This Privacy Policy explains how PENOPS and its affiliates ("we", "us") collect and use personal data when you visit our websites, contact us, apply for a job, or create and administer a PENOPS account. It covers our role as a controller of that data.
Important scope note. When PENOPS tests your systems through the Platform, we process data (including any personal data captured during a scan) on your behalf, as a processor. That processing is governed by our Data Processing Agreement (DPA) and your Main Service Agreement, not this Policy. This Policy covers personal data for which PENOPS is the controller (website, marketing, sales, support, account administration, and recruitment).
AT A GLANCE
Summary only; the detail below governs.
- What we collect: identity and contact details, professional details, account and usage data, communications, and limited device/analytics data.
- Why: to run our website, provide and secure our accounts and Services, communicate with you, market responsibly, meet legal duties, and recruit.
- We do not sell your personal data, and we do not use it to build advertising profiles for third parties.
- Your rights: access, correct, delete, object, restrict, port, and (where relevant) opt out, under GDPR/UK GDPR, US state laws (incl. CCPA/CPRA and Nevada), UAE PDPL, and equivalents.
- Contact: privacy@penops.com · Data Protection Officer: dpo@penops.com.
1. WHO WE ARE
The controller is PENOPS, [registered office / ADDRESS], company no. [NUMBER]. Questions: privacy@penops.com.
2. PERSONAL DATA WE COLLECT
| Category | Examples | Source |
|---|---|---|
| Identity & contact | Name, email, phone, company | You (forms, email), account signup |
| Professional | Employer, job title, role | You, enrichment providers |
| Account | Username, credentials, roles, API tokens, preferences | You / your organization |
| Support & communications | Messages, tickets, call notes, feedback | You |
| Usage & device | Pages viewed, referrer, request IDs, IP, browser/device, approximate location | Automatic (cookies/logs) |
| Marketing | Subscriptions, event registrations, engagement | You / marketing tools |
| Recruitment | CV, application and eligibility data | Applicants (see Section 12) |
We do not intentionally collect special-category data through our website. Please do not send us sensitive personal data unless we ask for it.
3. HOW WE USE PERSONAL DATA, AND OUR LEGAL BASES
| Purpose | GDPR / UK GDPR legal basis |
|---|---|
| Operate, secure, and improve our website and accounts | Legitimate interests; performance of a contract |
| Provide, administer, and support the Services and accounts | Performance of a contract; legitimate interests |
| Respond to enquiries and communications | Legitimate interests; performance of a contract |
| Marketing (newsletters, events, product updates) | Consent where required; otherwise legitimate interests |
| Security, fraud prevention, and network protection | Legitimate interests; legal obligation |
| Comply with law, enforce terms, and handle disputes | Legal obligation; legitimate interests |
| Recruitment | Legitimate interests; steps prior to a contract; consent |
Where we rely on consent you may withdraw it at any time. Where we rely on legitimate interests, you may object (Section 9).
4. COOKIES AND SIMILAR TECHNOLOGIES
We use cookies and similar technologies for essential functionality, analytics, and (where permitted) marketing. Non-essential cookies are set only with consent where required. See our Cookie Policy and the consent banner for details and controls.
5. HOW WE SHARE PERSONAL DATA
We share personal data with:
- Service providers / processors who act on our instructions (hosting and infrastructure, analytics, communications and email, CRM and marketing, customer support, payment and billing, and security tooling). Our current list of key subprocessors is available at [URL] or on request.
- Professional advisers, auditors, and authorities where necessary for legal, compliance, or audit purposes.
- Corporate transactions: in a merger, acquisition, financing, or asset sale, subject to this Policy and applicable law.
We do not sell personal data or share it for cross-context behavioral advertising.
6. INTERNATIONAL TRANSFERS
We operate globally and may transfer personal data to countries other than your own, including [EU, UK, US, UAE, and others]. Where we transfer personal data across borders, we use an appropriate safeguard, such as an adequacy decision, the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful mechanism. A copy of the relevant safeguard is available on request.
7. DATA RETENTION
We keep personal data only as long as needed for the purposes above, then delete or anonymize it. Retention depends on the data and context: account and contract data for the relationship plus any legally required period; marketing data until you opt out or after a period of inactivity; support and security logs for a limited period; recruitment data per Section 12.
8. SECURITY
We maintain appropriate technical and organizational measures based on the nature and sensitivity of the data, including encryption in transit and at rest, access controls, monitoring, and staff training. No method of transmission or storage is completely secure, but we work to protect your data and to notify you and regulators of qualifying incidents as required by law.
9. YOUR RIGHTS
Subject to your location and applicable law, you may have the right to:
- Access a copy of your personal data
- Correct inaccurate or incomplete data
- Delete your data
- Object to or restrict certain processing (including direct marketing)
- Withdraw consent where processing is based on consent
- Data portability
- Not be subject to solely automated decisions with legal or similarly significant effects
- Lodge a complaint with your supervisory authority
United States (incl. California/CCPA-CPRA and other states): rights to know, access, correct, delete, and to opt out of "sale"/"sharing" and certain profiling. We do not sell or share personal data as those terms are defined. We honor recognized opt-out preference signals (e.g., Global Privacy Control) where required.
Nevada: you may submit a "Do Not Sell" request to privacy@penops.com. We do not sell covered information.
UAE (PDPL) and other regions: equivalent rights apply where the local law provides them.
To exercise any right, contact privacy@penops.com. We will verify your request and respond within the timeframe required by law. You may use an authorized agent where permitted. We will not discriminate against you for exercising your rights.
10. CHILDREN
Our website and Services are for businesses and are not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact privacy@penops.com and we will delete it.
11. THIRD-PARTY LINKS
Our website may link to third-party sites and services we do not control. Their privacy practices are governed by their own policies.
12. RECRUITMENT
If you apply for a role, we process your application data to assess your candidacy, communicate with you, and meet legal obligations. We may share it with internal hiring teams and recruitment providers. Applicants may request access, correction, or deletion via careers@penops.com.