40and4

Privacy Policy

Last updated: 1 October 2026

This policy explains what personal data 40and4 Security Solutions collects, why, and what rights you have over it under the UK GDPR and the Data Protection Act 2018.

Data controller: Tomasz Mickiewicz, a sole trader trading as 40and4 Security Solutions. Registration with the Information Commission is in progress. For any privacy question or to exercise your rights, contact tomasz@40and4.io.

1. What we collect

Account data

  • Your name, business email address, company name and password (stored only as a secure hash).
  • Any phone number or notes you give us when booking an audit.

Scan data

  • The domains you submit and the results of each scan.
  • Publicly available technical information about those domains: DNS records, mail configuration, web server response headers, SSL/TLS certificate details, subdomains listed in public Certificate Transparency logs, open service ports, and whether cloud storage matching the domain name is publicly readable.
  • Whether email addresses associated with a scanned domain appear in known third-party data breach datasets. This can constitute personal data about your staff.

Technical data

  • Standard server logs, including IP address, browser type and pages requested.
  • Security records tied to your account: the IP address recorded when you accepted these terms, and the IP addresses from which a password reset was requested and completed. We keep these so that we can investigate if someone tries to take over your account, and so that we can tell you where a reset request came from.
  • Counts of recent failed sign-in attempts, held temporarily in memory to block password guessing. These are not written to the database and are discarded automatically.

2. Why we use it, and our lawful basis

  • To deliver the service you asked for — running scans, showing results, producing audit reports. Lawful basis: performance of a contract.
  • To prevent abuse — enforcing business-email registration and scan rate limits, so the scanner is not used for bulk automated reconnaissance. Lawful basis: legitimate interests (protecting our service and third parties).
  • To contact you about a booking you have made. Lawful basis: performance of a contract.
  • To improve the service using aggregated, anonymised statistics. Lawful basis: legitimate interests.
  • Marketing, only where you have opted in or where the soft opt-in for existing customers applies under PECR. You can withdraw consent at any time.

3. Who we share it with

We do not sell personal data. We share it only with processors that help us run the service:

  • our hosting and database provider;
  • our email delivery provider, for sign-in links and service messages;
  • breach-data providers, which we query to check whether addresses on a domain appear in known breaches; and
  • professional advisers or authorities where the law requires it.

[LIST YOUR ACTUAL PROVIDERS HERE — UK GDPR expects you to identify the categories of recipient, and naming them is clearer. Note where any of them process data outside the UK, and on what safeguard.]

4. How long we keep it

  • Account data: for as long as your account is open, then [RETENTION PERIOD] after closure.
  • Scan results: [RETENTION PERIOD], so you can compare your posture over time. You can ask us to delete them sooner.
  • Booking and billing records: six years, to meet UK tax and accounting requirements.
  • Server logs: [RETENTION PERIOD].
  • Password reset records: the link itself expires one hour after it is requested and can only be used once. The record that a reset happened, and the IP addresses involved, are kept for [RETENTION PERIOD] so we can investigate suspected account takeover. We never store the reset link itself — only a one-way hash of it, which cannot be turned back into a working link.

5. Your rights

Under the UK GDPR you have the right to:

  • access the personal data we hold about you;
  • have inaccurate data corrected;
  • have data erased, in certain circumstances;
  • restrict or object to processing, including processing based on legitimate interests;
  • receive your data in a portable format; and
  • withdraw consent at any time where consent is the basis we rely on.

Contact tomasz@40and4.io to exercise any of these. We will respond within one month. If you are not satisfied, you can complain to the Information Commission — the UK data protection regulator, which took over the Information Commissioner’s functions on 30 September 2026 — at ico.org.uk or on 0303 123 1113.

6. Security

Passwords are stored hashed, never in plain text. Access to scan results requires authentication, and your results are visible only to your account. We use encrypted connections throughout. No system is perfectly secure, and we will notify you and the Information Commission of a qualifying personal data breach as the law requires.

7. Cookies

We use a strictly necessary cookie to keep you signed in, which does not require consent under PECR. [IF YOU ADD ANALYTICS, ADVERTISING OR ANY OTHER NON-ESSENTIAL COOKIE, YOU MUST ADD A COMPLIANT CONSENT BANNER THAT BLOCKS THOSE COOKIES UNTIL THE USER OPTS IN, AND LIST THEM HERE.]