudflare's global network, so visitors are served from the data centre nearest them. Form submissions are handled by our email provider in the EU. Chat conversations are not stored anywhere: they exist only in your browser while the page is open. All of it sits within UK and EU data protection law.

How long we keep data

Enquiry emails are kept for as long as needed to deal with your enquiry and for a reasonable period afterwards (normally no more than 24 months), unless you become a client, in which case relevant information is kept for the duration of our engagement and as required for legal and accounting purposes.

If you have opted in to marketing emails, we keep your email address on the mailing list until you unsubscribe, after which it is removed.

Your rights

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• ask us to correct inaccurate data;
• ask us to delete your data;
• object to or restrict our processing of your data;
• receive a copy of data you provided in a portable format.

To exercise any of these rights, email kyle@sutherlandcyber.co.uk. We will respond within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.

Changes to this policy

If this policy changes, the new version will be published on this page with an updated date at the top.