Your privacy and the security of your Personal Data are important to us.

This Privacy Policy explains how NORTH STAR CYBER SECURITY LTD, trading as NS Security (“NS Security”, “we”, “us” or “our”), collects, uses, stores, shares and otherwise processes Personal Data when you access or use our website, communicate with us, request information or services, or engage with us in connection with our cybersecurity, information security, risk management, compliance and advisory services.

This Privacy Policy also explains your rights under applicable data protection legislation, including, where applicable, the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018, the Data (Use and Access) Act 2025, the EU General Data Protection Regulation (EU) 2016/679 (“EU GDPR”), and the Swiss Federal Act on Data Protection (“FADP”).

For the purposes of applicable data protection legislation, the data controller is:

NORTH STAR CYBER SECURITY LTD

Company number: 17058341

Company type: Private Limited by Shares

Registered in England and Wales

Registered office: [Registered Office Address]

Website: https://ns-security.co.uk/

Email: contact@ns-security.co.uk

This Privacy Policy applies to Personal Data processed by NS Security through:

• the NS Security website;
• website contact and service-request forms;
• consultation and service enquiries;
• communications with prospective and existing clients;
• delivery of cybersecurity, information security, governance, risk and compliance services;
• business development and professional communications;
• newsletters or other marketing communications where you have requested or consented to receive them;
• interactions with our suppliers, partners, contractors and professional advisers; and
• other interactions with NS Security where this Privacy Policy is referenced.

Our principal services include, without limitation:

• Security Assessment;
• Governance and Risk;
• PCI DSS Compliance;
• Policies & Documentation;
• information security and cybersecurity consulting;
• compliance and regulatory advisory services; and
• related professional cybersecurity services.

Additional privacy terms may apply to a particular service, project, engagement or platform. Where additional terms apply, they will supplement this Privacy Policy.

Our website and services are intended for businesses and professionals and are not directed at children.

We do not knowingly solicit or intentionally collect Personal Data from children.

If we become aware that Personal Data relating to a child has been collected without an appropriate lawful basis, we will take reasonable steps to delete or otherwise appropriately handle that information.

Our website may contain links to websites, platforms or services operated by third parties.

NS Security does not control the privacy or security practices of those third parties and is not responsible for their privacy policies, content or processing activities.

We encourage you to review the privacy notice of any third-party website or service before providing Personal Data to it.

We may collect information directly from you, automatically when you use our website, from organisations with which you are associated, or from legitimate business and publicly available sources.

4.1 Personal Data You Provide to Us

Depending on your interaction with NS Security, we may collect:

• first and last name;
• business email address;
• telephone number, where provided;
• company or organisation name;
• job title or professional role;
• country or business location;
• information about the service you are interested in;
• information contained in your enquiry or message;
• correspondence between you and NS Security;
• consultation and meeting information;
• contractual and commercial information;
• billing and transaction-related information where applicable;
• information necessary to establish or manage a client relationship; and
• any other information you voluntarily provide to us.

When you use our website contact form, we may collect your First Name, Last Name, Company Name, Business Email, selected service(s), and information you provide regarding the services or matters you wish to discuss.

Please avoid submitting confidential, special-category, highly sensitive or unnecessary Personal Data through our general website contact forms.

4.2 Information Collected Automatically

Depending on your interaction with NS Security, we may collect:

• first and last name;
• business email address;
• telephone number, where provided;
• company or organisation name;
• job title or professional role;
• country or business location;
• information about the service you are interested in;
• information contained in your enquiry or message;
• correspondence between you and NS Security;
• consultation and meeting information;
• contractual and commercial information;
• billing and transaction-related information where applicable;
• information necessary to establish or manage a client relationship; and
• any other information you voluntarily provide to us.

When you use our website contact form, we may collect your First Name, Last Name, Company Name, Business Email, selected service(s), and information you provide regarding the services or matters you wish to discuss.

Please avoid submitting confidential, special-category, highly sensitive or unnecessary Personal Data through our general website contact forms.

4.3 Business and Professional Information

As a business-to-business cybersecurity consultancy, we may process professional information relating to representatives, employees, contractors and other contacts of prospective clients, clients, suppliers, partners and other organisations.

This may include your name, position, employer, professional contact information and information relating to your professional responsibilities.

4.4 Information Obtained from Other Sources

We may receive Personal Data from:

• your employer or organisation;
• colleagues or business contacts;
• professional advisers;
• business partners;
• suppliers and service providers;
• professional networking platforms;
• publicly available corporate websites;
• public registers and regulatory sources; or
• other legitimate business sources.

Where required by applicable law, we will provide appropriate information regarding such processing.

Our website may use cookies and similar technologies to operate correctly, maintain security, remember preferences, understand website usage and, where permitted, measure website performance.

Cookies may include:

Strictly Necessary Cookies

These cookies are required for essential website functionality, security, network management and operation.

Where permitted by applicable law, strictly necessary cookies may be used without consent.

Analytics and Performance Cookies

These technologies help us understand how visitors interact with our website, for example which pages are visited and how visitors navigate the website.

Where consent is required by applicable law, these technologies will not be activated until the required consent has been obtained.

Functional Cookies

These cookies may enable additional website functionality or remember preferences.

Marketing Cookies

Where we use technologies for advertising, marketing measurement or similar non-essential purposes, we will obtain consent where required by applicable law.

You may manage non-essential cookies through the cookie controls made available on our website.

Further information is provided in our Cookie Policy.

