Privacy
How we handle your information.
Short version: we collect as little as possible, we only use it to do the thing you asked us to do, and we don't sell it or add you to a mailing list you didn't ask for.
Who we are
Cyber for Purpose, operated by Vikas Mehmi, is the data controller for information collected through this website. You can reach us at hello@cyberforpurpose.co.uk.
What we collect
When you use the contact form, we collect:
- Your name
- Your email address
- Your organisation, if you tell us
- What you write in the message, and the topic you select
- Your IP address and the time of submission — kept as a basic anti-spam measure
We don't use tracking cookies or advertising cookies. If we use analytics, it is a cookieless service that does not identify individual visitors and does not follow you across other websites.
Why we use it
To reply to your enquiry and, if it goes further, to provide the services you've asked about. Our lawful basis is legitimate interests — responding to someone who has deliberately contacted us about our services — and, where we go on to work together, performance of a contract.
We will not add you to a marketing list because you sent an enquiry. If we ever offer a newsletter, you'd have to opt in separately.
Who else sees it
Our website hosting and email are provided by Hostinger, who process data on our behalf under contract from data centres in the Netherlands. We don't sell your information or share it with anyone for marketing. We'd only disclose it if legally required to.
Where it's kept
We are UK-based and UK-resident. Our website and email are hosted by Hostinger in the Netherlands, which sits within the EEA and is covered by UK adequacy regulations — so personal data can be transferred there without additional safeguards.
Where an engagement involves working in a client's systems, we work inside their own environment rather than copying data out of it. If a client's funders or contracts require UK-only data residency, we'll agree that arrangement with them directly.
How long we keep it
Enquiries that don't lead to work are deleted after 6 months. Where we work together, we keep records for as long as needed for the engagement and then for 6 years to meet legal and accounting obligations.
Your rights
Under UK GDPR you can ask us for a copy of your data, ask us to correct or delete it, object to how we're using it, or ask us to restrict processing. Email us and we'll deal with it within one month.
We are registered with the Information Commissioner's Office as a data controller. If you're unhappy with how we've handled your data, you can complain to the ICO at ico.org.uk. We'd appreciate the chance to put it right first.
Security
This site is served over HTTPS with strict transport security and a content security policy. Enquiry emails are held in a mailbox protected by multi-factor authentication, and access is limited to the two of us. We use server-side visitor statistics rather than tracking cookies, which is why you haven't been asked to accept any. Given what we do for a living, we'd be embarrassed to do otherwise.
Changes
If we change how we handle information, we'll update this page and change the date below.
Last updated: August 2026