Privacy Policy

Lexs Security (“we”, “us”, “our”) provides penetration testing and offensive security services. We are the data controller for the personal information described in this policy, which means we decide how and why it is used.

If you have any questions about this policy or how we handle your information, contact us at info@lexssecurity.com.

Information you give us. When you submit our contact form, we collect:

• Your first and last name
• Your email address
• Your phone number (optional)
• Your company name and company address (optional)
• The details you provide about your product and testing needs

We also collect any information you choose to share when you email or speak with us.

Information collected automatically. Like most websites, our hosting provider automatically records basic technical information when you visit, such as your IP address, browser type, device type, pages requested and the date and time of your visit. This is used to keep the website running securely and to investigate abuse.

Please do not send us passwords, credentials, or confidential details about vulnerabilities in your systems through the contact form. We will arrange a secure way to exchange that information if we work together.

We use your personal information only to:

• Respond to your enquiry and discuss your testing needs
• Prepare proposals, quotes and agreements
• Provide our services if you become a client
• Keep our website secure and prevent spam and misuse
• Meet our legal, regulatory and accounting obligations

We do not sell your personal information, and we do not use it for automated decision-making or profiling. We will only send you marketing emails if you have asked us to, and you can opt out at any time.

Where data protection laws such as the UK GDPR or EU GDPR apply, we rely on the following legal bases:

• Steps before entering a contract, when we respond to your enquiry and prepare a proposal at your request.
• Performance of a contract, when we deliver services to you as a client.
• Legitimate interests, to run and secure our website, prevent fraud and spam, and manage our business relationships.
• Legal obligation, where we must keep records for tax, accounting or regulatory purposes.
• Consent, where we ask for it, for example before sending marketing emails. You can withdraw consent at any time.

We share personal information only with trusted service providers who help us operate our business, and only as much as they need to do their job:

• Email delivery: Resend, which delivers contact form submissions to our inbox.
• Domain and email services: Porkbun, which provides our domain and email forwarding.
• Website hosting: our hosting provider, which serves this website and processes technical visit data.
• Professional advisers, such as lawyers and accountants, where needed.

These providers are required to keep your information secure and to use it only on our instructions. We may also disclose information if required by law, or to protect our rights, our clients or others.

We keep enquiry information for up to 24 months after our last contact with you, unless you become a client. Client information is kept for as long as our relationship continues and afterwards for as long as required by law or for legitimate business purposes, such as resolving disputes. When information is no longer needed, we securely delete it.

Protecting information is our business. We use appropriate technical and organisational measures to protect your personal information, including encrypted connections (HTTPS), access controls that limit information to people who need it, and carefully selected service providers.

No method of transmission over the internet is completely secure, but we work hard to protect your information and will notify you and the relevant authorities of a data breach where the law requires us to.

Some of our service providers may process information outside your country, including in the United States. Where this happens, we make sure appropriate safeguards are in place, such as standard contractual clauses approved by the relevant authorities.

Depending on where you live, you may have the right to:

• Access the personal information we hold about you
• Ask us to correct inaccurate or incomplete information
• Ask us to delete your information
• Object to, or ask us to restrict, how we use it
• Receive a copy of your information in a portable format
• Withdraw consent at any time, where we rely on consent

To exercise any of these rights, email us at info@lexssecurity.com. We will respond within one month and may need to verify your identity first. You also have the right to complain to your local data protection authority, although we would appreciate the chance to address your concerns first.

Our website does not use advertising or tracking cookies, and we do not use third-party analytics. If we introduce any non-essential cookies in future, we will update this policy and ask for your consent where required.

During a penetration test we may come across personal or confidential data held in your systems. This is not covered by this policy. It is handled under the confidentiality and data processing terms of our engagement agreement with you, and is accessed only as far as needed to carry out the agreed testing.

Our services are intended for businesses. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, please contact us and we will delete it.

We may update this policy from time to time. The latest version will always be available on this page, with the “last updated” date shown at the top. If we make significant changes, we will take reasonable steps to let you know.

For any questions about this policy or your personal information, email info@lexssecurity.com or use our contact form.