Your privacy and the security of your Personal Data are important to us.

This Privacy Policy explains how NORTH STAR CYBER SECURITY LTD, trading as NS Security (“NS Security”, “we”, “us” or “our”), collects, uses, stores, shares and otherwise processes Personal Data when you access or use our website, communicate with us, request information or services, or engage with us in connection with our cybersecurity, information security, risk management, compliance and advisory services.

This Privacy Policy also explains your rights under applicable data protection legislation, including, where applicable, the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018, the Data (Use and Access) Act 2025, the EU General Data Protection Regulation (EU) 2016/679 (“EU GDPR”), and the Swiss Federal Act on Data Protection (“FADP”).

For the purposes of applicable data protection legislation, the data controller is:

NORTH STAR CYBER SECURITY LTD

Company number: 17058341

Company type: Private Limited by Shares

Registered in England and Wales

Website: https://ns-security.co.uk

Email: contact@ns-security.co.uk

This Privacy Policy applies to Personal Data processed by NS Security through:

• the NS Security website;
• website contact and service-request forms;
• consultation and service enquiries;
• communications with prospective and existing clients;
• delivery of cybersecurity, information security, governance, risk and compliance services;
• business development and professional communications;
• newsletters or other marketing communications where you have requested or consented to receive them;
• interactions with our suppliers, partners, contractors and professional advisers; and
• other interactions with NS Security where this Privacy Policy is referenced.

Our principal services include, without limitation:

• Security Assessment;
• Governance and Risk;
• PCI DSS Compliance;
• Policies & Documentation;
• information security and cybersecurity consulting;
• compliance and regulatory advisory services; and
• related professional cybersecurity services.

Additional privacy terms may apply to a particular service, project, engagement or platform. Where additional terms apply, they will supplement this Privacy Policy.

Our website and services are intended for businesses and professionals and are not directed at children.

We do not knowingly solicit or intentionally collect Personal Data from children.

If we become aware that Personal Data relating to a child has been collected without an appropriate lawful basis, we will take reasonable steps to delete or otherwise appropriately handle that information.

Our website may contain links to websites, platforms or services operated by third parties.

NS Security does not control the privacy or security practices of those third parties and is not responsible for their privacy policies, content or processing activities.

We encourage you to review the privacy notice of any third-party website or service before providing Personal Data to it.

We may collect information directly from you, automatically when you use our website, from organisations with which you are associated, or from legitimate business and publicly available sources.

4.1 Personal Data You Provide to Us

Depending on your interaction with NS Security, we may collect:

• first and last name;
• business email address;
• telephone number, where provided;
• company or organisation name;
• job title or professional role;
• country or business location;
• information about the service you are interested in;
• information contained in your enquiry or message;
• correspondence between you and NS Security;
• consultation and meeting information;
• contractual and commercial information;
• billing and transaction-related information where applicable;
• information necessary to establish or manage a client relationship; and
• any other information you voluntarily provide to us.

When you use our website contact form, we may collect your First Name, Last Name, Company Name, Business Email, selected service(s), and information you provide regarding the services or matters you wish to discuss.

Please avoid submitting confidential, special-category, highly sensitive or unnecessary Personal Data through our general website contact forms.

4.2 Information Collected Automatically

Depending on your interaction with NS Security, we may collect:

• first and last name;
• business email address;
• telephone number, where provided;
• company or organisation name;
• job title or professional role;
• country or business location;
• information about the service you are interested in;
• information contained in your enquiry or message;
• correspondence between you and NS Security;
• consultation and meeting information;
• contractual and commercial information;
• billing and transaction-related information where applicable;
• information necessary to establish or manage a client relationship; and
• any other information you voluntarily provide to us.

When you use our website contact form, we may collect your First Name, Last Name, Company Name, Business Email, selected service(s), and information you provide regarding the services or matters you wish to discuss.

Please avoid submitting confidential, special-category, highly sensitive or unnecessary Personal Data through our general website contact forms.

4.3 Business and Professional Information

As a business-to-business cybersecurity consultancy, we may process professional information relating to representatives, employees, contractors and other contacts of prospective clients, clients, suppliers, partners and other organisations.

This may include your name, position, employer, professional contact information and information relating to your professional responsibilities.

4.4 Information Obtained from Other Sources

We may receive Personal Data from:

• your employer or organisation;
• colleagues or business contacts;
• professional advisers;
• business partners;
• suppliers and service providers;
• professional networking platforms;
• publicly available corporate websites;
• public registers and regulatory sources; or
• other legitimate business sources.

Where required by applicable law, we will provide appropriate information regarding such processing.

Our website may use cookies and similar technologies to operate correctly, maintain security, remember preferences, understand website usage and, where permitted, measure website performance.

Cookies may include:

Strictly Necessary Cookies

These cookies are required for essential website functionality, security, network management and operation.

Where permitted by applicable law, strictly necessary cookies may be used without consent.

Analytics and Performance Cookies

These technologies help us understand how visitors interact with our website, for example which pages are visited and how visitors navigate the website.

Where consent is required by applicable law, these technologies will not be activated until the required consent has been obtained.

Functional Cookies

These cookies may enable additional website functionality or remember preferences.

Marketing Cookies

Where we use technologies for advertising, marketing measurement or similar non-essential purposes, we will obtain consent where required by applicable law.

You may manage non-essential cookies through the cookie controls made available on our website.

Further information is provided in our Cookie Policy.

We may process Personal Data for the following purposes:

• responding to enquiries;
• arranging consultations and meetings;
• understanding your organisation’s cybersecurity, compliance or information security requirements;
• preparing proposals, statements of work and quotations;
• taking steps at your request before entering into a contract;
• entering into and administering contracts;
• delivering cybersecurity and professional advisory services;
• conducting security assessments, compliance assessments, gap analyses and related consulting engagements;
• delivering governance, risk and compliance services;
• providing PCI DSS and other compliance-related services;
• preparing security policies, procedures, documentation and related deliverables;
• communicating with clients and prospective clients;
• managing client and supplier relationships;
• providing requested information and materials;
• invoicing, accounting and payment administration;
• maintaining appropriate business and project records;
• operating, maintaining and improving our website;
• protecting our website, systems, clients and business against cybersecurity threats, fraud, misuse and unauthorised access;
• investigating security events and incidents;
• complying with legal, regulatory, tax, accounting and professional obligations;
• establishing, exercising or defending legal claims;
• managing complaints and disputes;
• protecting our legal rights and the rights of others;
• carrying out internal business administration;
• measuring and improving our services;
• conducting legitimate business development activities; and
• sending marketing communications where permitted by applicable law.

We will not use Personal Data for purposes materially incompatible with the purposes for which it was collected unless permitted or required by law.

Where the EU GDPR or UK GDPR applies, we process Personal Data only where we have an appropriate lawful basis.

Depending on the circumstances, this may include:

Contract

Processing may be necessary to perform a contract with you or to take steps at your request before entering into a contract.

This may apply when you request a consultation, request a proposal, engage NS Security or communicate with us regarding services.

Legitimate Interests

We may process Personal Data where necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms.

Our legitimate interests may include:

• operating and developing our cybersecurity consultancy;
• responding to business enquiries;
• maintaining business relationships;
• improving our services;
• protecting our systems and information;
• preventing fraud and misuse;
• maintaining network and information security;
• establishing and defending legal rights; and
• appropriate business-to-business communications.

Where required, we assess and balance our legitimate interests against the rights and interests of affected individuals.

Legal Obligation

We may process Personal Data where necessary to comply with applicable laws, regulations, court orders, regulatory requirements, tax requirements or other legal obligations.

Consent

Where processing is based on your consent, including certain electronic marketing or non-essential cookie activities, you may withdraw that consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

We distinguish between communications necessary to respond to an enquiry or provide requested services and communications sent for marketing purposes.

Submitting an enquiry or requesting information from NS Security does not automatically require you to agree to unrelated marketing communications.

Where required by applicable law, we will obtain your consent before sending marketing communications.

If you choose to receive other communications from NS Security, we may use your contact information to provide relevant information concerning our services, cybersecurity developments, regulatory developments, insights or other professional content.

You may unsubscribe from marketing communications at any time by:

• contacting us at contact@ns-security.co.uk.

Service-related and transactional communications may continue where they are necessary for an existing relationship or contract.

We do not sell or rent your personal information or email lists to third parties for marketing purposes.

We may disclose Personal Data where reasonably necessary to:

• service providers processing information on our behalf;
• hosting and cloud infrastructure providers;
• website and IT service providers;
• communications and email providers;
• CRM and business administration providers;
• payment and accounting providers;
• professional advisers, including lawyers, accountants and auditors;
• consultants and contractors assisting us in providing services;
• regulatory authorities;
• law enforcement agencies;
• courts and tribunals;
• government authorities;
• potential purchasers, investors or advisers in connection with a legitimate corporate transaction; and
• other parties where you instruct or authorise us to disclose information.

Where a service provider processes Personal Data on our behalf, we require appropriate contractual, confidentiality and data protection obligations where required by law.

Because NS Security provides cybersecurity, information security, compliance and risk-management services, clients may provide us with information necessary to perform an engagement.

Depending on the engagement, this may include information concerning systems, applications, infrastructure, personnel, access controls, security incidents, audit evidence, security configurations or business processes.

The respective roles of NS Security and the client as controller, processor or independent controller will depend on the nature of the engagement.

Where NS Security processes Personal Data on behalf of a client as a processor, such processing will be governed by the applicable contractual terms and, where required, a Data Processing Agreement (“DPA”).

We seek to apply data-minimisation principles and encourage clients not to provide Personal Data that is unnecessary for the relevant cybersecurity or compliance engagement.

Our normal website and business activities do not require the collection of special-category Personal Data.

We ask that you do not provide information concerning health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, sexual orientation or other specially protected information unless it is genuinely necessary and an appropriate legal basis exists.

Where special-category Personal Data must be processed in connection with a client engagement, we will apply the additional requirements imposed by applicable data protection legislation.