We may process Personal Data for the following purposes:

• responding to enquiries;
• arranging consultations and meetings;
• understanding your organisation’s cybersecurity, compliance or information security requirements;
• preparing proposals, statements of work and quotations;
• taking steps at your request before entering into a contract;
• entering into and administering contracts;
• delivering cybersecurity and professional advisory services;
• conducting security assessments, compliance assessments, gap analyses and related consulting engagements;
• delivering governance, risk and compliance services;
• providing PCI DSS and other compliance-related services;
• preparing security policies, procedures, documentation and related deliverables;
• communicating with clients and prospective clients;
• managing client and supplier relationships;
• providing requested information and materials;
• invoicing, accounting and payment administration;
• maintaining appropriate business and project records;
• operating, maintaining and improving our website;
• protecting our website, systems, clients and business against cybersecurity threats, fraud, misuse and unauthorised access;
• investigating security events and incidents;
• complying with legal, regulatory, tax, accounting and professional obligations;
• establishing, exercising or defending legal claims;
• managing complaints and disputes;
• protecting our legal rights and the rights of others;
• carrying out internal business administration;
• measuring and improving our services;
• conducting legitimate business development activities; and
• sending marketing communications where permitted by applicable law.

We will not use Personal Data for purposes materially incompatible with the purposes for which it was collected unless permitted or required by law.

Where the EU GDPR or UK GDPR applies, we process Personal Data only where we have an appropriate lawful basis.

Depending on the circumstances, this may include:

Contract

Processing may be necessary to perform a contract with you or to take steps at your request before entering into a contract.

This may apply when you request a consultation, request a proposal, engage NS Security or communicate with us regarding services.

Legitimate Interests

We may process Personal Data where necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms.

Our legitimate interests may include:

• operating and developing our cybersecurity consultancy;
• responding to business enquiries;
• maintaining business relationships;
• improving our services;
• protecting our systems and information;
• preventing fraud and misuse;
• maintaining network and information security;
• establishing and defending legal rights; and
• appropriate business-to-business communications.

Where required, we assess and balance our legitimate interests against the rights and interests of affected individuals.

Legal Obligation

We may process Personal Data where necessary to comply with applicable laws, regulations, court orders, regulatory requirements, tax requirements or other legal obligations.

Consent

Where processing is based on your consent, including certain electronic marketing or non-essential cookie activities, you may withdraw that consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

We distinguish between communications necessary to respond to an enquiry or provide requested services and communications sent for marketing purposes.

Submitting an enquiry or requesting information from NS Security does not automatically require you to agree to unrelated marketing communications.

Where required by applicable law, we will obtain your consent before sending marketing communications.

If you choose to receive other communications from NS Security, we may use your contact information to provide relevant information concerning our services, cybersecurity developments, regulatory developments, insights or other professional content.

You may unsubscribe from marketing communications at any time by:

• contacting us at contact@ns-security.co.uk.

Service-related and transactional communications may continue where they are necessary for an existing relationship or contract.

We do not sell or rent your personal information or email lists to third parties for marketing purposes.

We may disclose Personal Data where reasonably necessary to:

• service providers processing information on our behalf;
• hosting and cloud infrastructure providers;
• website and IT service providers;
• communications and email providers;
• CRM and business administration providers;
• payment and accounting providers;
• professional advisers, including lawyers, accountants and auditors;
• consultants and contractors assisting us in providing services;
• regulatory authorities;
• law enforcement agencies;
• courts and tribunals;
• government authorities;
• potential purchasers, investors or advisers in connection with a legitimate corporate transaction; and
• other parties where you instruct or authorise us to disclose information.

Where a service provider processes Personal Data on our behalf, we require appropriate contractual, confidentiality and data protection obligations where required by law.

Because NS Security provides cybersecurity, information security, compliance and risk-management services, clients may provide us with information necessary to perform an engagement.

Depending on the engagement, this may include information concerning systems, applications, infrastructure, personnel, access controls, security incidents, audit evidence, security configurations or business processes.

The respective roles of NS Security and the client as controller, processor or independent controller will depend on the nature of the engagement.

Where NS Security processes Personal Data on behalf of a client as a processor, such processing will be governed by the applicable contractual terms and, where required, a Data Processing Agreement (“DPA”).

We seek to apply data-minimisation principles and encourage clients not to provide Personal Data that is unnecessary for the relevant cybersecurity or compliance engagement.

Our normal website and business activities do not require the collection of special-category Personal Data.

We ask that you do not provide information concerning health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, sexual orientation or other specially protected information unless it is genuinely necessary and an appropriate legal basis exists.

Where special-category Personal Data must be processed in connection with a client engagement, we will apply the additional requirements imposed by applicable data protection legislation.

NS Security operates from the United Kingdom, European Economic Area and Switzerland and provides services to organisations including those located in the United Kingdom, European Economic Area and Switzerland.

Personal Data may therefore be transferred between these jurisdictions where necessary for legitimate business purposes or the delivery of our services.

Where Personal Data is transferred internationally, we will comply with applicable requirements concerning international transfers.

This may include relying on:

• an applicable adequacy decision or adequacy regulation;
• approved contractual safeguards;
• Standard Contractual Clauses where applicable;
• the UK International Data Transfer Agreement or UK Addendum where applicable; or
• another transfer mechanism permitted by applicable law.

Where appropriate, we may also undertake transfer risk assessments or implement supplementary technical and organisational safeguards.

If a service provider processes Personal Data outside the UK, EEA or Switzerland, we will assess and implement an appropriate transfer mechanism where required.