Privacy Policy
Last updated: 7 August 2026
This policy explains what personal data 8kSec collects when you visit 8ksec.io, why we collect it, who we share it with, and what rights you have over it. It covers this website only. Our training platform at academy.8ksec.io and our store at store.8ksec.io are separate services with their own terms.
Who is responsible for your data
8kSec is the data controller for the personal data described in this policy.
- Legal entity: [LEGAL ENTITY NAME TO BE CONFIRMED]
- Registered address: [REGISTERED ADDRESS TO BE CONFIRMED]
- Privacy contact: privacy@8ksec.io
What we collect
Information you give us
We only receive this when you choose to submit a form.
- Enquiry and contact forms: your name, email address, phone number, company name, subject, your message, and the page you submitted the form from.
- Career applications: your name, email address, phone number, location, the position applied for, links you choose to share such as LinkedIn or a blog, and your message.
- Newsletter signup: your email address.
Information collected automatically
Each time you load a page, our own analytics records the following. We are describing this in full because some of it is personal data and it is linked to a persistent identifier.
- Your IP address
- Approximate location derived from that IP address: country, region and city
- Browser user agent and preferred language
- The page you viewed, its title, and the page that referred you
- Screen resolution and time zone
- A randomly generated visitor identifier and session identifier, described below
We use this to understand which trainings, certifications and research articles people find useful, and to detect abuse of the site.
Cookies and browser storage
We store two identifiers in your browser. Neither contains your name or email, and neither is sold or used for advertising.
_vid(local storage): a random visitor identifier that persists between visits. It lets us tell a returning visitor from a new one, which means the page views described above can be linked together over time into a single browsing history._sid(session storage): a random session identifier, cleared when you close the tab.announcement-dismissed(session storage): remembers that you closed a site notice.
The third-party services listed below set their own cookies and identifiers under their own policies. You can clear all of these at any time through your browser settings, and you can block them with most privacy extensions. Clearing _vid resets you to an unrecognised visitor.
Why we are allowed to process it
Where the GDPR or UK GDPR applies, we rely on the following legal bases:
- Legitimate interests for site analytics, security monitoring and error reporting, so that we can keep the site working, understand what content is useful, and investigate abuse.
- Consent for marketing emails. You give it when you subscribe and you can withdraw it at any time using the unsubscribe link in any email.
- Steps prior to entering a contract when you contact us about training or services, or apply for a role.
Who we share it with
We do not sell personal data, and we do not run advertising on this site. We use the following processors, each of which receives only what it needs:
| Service | What it receives | Purpose |
|---|---|---|
| Vercel | IP address, request metadata | Website hosting and delivery |
| Sentry | Visit records above, error reports | Site analytics and error monitoring |
| Google Analytics via Google Tag Manager | Usage and device data | Aggregate audience measurement |
| Metricool | Usage data | Traffic and campaign measurement |
| MailerLite | Email address | Newsletter delivery |
| Slack | Form submission contents | Routing enquiries and applications to our team |
| YouTube (Google) | Data collected by embedded players | Video playback on some pages |
We may also disclose personal data where we are legally required to do so, or to establish or defend legal claims.
International transfers
We are a globally distributed company and several of the processors above are based in the United States. Our analytics and error monitoring provider, Sentry, stores data in the United States. If you are in the European Economic Area or the United Kingdom, this means your personal data is transferred outside your home jurisdiction. These transfers rely on the European Commission's Standard Contractual Clauses or an equivalent safeguard offered by the provider.
How long we keep it
| Data | Retention |
|---|---|
| Analytics and visit records | [RETENTION PERIOD TO BE CONFIRMED, e.g. 90 days] |
| Enquiry and contact submissions | [RETENTION PERIOD TO BE CONFIRMED] |
| Career applications | [RETENTION PERIOD TO BE CONFIRMED] |
| Newsletter subscription | Until you unsubscribe |
Your rights
Depending on where you live, you may have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to how we process it, to receive it in a portable format, and to withdraw consent you have previously given. Withdrawing consent does not affect processing carried out before you withdrew it.
If you are in California, you also have the right to know what categories of personal data we collect and to request deletion. We do not sell personal data, so there is nothing to opt out of in that respect.
To exercise any of these rights, email privacy@8ksec.io. We will respond within one month. You will not be charged for making a request. If you are in the EEA or UK and you are unhappy with our response, you may lodge a complaint with your national data protection authority.
Security
Data is transmitted to us over HTTPS and held with the providers listed above under their own security controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we take reasonable measures appropriate to the sensitivity of the data involved.
Children
This site is intended for security professionals and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact privacy@8ksec.io and we will delete it.
Changes to this policy
We will update this page when our practices change and revise the date at the top. Significant changes will be highlighted on the site.
Contact
Questions about this policy or how we handle your data: privacy@8ksec.io.