Privacy Policy
What we collect, why, and what you can ask us to do about it.
Last updated 9 September 2026
Who is responsible
PenTest Online is the data controller for the personal data described here. Contact us about anything on this page at hello@penetrationtest.online.
What we collect
- Enquiry and booking details — name, business email, phone, company, role, and what you tell us about your site.
- Authorisation records — the name and role of the person who authorised testing, with a timestamp and the IP address the authorisation came from. This is our evidence that testing was lawful.
- Technical findings — the output of testing your systems. This is commercially sensitive rather than personal, and is treated as confidential.
- Correspondence — emails you send us and our replies.
We do not use tracking or advertising cookies, and we do not build profiles of visitors.
Why we hold it, and our lawful basis
- To provide the service you asked for — performance of a contract.
- To evidence that testing was authorised — legal obligation and legitimate interests. This is the one record we keep longest, because it is our defence that access was lawful.
- To answer your enquiry — legitimate interests.
- To send you service emails about your engagement — contract. We do not add enquirers to a marketing list without asking.
How long we keep it
- Enquiries that do not become engagements — 12 months.
- Engagement records and reports — 6 years, in line with normal business and tax record keeping.
- Authorisation records — 6 years, for the reason given above.
Who else sees it
Testing is carried out using licensed commercial scanning engines, and our website and email are provided by third-party suppliers. These providers process data on our instructions only. Some are based outside the UK, in which case transfers rely on the appropriate safeguards under UK data protection law. We do not sell data, and we do not share your findings with anyone outside our engagement with you.
Security
Reports are sent encrypted, with the passphrase delivered separately. Access to engagement records is limited to those who need it to deliver the work.
Your rights
You can ask us for a copy of your personal data, ask us to correct it, ask us to delete it, object to processing, or ask us to restrict it. Email hello@penetrationtest.online and we will respond within one month.
Note that we may need to retain authorisation records even where you ask for erasure, because they evidence that our access to a system was lawful. We will explain if that applies.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk.