Privacy policy

This policy explains what personal information WindBreak Security (“WindBreak”, “we”, “us”) collects, why we collect it, and the choices you have. We've written it to be read, not skimmed. If anything is unclear, email privacy@windbreaksecurity.com.

Who this covers

This policy applies to visitors of windbreaksecurity.com, people who contact us, and the business contacts of our customers. When we deliver security services to a customer, we process data about their staff and systems on the customer's behalf and under our agreement with them. The customer decides what we process; our trust center explains how we protect it.

What we collect

Information you give us

• Contact details you submit through our forms or by email: name, work email, company, team size and your message.
• Details you share on calls or in meetings about your business and its systems.
• Job applications and related correspondence.

Information collected automatically

• Standard web server logs: IP address, browser type, pages requested and timestamps. We keep these for 90 days for security and troubleshooting.
• We do not use advertising trackers or sell analytics data. If we add privacy-respecting analytics in future, we'll update this policy first.

Information we process for customers

To deliver our services we process security telemetry from customer devices, email systems and identity providers. This can include user names, email addresses, device names, sign-in locations and, where a message is quarantined or an investigation requires it, message content. We process this only to protect the customer and as instructed by them.

How we use it

• To respond to your enquiry and, if you ask, to provide a quote or a security review.
• To deliver, support and improve our services.
• To send service notices, such as incident notifications and changes to terms. These are not marketing and you can't opt out while you're a customer.
• To send occasional updates about WindBreak if you've agreed to receive them. Every one includes an unsubscribe link.
• To meet legal obligations and to protect WindBreak, our customers and others from fraud or abuse.

Legal bases

Where data protection law requires a legal basis, we rely on: performance of a contract (delivering services you or your employer have asked for), legitimate interests (running and securing our business, responding to enquiries), consent (marketing emails), and legal obligation.

Who we share it with

We share personal information only with:

• Service providers who help us run our business and deliver our services, such as security platforms, cloud hosting and email. They are bound by contract to protect your data and use it only for us.
• Professional advisers, insurers and auditors, where necessary.
• Law enforcement or regulators when required by law, or to protect someone's safety.
• A buyer or successor if WindBreak is sold or merged. You'll be told before your data is transferred under a different policy.

We do not sell personal information and we do not share it with advertisers.

How long we keep it

• Enquiries: up to 24 months after our last contact, unless you become a customer.
• Customer records: for the term of the agreement and 7 years afterwards for accounting and legal purposes.
• Security telemetry processed for customers: 12 months, or as agreed in the customer's plan.
• Web server logs: 90 days.

Security

We protect personal information with encryption in transit and at rest, access limited to people who need it, multi-factor authentication and hardware keys for all staff, logging and review of access, and the controls described in our trust center. No system is perfectly secure; if we suffer a breach that affects you, we'll tell you promptly and clearly.

International transfers

We store data in the United States. If we transfer personal information across borders, we use recognized safeguards such as standard contractual clauses.

Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict certain processing, and to withdraw consent. To exercise any of these, email privacy@windbreaksecurity.com. We'll respond within 30 days and won't treat you differently for asking. If we process your data on behalf of a customer, we may refer your request to them.

If you're in California, you also have the right to know what personal information we collect and to opt out of its sale. We don't sell personal information. If you're in the European Economic Area or the United Kingdom, you can complain to your local data protection authority.

Cookies

This website uses only strictly necessary cookies, if any, to remember your preferences. We do not set advertising or cross-site tracking cookies.

Children

Our website and services are for businesses. We don't knowingly collect information from anyone under 16.

Changes

If we change this policy in a way that matters, we'll post the new version here with a new effective date and, for customers, email you.

Contact

WindBreak Security
Email: privacy@windbreaksecurity.com