Privacy Notice

Negative Zero Ltd

Negative Zero Ltd is an IASME-approved Cyber Essentials Certification Body and cybersecurity advisory consultancy registered in England and Wales. We operate as the Data Controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 for personal data processed through our website and digital services.

You can object to commercial follow-up at any time by emailing privacy@negativezero.com.

When you submit a request to book a live demo (/book-demo), request a fixed-price certification quote (/cyber-essentials/quote), or message our advisory team (/contact-team), we collect:

• Contact details: Full name, professional work email address, company or organisation name, professional role/job title, and telephone number (if provided).
• Scoping context: Organization size, current Cyber Essentials requirements, target compliance timeline, and custom requirements notes.
• Technical telemetry: We record the visitor's IP address and browser user-agent, and for the demo and quote forms timezone, screen resolution, and browser language.

Attachment & Retention: These technical telemetry items are attached to the enquiry record in our CRM and internal notification email and kept for the same period as the enquiry.

Purpose & Lawful Basis: We process this information to evaluate your certification or consulting needs, issue guaranteed fixed-price quotes, schedule discovery sessions with our Lead Assessor, and follow up with commercial information. Our lawful basis is our legitimate interest in conducting B2B commerce with business representatives (UK GDPR Art 6(1)(f)).

When you complete our self-assessment readiness check and request a bespoke Cyber Essentials preparation report in PDF or Excel format, we collect your name, business email, organization name, technical answers across the 5 Cyber Essentials control pillars, target deadline, and telephone number (if provided). We also record the visitor's IP address and browser user-agent, which are attached to the enquiry record in our CRM and internal notification email and kept for the same period as the enquiry.

Delivery & Processing: The readiness report is emailed to the visitor and to our sales inbox, the enquiry (with the assessment score) is recorded in HubSpot, and the chat transcript is sent to Google Gemini to write the executive summary. If you give the Cyber Essentials agent your name, organisation and work email in the chat and ask us to get in touch, those details, the certification level, deadline and concerns you mentioned are recorded in HubSpot, posted to our internal Teams channel, and a confirmation is emailed to you.

To protect our services against abusive traffic, automated script flooding, and volumetric request exhaustion, we use:

• Cloudflare Turnstile challenge tokens verified per request.
• Rate-limit counters keyed by IP address and session id held in Vercel KV for at most one day.

Lawful Basis: Legitimate interests (UK GDPR Art 6(1)(f)) in protecting application availability and infrastructure stability.

We host community hackathons, tech workshops, and industry meetups (such as our August Hackathon documented on /events). Group photographs and general event imagery may be published to document community participation.

Your Choice: If you appear in any published event photograph and wish to have the image cropped, blurred, or removed, email privacy@negativezero.com and we will action your request promptly.

International Transfers

Where personal data leaves the UK we rely on the UK International Data Transfer Addendum or UK adequacy regulations. The mechanism for each provider is available upon request and is shown in the sub-processor list above.

Data Retention Schedule

Nothing Loads Until You Say Yes

No cookie is set and no analytics script is loaded until you accept. If you decline, or simply ignore the banner, nothing is stored on your device and no request is made to Google. You can change your mind at any time with the Cookie settings link in the footer.

No Advertising or Cross-Site Tracking

With your consent we use Google Analytics 4 to count visits and see which pages are read, and Vercel Web Analytics and Speed Insights, our hosting provider’s cookieless, first-party page-view and performance measurement. Advertising storage, ad personalisation and Google Signals are switched off, so your visit is not used to build an advertising profile. There are no advertising pixels, no session replay and no cross-site tracking. The Cloudflare Turnstile challenge runs without tracking cookies.

What Is Stored

Your choice is recorded in your browser’s local storage, not in a cookie, so declining leaves nothing in the cookie jar. If you accept, Google Analytics sets _ga and _ga_<stream>, which expire after 13 months and are deleted immediately if you withdraw consent. Vercel Web Analytics stores nothing on your device: it recognises a returning visitor for a single day from a hash of request headers held on Vercel’s servers, so withdrawing consent simply stops it reporting.

Enquiry Follow-Up & Marketing Consent

We follow up on enquiries under legitimate interests. Business contacts who enquire through our forms or agent tools may also receive relevant marketing about our products, services and events under legitimate interests (corporate subscribers, PECR regulation 22); the contact-team form lets you decline at the point of submission, personal email addresses are never added to marketing without consent, and every marketing email carries an unsubscribe link. Either can be stopped at any time by emailing privacy@negativezero.com.

Under the UK GDPR and the Data Protection Act 2018, you possess specific legal rights regarding your personal information: