1. Introduction
UR Cyber Defense ("UR Cyber Defense," "we," "us," or "our") provides cybersecurity consulting services, including virtual CISO (vCISO) advisory, governance, risk, and compliance (GRC) support, cybersecurity solution architecture, and security program development, primarily to organizations based in the United States. This Privacy Policy explains how we collect, use, disclose, and protect information when you visit our website at www.urcyberdefense.com (the "Site") or engage us for professional services.
By using the Site or engaging our services, you agree to the practices described in this Policy. If you do not agree, please do not use the Site.
2. Information We Collect
2.1 Information You Provide Directly
When you request or book a consultation through the Site, we collect:
- —First name
- —Last name
- —Email address
We do not currently collect phone numbers, physical addresses, payment information, or other personal details through the Site's booking process. If this changes, we will update this Policy accordingly.
2.2 Information Collected Automatically
Like most websites, the Site may automatically collect limited technical information when you visit, such as IP address, browser type, device type, referring/exit pages, and general usage data. The Site uses Google Analytics to collect this information, through cookies, log files, or similar technologies. See Section 8 (Cookies and Tracking Technologies) for details.
2.3 Information Collected During Client Engagements
If you or your organization engages UR Cyber Defense for consulting services, we may, in the course of that engagement, receive access to additional information beyond what is collected through the Site. This may include network diagrams, system architecture documentation, product specifications, security configurations, policies, incident data, and other technical or business information ("Engagement Information"). Engagement Information:
- —Is provided directly by the client, or accessed with the client's authorization, for the purpose of delivering contracted services;
- —Is governed by the terms of the applicable engagement agreement, statement of work, master services agreement, and/or non-disclosure agreement (NDA) between UR Cyber Defense and the client, which take precedence over this Policy with respect to that information;
- —Is handled in accordance with the data security practices described in Section 5.
This Policy addresses our handling of personal information collected through the Site. Engagement Information is primarily business, technical, and organizational data rather than personal information about identifiable individuals. Where it does include personal information (for example, names of client personnel appearing in network diagrams or documentation), we treat it with the same care described in Section 5.
3. How We Use Information
We use the information described above to:
- —Schedule, confirm, and prepare for consultations;
- —Communicate with you about your inquiry or engagement;
- —Deliver, manage, and improve our consulting services;
- —Maintain business records;
- —Comply with legal, regulatory, or contractual obligations;
- —Protect the security and integrity of our Site and services.
We do not use the personal information collected through our booking form (first name, last name, email address) for advertising, profiling, or automated decision-making, and we do not sell this information.
5. Data Security
As a cybersecurity consulting firm, we hold ourselves to a high standard for protecting information, including:
- —Access controls limiting data access to personnel who need it to perform their duties;
- —Encryption of sensitive data in transit and, where appropriate, at rest;
- —Confidentiality and non-disclosure obligations for personnel and subcontractors;
- —Secure handling procedures for client Engagement Information, including network diagrams and technical documentation, consistent with the sensitivity of that data;
- —Periodic review of our own internal security practices.
No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting personal information, we will notify affected individuals and/or clients as required by applicable law and our contractual obligations.
6. Data Retention
- —Booking information (first name, last name, email) is retained for as long as reasonably necessary to respond to your inquiry, manage the relationship, and comply with recordkeeping obligations, after which it is deleted or anonymized.
- —Engagement Information is retained for the period specified in the applicable engagement agreement, or as required by law or professional standards, after which it is securely deleted or returned in accordance with that agreement.
7. Your Privacy Rights
Depending on your state of residence, you may have rights under applicable U.S. state privacy laws (such as the California Consumer Privacy Act/CPRA, Virginia Consumer Data Protection Act, Colorado Privacy Act, Connecticut Data Privacy Act, Utah Consumer Privacy Act, and similar laws), which may include the right to:
- —Know what personal information we hold about you;
- —Request access to or a copy of your personal information;
- —Request correction of inaccurate information;
- —Request deletion of your personal information;
- —Opt out of the sale or sharing of personal information (we do not sell or share personal information as defined under these laws) and opt out of targeted advertising (we do not engage in targeted advertising);
- —Not be discriminated against for exercising these rights.
To exercise any of these rights, contact us using the information in Section 13. We may need to verify your identity before fulfilling certain requests.
9. Children's Privacy
The Site and our services are intended for business use by adults and are not directed to individuals under 18. We do not knowingly collect personal information from children. If you believe a child has provided us information, please contact us and we will delete it.
10. Third-Party Links
The Site may contain links to third-party websites. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies.
11. International Visitors
UR Cyber Defense is based in the United States and primarily serves U.S.-based clients. If you access the Site from outside the United States, your information will be processed in the United States, which may have data protection laws different from those of your jurisdiction.
12. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or for legal or operational reasons. The "Effective Date" above indicates when this Policy was last revised. Material changes will be posted on this page.
13. Contact Us
If you have questions about this Privacy Policy or wish to exercise your privacy rights, contact us at:
UR Cyber Defense
1846 E. Innovation Park Dr., STE 100
Oro Valley, AZ 85755
United States
[email protected]