Privacy Policy

Last updated: 18 August 2026

Who this covers

Data controller: Fieldnote Security, operated by Kiet Hoong through [COMPANY LEGAL NAME TBC], a limited company registered in England and Wales (Company No. [COMPANY NUMBER TBC]). For the purposes of UK GDPR, the company is the data controller for any personal data collected through this site or during an engagement. Contact: contact@fieldnotesecurity.com.

What data is collected

• Name, email address, company name, and domain/website URL submitted through the contact form on this site.
• Any message or context you add to that form.
• During a paid engagement: the domain(s) and target(s) you authorize for scanning, and the technical findings that scan produces (DNS records, open ports, headers, and similar data about the target, not about you personally).

Why it's collected (lawful basis)

• Contract necessity - to deliver the assessment or report you've requested, once an engagement is agreed.
• Consent - for the contact form submission itself, which you give by completing and sending it.

How long it's kept

• Final client reports and authorization forms: retained for 6 years, matching the UK Limitation Act 1980 standard limitation period for contract claims.
• Raw scan data (detailed technical output, JSON artifacts): retained for 12 months following report delivery, then deleted.
• Free-tier scan submissions from prospects who did not become paying clients: retained for 12 months, then deleted if no engagement followed.

Data is deleted, not just archived, at the end of each period above. You can request earlier deletion at any time by contacting contact@fieldnotesecurity.com, subject to the exceptions above where retention supports a legal or contractual purpose.

Third parties

The contact form on this site is processed by Formspree, a third-party form-handling service. Submitting the form sends your details to Formspree's infrastructure before they reach Kiet. Formspree's own handling of that data is governed by Formspree's Privacy Policy. No other third party receives data collected through this site.

Cookies and tracking

This site does not currently use cookies, analytics, or any tracking technology. If that changes in the future - for example, if analytics is added - this policy will be updated to reflect it before that change goes live.

Your rights

Under UK GDPR you can ask to access, correct, or delete the personal data held about you, or ask that its use be restricted. To make any of these requests, email contact@fieldnotesecurity.com.

Complaints

If you're unhappy with how your data has been handled, you can raise it directly first, or complain to the UK's data protection regulator, the Information Commissioner's Office, at ico.org.uk.

[ICO registration number - add once registered]

Changes to this policy

This policy may be updated as the business and its data practices develop. The date at the top of this page reflects the most recent revision.