Privacy Policy

What this site does not do

• No cookies of any kind, including analytics or advertising cookies
• No Google Analytics, no tag manager, no pixels, no session recording
• No advertising networks and no data sold or shared with them
• No third-party fonts or scripts. Fonts are served from this domain
• No account, no login, and no profile built about you

You do not need to accept a cookie banner here because there is nothing to accept.

What we collect

Information you submit

If you use the contact form, we receive what you enter: your name, business email, company, and a description of what you need. Optionally a phone number, user count, current IT provider, and Microsoft 365 tenant size.

Please do not submit passwords, access tokens, regulated data such as health or payment records, incident evidence, customer records, or confidential files through the form. It is not the right channel for any of that, and the form says so.

Information collected automatically

This site is hosted on Cloudflare Pages. As with any website, Cloudflare processes the technical details of your request, including IP address, user agent, and the page requested, to serve the page and to protect the site from attack and abuse. NextLayerSec does not have a visitor analytics dashboard and does not build reports about individual visitors.

Where form submissions go

Submissions are sent through Microsoft Graph directly into a Microsoft 365 mailbox that NextLayerSec controls. They are not routed through a form service, a marketing platform, or a CRM.

That is a deliberate choice. It means no third-party processor sits between you and us reading a description of your security gaps.

Microsoft acts as our data processor for email. Cloudflare acts as our infrastructure provider. Both are bound by their own agreements and privacy terms.

Why we use it

• To reply to your enquiry
• To scope work and prepare a proposal
• To keep records of business correspondence

We do not use it to send marketing you did not ask for, and we do not add you to a mailing list because you filled in a contact form.

How long it is kept

Enquiries that do not become engagements are kept for up to 24 months and then deleted. Correspondence connected to an actual engagement is retained for the life of the engagement plus seven years, which reflects ordinary business, tax, and professional record-keeping practice.

Your choices

You can ask us what we hold about you, ask for a copy, ask for it corrected, or ask for it deleted. Use the contact form and say which. We will respond within 30 days.

Deletion requests are honoured except where we are required to retain something, for example records tied to a signed engagement or a tax obligation. If that applies we will tell you what is being kept and why.

Depending on where you live you may have additional statutory rights. We apply the process above to everyone rather than sorting people by jurisdiction.

Client data during an engagement

This policy covers this website. Data accessed inside a client environment during an assessment or hardening engagement is governed by the confidentiality and data handling terms of the signed agreement, which are stricter than this page and take precedence.

Security of what we hold

Enquiry data lives in a Microsoft 365 tenant with multi-factor authentication enforced, conditional access applied, and administrative accounts separated from daily-use accounts. We hold ourselves to the configuration we recommend to clients.

Children

This is a business-to-business site. It is not directed at children and we do not knowingly collect information from anyone under 18.

Changes

If this policy changes materially, the date at the top changes with it. There is no version history published, so if the specifics matter to you, keep a copy of the version you relied on.