CYBERSHIELD PARTNERS
Privacy Policy
Cybershield Partners
Last updated: 17th October 2026
This policy explains how CyberShield LTD ("Cybershield Partners", "we", "us", "our") collects and uses personal data when you visit www.cybershieldpartners.com (the "website"), send us an enquiry, or contact us by email. It is written to meet our obligations under the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 ("PECR").
This policy covers the website and related correspondence only. Personal data we process when delivering client engagements is governed by the relevant engagement terms and data processing agreements.
1. Who we are
The controller responsible for your personal data is:
Cybershield LTD, trading as Cybershield Partners
Registered in England and Wales, company number 12183113
Registered office: 129 Disraeli Road, London, UK
Registered with the Information Commissioner's Office (ICO) under registration number ZA918679
For any question about this policy or your personal data, contact us at [email protected] or write to us at the registered office above, marked "Data Protection".
2. Personal data we collect
We collect only what we need, and most of it comes directly from you.
Information you give us
Website enquiry form (/contact/): your name, email address, job title (optional) and the content of your message. If you arrived from a link to a specific service, the message box may be pre-filled with that topic; you can edit or remove it.
Email: if you write to [email protected], [email protected] or any of our staff, we receive your email address, name, signature details and anything else you choose to include in the message or attachments.
Vulnerability research submissions: if you are an independent researcher contacting us through our Vulnerability Acquisition Program, we receive your contact details, any handle or alias you use, the technical material you submit, and any details needed to discuss collaboration or payment.
Please do not include special category data (for example, health information) or details of criminal offences in an enquiry. If you are contacting us about a live security incident, give only a brief outline at first. We will agree a secure channel before you share sensitive or confidential details.
Information collected automatically
Technical and security data: when you visit the website, our content delivery and security provider, Cloudflare, processes your IP address, browser and device information (user agent), the pages requested, the date and time of the request, and related connection data. It uses this to deliver the website, protect it against attack and detect automated (bot) traffic. See Section 10 for the cookies involved.
Enquiry submission data: when you submit the form, FormSubmit (the service that relays the form to our mailbox) receives the submitted content together with standard connection data such as your IP address and browser information.
We do not use analytics, advertising or social media tracking tools on the website, and we do not build profiles of visitors.
3. How we use your personal data and our lawful bases
| Purpose | Personal data | Lawful basis (UK GDPR Article 6) |
|---|---|---|
| Responding to enquiries submitted via the form or by email, and following up on them | Name, email address, job title, message content, correspondence | Legitimate interests: responding to people who contact us and developing business relationships. Where you ask us about entering into an engagement, also steps taken at your request before entering into a contract. |
| Assessing and responding to vulnerability research submissions and managing researcher relationships | Contact details, alias, submitted material, correspondence, payment details where relevant | Legitimate interests: operating our research program. Contract once terms are agreed with you. |
| Operating, securing and protecting the website, including blocking malicious and automated traffic | IP address, device and browser data, request data, security cookies | Legitimate interests: keeping the website available and secure. |
| Preventing spam and abuse of the enquiry form | Form content, connection data | Legitimate interests: protecting our systems and staff. |
| Keeping records, meeting regulatory requirements, and establishing, exercising or defending legal claims | Relevant correspondence and records | Legal obligation where the law requires it. Otherwise legitimate interests. |
Where we rely on legitimate interests, we have balanced our interests against your rights and expectations. We consider the processing proportionate because it is limited to what you have chosen to send us or what is technically necessary to serve the website securely. You can ask us for more information about this assessment and you have the right to object (see Section 8).
Marketing. We do not add enquirers to marketing lists. We will only send you insights or event invitations by email if you have asked us to or where PECR otherwise allows it. Every such message will offer a simple way to opt out.
Automated decision-making. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
4. Who we share your personal data with
We do not sell your personal data. We share it only as described below.