NS Security operates from the United Kingdom, European Economic Area and Switzerland and provides services to organisations including those located in the United Kingdom, European Economic Area and Switzerland.

Personal Data may therefore be transferred between these jurisdictions where necessary for legitimate business purposes or the delivery of our services.

Where Personal Data is transferred internationally, we will comply with applicable requirements concerning international transfers.

This may include relying on:

• an applicable adequacy decision or adequacy regulation;
• approved contractual safeguards;
• Standard Contractual Clauses where applicable;
• the UK International Data Transfer Agreement or UK Addendum where applicable; or
• another transfer mechanism permitted by applicable law.

Where appropriate, we may also undertake transfer risk assessments or implement supplementary technical and organisational safeguards.

If a service provider processes Personal Data outside the UK, EEA or Switzerland, we will assess and implement an appropriate transfer mechanism where required.

As a cybersecurity organisation, protecting information is fundamental to our business.

We maintain technical and organisational measures designed to protect Personal Data against:

• unauthorised access;
• accidental or unlawful destruction;
• loss;
• alteration;
• unauthorised disclosure;
• misuse; and
• other unlawful processing.

Depending on the relevant system and risk, measures may include:

• access controls;
• authentication controls;
• least-privilege principles;
• encryption;
• secure configuration;
• vulnerability management;
• logging and monitoring;
• backup and recovery controls;
• security testing;
• supplier security controls;
• incident-management procedures; and
• internal security policies and procedures.

No internet transmission or information system can be guaranteed to be completely secure. We therefore cannot guarantee absolute security, but we maintain controls proportionate to the nature and risks of the processing.

We retain Personal Data only for as long as reasonably necessary for the purposes for which it was collected and to satisfy applicable legal, regulatory, contractual, accounting, security and dispute-resolution requirements.

Retention periods may depend on:

• the nature of the information;
• the purpose for which it was collected;
• the nature and duration of our relationship with you or your organisation;
• contractual requirements;
• applicable limitation periods;
• tax and accounting requirements;
• regulatory obligations;
• security requirements; and
• the existence or likelihood of a legal dispute.

When Personal Data is no longer required, we will delete, anonymise or securely dispose of it, subject to applicable legal and technical requirements.

NS Security does not currently use Personal Data collected through the website to make solely automated decisions that produce legal effects or similarly significant effects on individuals.

If this changes, we will provide the information and safeguards required by applicable law.

Depending on where you are located and the applicable legislation, you may have rights concerning your Personal Data.

These may include the right to:

• request confirmation as to whether we process your Personal Data;
• request access to your Personal Data;
• request correction of inaccurate or incomplete Personal Data;
• request deletion of Personal Data;
• request restriction of processing;
• object to certain processing;
• object to direct marketing;
• request data portability where applicable;
• withdraw consent where processing is based on consent;
• obtain information regarding applicable international transfer safeguards;
• object to or obtain safeguards regarding certain automated decision-making where applicable; and
• lodge a complaint with an applicable supervisory authority.

These rights are not absolute and may be subject to exemptions and conditions under applicable law.

To exercise your rights, contact:

contact@ns-security.co.uk

We may request information reasonably necessary to verify your identity before responding to a request.

Depending on your location and the data protection laws applicable to the processing of your Personal Data, you may have the right to lodge a complaint with a competent data protection or supervisory authority.

This may include the relevant authority in the United Kingdom, the European Economic Area, Switzerland, or another jurisdiction whose data protection laws apply to the processing.

We encourage you to contact us first at contact@ns-security.co.uk if you have any concerns about how we process your Personal Data, so that we have an opportunity to address them.

Contacting us does not affect your right to lodge a complaint with a competent supervisory authority or to exercise any other rights available to you under applicable law.

If NS Security is involved in a merger, acquisition, restructuring, financing, sale of assets or similar corporate transaction, Personal Data may be disclosed to relevant advisers, counterparties or other parties where reasonably necessary and legally permitted.

Where appropriate, confidentiality and data protection safeguards will apply.

If Personal Data is transferred to another controller as part of such a transaction, affected individuals will be informed where required by applicable law.

We may retain, use or disclose Personal Data where reasonably necessary to:

• comply with applicable law;
• respond to lawful requests from public authorities;
• comply with court orders or legal proceedings;
• meet regulatory obligations;
• investigate fraud, cyber incidents or unlawful activity;
• protect the security of our systems;
• protect our rights, property or legitimate interests;
• protect clients, users or other persons; or
• establish, exercise or defend legal claims.

We may update this Privacy Policy periodically to reflect:

• changes to our services;
• changes to our website or technologies;
• changes to our processing activities;
• changes to applicable legislation or regulatory guidance; or
• improvements to our privacy and security practices.

The current version will be published on our website together with the date on which it was last updated.

Where a change materially affects how we process Personal Data, we will provide additional notice where required by applicable law.

If you have questions concerning this Privacy Policy, our processing of Personal Data, or wish to exercise your data protection rights, please contact:

Phone:

Email: contact@ns-security.co.uk

Postal Address: