Privacy Policy

For the purposes of UK data protection law, Trusted Path Ltd is the data controller in respect of personal data collected via our website (www.trustedpath.biz), our survey and interview system (surveys.trustedpath.biz), our beta programme and pilots, and any communications, contracts, or interactions related to our services.

Website Visitors

When you visit our website, we may collect the following categories of personal data:

• Technical data: IP address, browser type and version, operating system, device type, and screen resolution.
• Usage data: Pages visited, time spent on each page, referral source, and navigation paths.
• Cookie data: Session and preference cookies, subject to your consent as described in Section 11.

Contact and Enquiry Data

When you submit a contact form, book a pilot call, or otherwise contact us, we collect:

• Full name
• Work email address
• Organisation name
• Job title or role (if provided)
• The content of your message or enquiry

Beta Programme, Pilot and Platform Data

If you take part in our beta programme or a pilot, or sign up to use the Trusted Path platform, we collect additional data as described in our Terms of Service and, where applicable, our Data Processing Agreement, including:

• Professional contact details (name, work email, job title)
• Organisation and team information
• SDLC maturity assessment inputs and responses
• Platform usage and activity data

Beta testers and pilot participants also sign a Non-Disclosure Agreement with us. That agreement covers confidential business information. It does not cover personal data, which is governed by this policy.

Research Surveys and Interviews

We run discovery surveys and interviews with engineering, security, compliance and leadership practitioners through surveys.trustedpath.biz and by video call. With your consent we collect:

• Your name, work email address, organisation and role, where you choose to give them
• Your answers to the survey or interview questions, and the interviewer's notes
• Whether you have agreed to be contacted about the findings or about a follow-up conversation

You can take part in a survey without giving your name or contact details. Findings are reported in aggregate and are not attributed to you or your organisation without your written agreement.

Data We Do Not Collect

We do not intentionally collect special category personal data (such as data about health, ethnicity, religion, or political opinions) through our website or standard service interactions. We do not collect payment card data directly; any payments are processed by our payment processors.

Directly From You

• Contact and booking forms on our website
• Email and telephone communications
• Beta programme or pilot enrolment and onboarding
• Survey and interview participation

Automatically

• Server logs when you access our website
• Cookies and similar tracking technologies (see Section 11)
• Analytics tools (subject to your consent)

From Third Parties

• Professional networking platforms such as LinkedIn, where you have made your details publicly available or connected with us
• Referrals from existing contacts or partners
• Publicly available business directories, used for B2B prospecting

We use your personal data for the following purposes:

LI = Legitimate Interests. We have carried out a legitimate interests assessment (LIA) for each activity marked LI and determined that our interests do not override your fundamental rights and freedoms.

Performance of a Contract (Article 6(1)(b))

Where processing is necessary to perform a contract with you or to take steps at your request before entering into such a contract.

Legitimate Interests (Article 6(1)(f))

Where processing is necessary for our legitimate interests, including operating and improving our platform, conducting B2B outreach, maintaining security, and preventing fraud, provided those interests are not overridden by your rights.

Legal Obligation (Article 6(1)(c))

Where processing is necessary to comply with a legal obligation, including tax, accounting, or data protection law requirements.

Consent (Article 6(1)(a))

Where you have given clear consent for a specific purpose, such as taking part in a research survey or interview, subscribing to marketing communications, or accepting non-essential cookies. Where processing is based on your consent, you may withdraw that consent at any time by contacting dpo@trustedpath.biz. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

We do not sell your personal data. We share data only in the following circumstances:

Service Providers (Sub-Processors)

We use a limited number of trusted third-party service providers to operate our business. These providers act as data processors and are contractually bound to process data only on our instructions and in accordance with applicable data protection law. Our current sub-processors include:

Legal and Regulatory Disclosure

We may disclose personal data where required by law, court order, or a competent regulatory authority, including the Information Commissioner's Office (ICO) or law enforcement agencies acting under lawful authority.

Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of our assets, personal data may be transferred to the successor entity, subject to equivalent data protection obligations.

Where we or our sub-processors transfer personal data to countries that do not benefit from a UK adequacy decision, we put appropriate safeguards in place, including International Data Transfer Agreements (IDTAs), the UK's equivalent of the EU Standard Contractual Clauses (SCCs).

Specifically, transfers to our US-based sub-processors (including Google Workspace and Stripe) are governed by IDTAs incorporated into our data processing agreements with those providers.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law.

At the end of the applicable retention period, personal data is securely deleted or anonymised.

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction, including:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
• Access controls based on the principle of least privilege
• Multi-factor authentication for internal systems
• Regular vulnerability assessments and penetration testing
• Incident response and breach notification procedures

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware and will notify affected individuals without undue delay where required by law.

Under the UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data:

To exercise any of these rights, please contact us at dpo@trustedpath.biz. We may need to verify your identity before fulfilling a request.

Marketing Opt-Out

If you receive B2B marketing communications from us, you may opt out at any time by clicking the unsubscribe link in the communication or by contacting us at dpo@trustedpath.biz. We will honour opt-out requests within 10 business days.

Cookies We Use

Cookie Consent

When you first visit www.trustedpath.biz, our cookie consent banner will ask for your preferences before any non-essential cookies are set. A full list of cookies in use is available on our Cookie Policy page.

Our website and services are directed at business professionals and are not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected personal data from a child, please contact us immediately at dpo@trustedpath.biz and we will delete it promptly.

We may update this Privacy Policy from time to time to reflect changes in our data processing activities, business operations, or applicable law. Where changes are material, we will notify platform users by email or via an in-app notice before the changes take effect.

If you have any questions, concerns, or complaints about how we handle your personal data, please contact us in the first instance:

We aim to respond to all data protection queries within 10 business days.

Right to Lodge a Complaint

If you are not satisfied with our response, or if you believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):