Service providers acting on our behalf (processors)
| Provider | Role | Data involved |
|---|---|---|
| Cloudflare, Inc. | DNS, content delivery, TLS encryption, bot management and protection for the website, and obfuscation of email addresses on our pages | Visitor technical and security data, security cookies |
| FormSubmit (formsubmit.co) | Receives submissions from our enquiry form and forwards them to our mailbox by email | Form content and associated connection data |
| Microsoft Corporation / Microsoft Ireland Operations Limited (Microsoft 365) | Email, document storage and collaboration | Enquiries and correspondence, and any information you send us by email |
| Cloudflare | Hosting of the website files | Technical request data |
We assess the security and data protection arrangements of service providers. FormSubmit’s contractual processing terms and transfer safeguards have not yet been confirmed.
Other recipients
Consulting and delivery partners: if your enquiry relates to a service we deliver with a partner (for example, a joint engagement), we may share relevant enquiry details with that partner, in confidence, to respond to you. Where this is likely, we will tell you first.
GCC-based colleagues, associates and local partners: where your enquiry relates to work in Saudi Arabia, the United Arab Emirates or Qatar, we may share it with members of our team or associate network supporting that region.
Professional advisers: lawyers, accountants and insurers, under a duty of confidentiality.
Authorities: law enforcement, regulators, courts or other public bodies where we are legally required to share data, or where it is necessary to establish, exercise or defend legal claims.
Business transfers: a prospective buyer or successor if our business, or part of it, is sold or reorganised, subject to confidentiality obligations.
5. International transfers
Some of the recipients above process personal data outside the United Kingdom. When we transfer personal data outside the UK, we make sure one of the safeguards recognised by UK data protection law applies:
United States providers (Cloudflare and Microsoft): transfers rely on the UK Extension to the EU–US Data Privacy Framework (the "UK–US data bridge") where the provider is certified, and/or the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses included in the provider's data processing terms. Microsoft 365 data for our organisation is stored in the United Kingdom, and Cloudflare operates a global network, so requests may be served from a data centre close to you.
FormSubmit: our current understanding is that FormSubmit is hosted on Microsoft infrastructure in the United Kingdom. Its contractual transfer safeguards and any onward processing outside the UK have not yet been confirmed. If you would rather not use the form, you can email us directly at [email protected].
Gulf Cooperation Council (KSA, UAE, Qatar): these countries are not covered by UK adequacy regulations. Where we transfer personal data to colleagues, associates, partners or clients in the region, we use the UK International Data Transfer Agreement or UK Addendum where appropriate. Alternatively, where the transfer is occasional and necessary to respond to your request or to perform or enter into a contract with you or in your interest, we rely on the specific exceptions in Article 49 UK GDPR. Local data protection laws in those countries may also apply to our processing there.
You can ask us for more information about the safeguards we use, including a copy of the relevant transfer mechanism, by contacting us at [email protected].
6. How long we keep your personal data
We keep personal data only for as long as we need it for the purposes described above:
| Data | Retention period |
|---|---|
| Enquiries that do not lead to an engagement | 24 months after our last contact with you, then deleted |
| Enquiries and correspondence that lead to an engagement | Project deliverables are retained for 6 years. Enquiries and related correspondence are retained for 24 months after our last contact with you. |
| Vulnerability research submissions and related correspondence | For as long as needed to assess the submission and manage any resulting relationship, subject to applicable contractual and legal requirements |
| Form submissions held by FormSubmit | FormSubmit’s retention period has not yet been confirmed. You may email us directly if you prefer not to use the form. |
| Cloudflare security cookies | See Section 10 (the bot management cookie expires after 30 minutes) |
| Cloudflare request and security logs | As set out in Cloudflare's data processing terms and privacy policy |
We may keep data for longer where the law requires it or where it is needed in connection with a legal claim.
7. How we protect your personal data
As a cybersecurity firm, we hold ourselves to a high standard. Our measures include:
encryption in transit for all website traffic (HTTPS/TLS) and for the transmission of form submissions;
access to enquiries restricted to the people who need it, using individual accounts protected by multi-factor authentication;
obfuscation of our published email addresses to reduce automated harvesting, and anti-spam controls on the enquiry form;
a published GPG public key so that researchers can encrypt vulnerability submissions to us end to end;
due diligence on our service providers and contractual data protection commitments from them;
network security and endpoint security controls.
