Privacy Policy

OFFCEPT ("we", "us", "our") is an offensive security company registered in Portugal. This privacy policy explains how we collect, use, and protect your personal data when you visit our website or engage our services.

We collect only the data necessary to provide our services and operate our website:

• Contact information: name, email address, company name, and phone number when you submit our contact form or email us directly.
• Website usage data: IP address, browser type, pages visited, and time spent on our site. We use privacy-respecting analytics that do not track you across other websites.
• Engagement data: information shared during security assessments, stored securely and deleted after the retention period.

We use your data to:

• Respond to enquiries and scope potential engagements
• Deliver and manage our security testing services
• Send relevant updates about your engagement (not marketing)
• Improve our website based on aggregate usage patterns
• Comply with legal obligations

Security is our business. We apply the same rigour to protecting your data that we apply to testing our clients' systems:

• All data in transit is encrypted using TLS 1.3
• Client engagement data is encrypted at rest using AES-256
• Access to personal data is restricted to authorised personnel on a need-to-know basis
• We conduct regular security reviews of our own infrastructure
• Client data from engagements is deleted within 90 days of engagement completion unless retention is legally required

We do not sell, rent, or trade your personal data. We share data only with:

• Service providers: hosting and email providers who process data on our behalf under strict contractual obligations
• Legal requirements: when required by law, regulation, or legal process

Our website uses minimal, functional cookies only. We do not use third-party tracking cookies, advertising cookies, or social media pixels. Any cookies used are essential for website operation and do not track you across other sites.

Under the General Data Protection Regulation, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to processing of your data
• Request data portability
• Withdraw consent at any time

To exercise any of these rights, contact us at privacy@offcept.com. We will respond within 30 days.

We retain personal data only for as long as necessary:

• Contact enquiries: 12 months from last interaction
• Client engagement data: deleted within 90 days of engagement completion
• Website analytics: aggregated and anonymised within 30 days

Our operations are based within the European Union. If we engage a service provider outside the EU, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission.

We may update this policy from time to time. Changes will be posted on this page with an updated revision date. We encourage you to review this page periodically.

For any questions about this privacy policy or your personal data, contact us at:

OFFCEPT
Email: privacy@offcept.com