Privacy Policy

CIPHER Proactive Solutions ("CIPHER", "we", "our", or "us") is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use our platforms (CIPHER QHSE, CIPHER GRC), or engage with our professional services. This policy is compliant with the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR 2016/679), the Data Protection Act 2018, and other applicable data protection laws. By accessing our website or services, you acknowledge that you have read and understood this policy.

CIPHER Proactive Solutions is the data controller responsible for your personal data. Registered Address: 128 City Road, London, EC1V 2NX, United Kingdom Email: info@cipherproactive.com Phone: +44 7472 134 193 If you have any questions about this Privacy Policy or our data practices, please contact us at the details above.

We may collect and process the following categories of personal data: 3.1 Information You Provide Directly • Identity Data: Full name, job title, company name • Contact Data: Email address, phone number, postal address • Communication Data: Messages, enquiries, demo requests submitted via our contact forms • Account Data: Login credentials and preferences when using our software platforms 3.2 Information Collected Automatically • Technical Data: IP address, browser type and version, time zone, operating system, device identifiers • Usage Data: Pages visited, time spent on pages, links clicked, referring URLs • Cookie Data: As described in our Cookie Policy below 3.3 Information from Third Parties • Business contact data from professional networks or industry events • Referral data from partners or resellers

We use your personal data for the following purposes, relying on the indicated legal bases: • Service Delivery (Contract): To provide, manage, and improve our QHSE and GRC software platforms and consulting services • Client Communication (Legitimate Interest / Contract): To respond to enquiries, provide support, and manage our business relationship • Marketing Communications (Consent / Legitimate Interest): To send information about our services, industry insights, and updates — you may opt out at any time • Legal Compliance (Legal Obligation): To comply with applicable laws, regulations, and court orders • Security & Fraud Prevention (Legitimate Interest): To protect our platforms, detect and prevent fraud or unauthorised access • Analytics & Improvement (Legitimate Interest): To understand how our website and services are used and to improve user experience

We do not sell your personal data. We may share it with: • Service Providers: Trusted third-party vendors who assist in operating our website and delivering our services (e.g., cloud hosting, CRM, analytics), bound by confidentiality obligations • Professional Advisers: Lawyers, auditors, and insurers as necessary in the course of professional services • Regulatory Authorities: Where required by law, regulation, or legal process • Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity All third parties are required to handle your data securely and in accordance with applicable law.

CIPHER Proactive Solutions operates primarily in the United Kingdom and the European Union. Where we transfer personal data outside of the UK or EEA, we ensure appropriate safeguards are in place, including: • Standard Contractual Clauses (SCCs) approved by the European Commission or the UK ICO • Adequacy decisions recognising equivalent levels of data protection • Other legally approved transfer mechanisms You may request details of the safeguards applicable to any specific transfer by contacting us.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, accounting, or reporting requirements. • Client and contractual data: Retained for the duration of the business relationship plus 7 years • Marketing data: Retained until you withdraw consent or opt out • Website usage and analytics data: Typically retained for 26 months • Enquiry and contact form data: Retained for up to 3 years Upon expiry of the applicable retention period, data is securely deleted or anonymised.

Under applicable data protection law, you have the following rights: • Right of Access: Obtain a copy of the personal data we hold about you • Right to Rectification: Request correction of inaccurate or incomplete data • Right to Erasure: Request deletion of your personal data in certain circumstances ("right to be forgotten") • Right to Restrict Processing: Request that we limit how we use your data • Right to Data Portability: Receive your data in a structured, machine-readable format • Right to Object: Object to processing based on legitimate interests or for direct marketing purposes • Right to Withdraw Consent: Where processing is based on consent, withdraw it at any time without affecting prior processing • Right to Lodge a Complaint: Lodge a complaint with your supervisory authority (UK: the Information Commissioner's Office — ico.org.uk) To exercise any of these rights, please contact us at info@cipherproactive.com. We will respond within one month.

Our website uses cookies and similar technologies to enhance your browsing experience, analyse site traffic, and personalise content. Types of cookies we use: • Strictly Necessary Cookies: Essential for the website to function; cannot be disabled • Performance / Analytics Cookies: Help us understand how visitors interact with the site (e.g., Google Analytics) • Functional Cookies: Remember your preferences and settings • Marketing Cookies: Used to deliver relevant advertisements and track campaign effectiveness You can manage cookie preferences through your browser settings or our cookie consent banner. Disabling certain cookies may affect the functionality of our website.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include encryption in transit (TLS), access controls, regular security assessments, and staff training. However, no method of electronic transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security and encourage you to use secure passwords and keep your credentials confidential.

Our website may contain links to third-party websites, plug-ins, or applications. Clicking on those links may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy practices. We encourage you to read the privacy notice of every website you visit.

We reserve the right to update this Privacy Policy at any time. When we make material changes, we will notify you by updating the "Last Updated" date at the top of this page and, where appropriate, by email or prominent notice on our website. We encourage you to review this policy periodically.

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact: CIPHER Proactive Solutions 128 City Road, London, EC1V 2NX, United Kingdom Email: info@cipherproactive.com Phone: +44 7472 134 193