No method of transmission over the internet is completely secure. Please do not send confidential incident details or sensitive material through the website form; we will agree a secure channel with you.
8. Your rights
Under UK data protection law you have the right to:
Access: ask for a copy of the personal data we hold about you.
Rectification: ask us to correct inaccurate or incomplete data.
Erasure: ask us to delete your data in certain circumstances.
Restriction: ask us to limit how we use your data in certain circumstances.
Object: object to processing based on legitimate interests. You have an absolute right to object to direct marketing.
Data portability: receive data you provided to us in a structured, machine-readable format, or have it sent to another organisation, where processing is based on consent or contract and carried out by automated means.
Withdraw consent: where we rely on consent, withdraw it at any time. This does not affect processing carried out before withdrawal.
To exercise any of these rights, contact us at [email protected]. We may need to verify your identity before we act. We will respond within one month. If your request is complex or you have made several requests, we may extend this by up to two further months; if so, we will tell you why. There is normally no fee.
9. Complaints
If you are unhappy with how we have handled your personal data, please contact us first at [email protected] so we can try to resolve the matter. We will acknowledge your complaint within 30 days and respond without undue delay.
You also have the right to complain to the UK's supervisory authority, the Information Commissioner's Office:
Website: ico.org.uk/make-a-complaint
Telephone: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
10. Cookies and similar technologies
PECR requires us to tell you about any information we store on, or access from, your device, and to obtain your consent unless the storage is strictly necessary to provide the service you have requested.
The website does not use analytics, advertising, social media or other tracking cookies. It sets no cookies of its own. The only cookies are security cookies set by Cloudflare, which are strictly necessary to protect the website and so do not require consent:
| Cookie | Set by | Purpose | Duration | Type |
|---|---|---|---|---|
| __cf_bm | Cloudflare (on www.cybershieldpartners.com) | Distinguishes humans from automated traffic as part of Cloudflare's bot management, to protect the website from malicious bots. It does not track you across other websites. | 30 minutes | Strictly necessary |
| cf_clearance | Cloudflare (on www.cybershieldpartners.com) | Set only if Cloudflare's security checks need to confirm your browser is legitimate (for example, after a challenge), so that you are not challenged again. | Expires according to the challenge passage duration configured in Cloudflare; it may be renewed following further security checks | Strictly necessary |
The website also loads two small scripts served from our own domain by Cloudflare:
a bot detection script (/cdn-cgi/challenge-platform/…), which runs lightweight browser checks to identify automated traffic; and
an email address decoding script (/cdn-cgi/scripts/…/email-decode.min.js), which displays our email addresses that are obfuscated in the page source to deter spam harvesters.
The website pages do not load analytics, advertising, externally hosted fonts or other non-essential embedded content. FormSubmit’s separate submission and CAPTCHA pages may load resources needed for spam protection. When you submit the enquiry form, your browser sends the form directly to FormSubmit. FormSubmit uses a CAPTCHA challenge for spam protection; its processing is described in its privacy terms.
You can block or delete cookies through your browser settings. If you block Cloudflare's security cookies, parts of the website may not load or you may be asked to complete additional security checks.
If we introduce any non-essential cookies in the future, we will update this policy and ask for your consent before setting them.
11. Links to other websites
The website links to other websites, including our partners' sites and FormSubmit's privacy terms. We are not responsible for the privacy practices of those websites, and we encourage you to read their privacy policies.
12. Children
The website and our services are intended for business and government professionals. They are not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has sent us personal data, please contact us and we will delete it.
13. Changes to this policy
We review this policy regularly and will update it when our practices, service providers or legal obligations change. The "Last updated" date at the top shows when it was last revised. If we make significant changes, we will highlight them on the website and, where appropriate, notify people we are in contact with.
14. Contact us
Cybershield LTD, trading as Cybershield Partners
129 Disraeli Road, SW15 2DZ, London, UK
General enquiries: [email protected]