Privacy Notice

Negative Zero Ltd

Negative Zero Ltd is an IASME-approved Cyber Essentials Certification Body and cybersecurity advisory consultancy registered in England and Wales. We operate as the Data Controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 for personal data processed through our website and digital services.

You can object to commercial follow-up at any time by emailing privacy@negativezero.com.

When you submit a request to book a live demo (/book-demo), request a fixed-price certification quote (/cyber-essentials/quote), or message our advisory team (/contact-team), we collect:

• Contact details: Full name, professional work email address, company or organisation name, professional role/job title, and telephone number (if provided).
• Scoping context: Organization size, current Cyber Essentials requirements, target compliance timeline, and custom requirements notes.
• Technical telemetry: We record the visitor's IP address and browser user-agent, and for the demo and quote forms timezone, screen resolution, and browser language.

Attachment & Retention: These technical telemetry items are attached to the enquiry record in our CRM and internal notification email and kept for the same period as the enquiry.

Purpose & Lawful Basis: We process this information to evaluate your certification or consulting needs, issue guaranteed fixed-price quotes, schedule discovery sessions with our Lead Assessor, and follow up with commercial information. Our lawful basis is our legitimate interest in conducting B2B commerce with business representatives (UK GDPR Art 6(1)(f)).

When you complete our self-assessment readiness check and request a bespoke Cyber Essentials preparation report in PDF or Excel format, we collect your name, business email, organization name, technical answers across the 5 Cyber Essentials control pillars, target deadline, and telephone number (if provided). We also record the visitor's IP address and browser user-agent, which are attached to the enquiry record in our CRM and internal notification email and kept for the same period as the enquiry.

Delivery & Processing: The readiness report is emailed to the visitor and to our sales inbox, the enquiry (with the assessment score) is recorded in HubSpot, and the chat transcript is sent to Google Gemini to write the executive summary. If you give the Cyber Essentials agent your name, organisation and work email in the chat and ask us to get in touch, those details, the certification level, deadline and concerns you mentioned are recorded in HubSpot, posted to our internal Teams channel, and a confirmation is emailed to you.

To protect our services against abusive traffic, automated script flooding, and volumetric request exhaustion, we use:

• Cloudflare Turnstile challenge tokens verified per request.
• Rate-limit counters keyed by IP address and session id held in Vercel KV for at most one day.

Lawful Basis: Legitimate interests (UK GDPR Art 6(1)(f)) in protecting application availability and infrastructure stability.

We host community hackathons, tech workshops, and industry meetups (such as our August Hackathon documented on /events). Group photographs and general event imagery may be published to document community participation.

Your Choice: If you appear in any published event photograph and wish to have the image cropped, blurred, or removed, email privacy@negativezero.com and we will action your request promptly.

Some of our LinkedIn ads carry a LinkedIn Lead Gen Form, which LinkedIn pre-fills from your LinkedIn profile and which you can edit before you submit. If you submit one, LinkedIn passes us what the form showed:

• Contact details: Name, email address, company name, job title and, where the form asks, telephone number and country.
• Your answers: Any question the form asks, such as your organisation's size or what you would like help with.
• Which ad and form: The campaign and form you responded to, and when.

Storage & Retention: We store the submission in HubSpot as an enquiry and keep it for the same period as enquiries made on this website. LinkedIn also keeps a copy under its own privacy policy.

Purpose & Lawful Basis: We use it to answer the request you made in the form and to follow up with relevant commercial information. Our lawful basis is our legitimate interest in conducting B2B commerce with business representatives (UK GDPR Art 6(1)(f)), the same as for our website forms. Marketing follows the rules in the Marketing section below.

International Transfers

Where personal data leaves the UK we rely on the UK International Data Transfer Addendum or UK adequacy regulations. The mechanism for each provider is available upon request and is shown in the sub-processor list above.

Data Retention Schedule

Nothing Loads Until You Say Yes

No cookie is set and no analytics or advertising script is loaded until you accept. Analytics and advertising are separate choices, both off until you switch them on: Accept allows both, and Manage lets you allow one without the other. If you decline, or simply ignore the banner, nothing is stored on your device and no request is made to Google, HubSpot or LinkedIn. You can change your mind at any time with the Cookie settings link in the footer.

Analytics Is Not Advertising

With your analytics consent we use Google Analytics 4 to count visits and see which pages are read, and Vercel Web Analytics and Speed Insights, our hosting provider’s cookieless, first-party page-view and performance measurement. Advertising storage, ad personalisation and Google Signals are switched off, so your visit is not used to build a Google advertising profile. The only advertising tag on this site is LinkedIn’s, described below, and it needs your separate advertising consent. There is no session replay. The Cloudflare Turnstile challenge runs without tracking cookies.

Connecting Your Visit to Your Enquiry

With your consent we also load HubSpot’s visitor tracking. Until you give us your details it records page views against an anonymous cookie. Once you submit a form or hand your details to the Cyber Essentials agent, the pages you read on this site — before and after — are linked to your enquiry record in our CRM, so the person who replies knows what you were looking at. Only HubSpot’s page-view tracking is loaded: not its advertising pixel, chat widget or automatic form collection.

LinkedIn Insight Tag (Advertising)

Only if you allow advertising, we load LinkedIn’s Insight Tag. It tells LinkedIn which pages of this site you visit, with your browser and device details and IP address, so that we can show our ads on LinkedIn to people who have visited, measure which ads lead to an enquiry, and see anonymised professional demographics (such as industry and seniority) of our visitors. LinkedIn matches the visit to a LinkedIn member where it can; we never see who you are from this, only aggregated reports and audience sizes. LinkedIn is responsible for its own use of the data under the LinkedIn Privacy Policy.

Lawful Basis: Your consent (PECR regulation 6 and UK GDPR Art 6(1)(a)), which you can withdraw at any time from Cookie settings. Allowing analytics does not allow advertising.

What Is Stored

Your choice is recorded in your browser’s local storage, not in a cookie, so declining leaves nothing in the cookie jar. If you accept, Google Analytics sets _ga and _ga_<stream>, which expire after 13 months, and HubSpot sets hubspotutk and __hstc (up to six months), __hssc (30 minutes) and __hssrc (for the session). If you allow advertising, the LinkedIn Insight Tag sets li_fat_id (30 days) and li_giant (7 days) on this site, and LinkedIn may set its own cookies on linkedin.com, such as bcookie, lidc, UserMatchHistory and AnalyticsSyncHistory (from one day to a year). Everything set on this site is deleted immediately if you withdraw consent, and withdrawing advertising reloads the page so the LinkedIn tag stops at once. Cookies on linkedin.com can only be removed by LinkedIn or by clearing them in your browser. Vercel Web Analytics stores nothing on your device: it recognises a returning visitor for a single day from a hash of request headers held on Vercel’s servers, so withdrawing consent simply stops it reporting.

Enquiry Follow-Up & Marketing Consent

We follow up on enquiries under legitimate interests. Business contacts who enquire through our forms or agent tools may also receive relevant marketing about our products, services and events under legitimate interests (corporate subscribers, PECR regulation 22); the contact-team form lets you decline at the point of submission, personal email addresses are never added to marketing without consent, and every marketing email carries an unsubscribe link. Either can be stopped at any time by emailing privacy@negativezero.com.

We may share the work email addresses of business contacts held in our CRM (HubSpot) with LinkedIn, to show relevant ads to those contacts on LinkedIn or to stop showing ads to existing customers and people already talking to us. The addresses are shared only in hashed form (converted into an irreversible code before they are sent), LinkedIn uses them only to find matching LinkedIn members, and we see audience sizes, never which members matched. Personal email addresses are never shared.

Lawful Basis & Opt-Out: Our legitimate interest in reaching business contacts with relevant B2B advertising (UK GDPR Art 6(1)(f)). To be left out of these audiences, email privacy@negativezero.com and we will remove you from every list we share and keep you off them.

At a Glance

Zero Drift is a free arcade game from Negative Zero Ltd for iPhone, iPad and Android. It does not collect, send or share any personal data. This section is its privacy policy.

What Stays on Your Device

The app saves your best score and your sound and haptics settings in its own storage on your device, so they are there next time you play. They are never sent to us or to anyone else, we cannot see them, and they are deleted when you delete the app. There is no account and no server holding anything about you, so there is nothing for us to export or erase on your behalf.

No Permissions, No Identifiers

The app asks for no permissions. It does not use your location, camera, microphone, contacts, photos or files, and it does not read your advertising identifier or any other device identifier. It plays sound through your device’s speaker and uses its vibration motor for haptic feedback; you can switch either off from the pause menu. All of the game’s code, fonts and images are bundled in the app, so it makes no network requests while you play and works without a connection.

The Learn More Link

When a run ends, a Learn more button can open negativezero.com in your device’s default browser, leaving the app. It only does so when you tap it. The link carries a fixed campaign label that is the same for everyone and contains nothing about you or your device. From that point you are on our website, where the Cookies & Tracking section above applies: nothing is measured unless you accept analytics.

App Store & Google Play Disclosures

Our store entries match this section. On the Apple App Store the app’s privacy details read Data Not Collected. On Google Play the Data safety section reads No data collected and No data shared. Zero Drift is aimed at a general audience and is not directed at children under 13; because it collects no personal data from anyone, there is no children’s data to collect, share or delete.

Changes, Contact & Support

Negative Zero Ltd is the publisher of Zero Drift. If a future version changes what the app collects or does with data, we will update this section, and the store entries, before that version is released. For questions about privacy, email privacy@negativezero.com; your wider rights over any data we do hold are set out under Your Rights. For help with the game, use our contact page.

Under the UK GDPR and the Data Protection Act 2018, you possess specific legal rights regarding your personal information: