Privacy Policy
The Product Security Guild respects your privacy. This Privacy Policy explains what personal information we collect through https://prodsecguild.com, our contact forms, event and training inquiries, and related business communications. It also explains why we use that information, when we share it, how long we keep it, and the choices available to you.
1. Who we are
The Product Security Guild LLC is responsible for the personal information described in this policy unless another notice says otherwise.
2. What this policy covers
This policy applies when you:
- Visit our website.
- Submit a contact form.
- Ask about our services, training, or events.
- Communicate with us by email or another business channel.
- Receive business communications from us.
Client engagements may involve additional processing governed by a services agreement, statement of work, data processing agreement, or engagement-specific privacy notice. Those documents control where they conflict with this website policy.
3. Personal information we collect
Information you provide
We may collect:
- Your name, organization, job title, and professional contact details.
- Whether you are contacting us as a product maker, product user, partner, or for another reason.
- Your desired timeline and the information you include in an inquiry.
- Training interests, audience details, delivery preferences, and scheduling information.
- Event registration and attendance information.
- Your communication preferences.
- Records of correspondence and meetings with us.
Please do not submit confidential, proprietary, export-controlled, patient, health, security-sensitive, or other sensitive information through a general website form. We can arrange a more appropriate channel when we respond.
Information collected when you use the website
We may collect:
- Internet Protocol address and approximate location derived from it.
- Browser, device, operating system, and language information.
- Pages visited, referring page, date, time, and basic interaction data.
- Security, diagnostic, and server-log information.
- Cookie or similar-technology data described in the Cookies and analytics section below.
Information from other sources
We may receive professional contact information from event organizers, referral partners, publicly available business sources, or people who introduce us. When required, we will provide any additional privacy information applicable to that collection.
4. How and why we use personal information
We use personal information for the following purposes:
| Purpose | Examples | Legal basis in the EEA and UK, where applicable |
|---|---|---|
| Respond to inquiries | Review a request, arrange a call, determine whether we are a suitable provider, and prepare a proposal | Steps taken at your request before entering a contract; legitimate interests in operating our business |
| Deliver services and training | Plan and administer an agreed engagement, session, or event | Performance of a contract; legitimate interests |
| Manage business relationships | Maintain contact records, schedule meetings, and communicate about active or potential work | Performance of a contract; legitimate interests |
| Send relevant business communications | Share requested information, service updates, event information, or other professional communications | Consent where required; otherwise legitimate interests, subject to your right to object |
| Operate and improve the website | Maintain functionality, understand aggregate use, troubleshoot problems, and improve content | Legitimate interests; consent where required for non-essential cookies or similar technologies |
| Protect the website and our business | Detect abuse, investigate security events, prevent fraud, and maintain records | Legitimate interests; compliance with legal obligations |
| Meet legal and regulatory obligations | Respond to lawful requests, maintain required records, and establish or defend legal claims | Compliance with legal obligations; legitimate interests |
Where we rely on legitimate interests, we consider whether those interests are proportionate and whether your rights and interests require a different approach. Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that took place before consent was withdrawn.
5. Cookies and analytics
Our website is hosted by Webflow, and its traffic passes through Cloudflare's network. Cloudflare sets one strictly necessary security cookie, _cfuvid, which helps protect the site from abusive traffic. It expires when you close your browser, is not used for advertising, and does not track you across websites. On pages with a form, Cloudflare Turnstile checks that submissions come from a person rather than an automated program and stores one small item in your browser for that purpose. These technologies are necessary for security and cannot be disabled without affecting the site.
We also use Umami to understand, in aggregate, how visitors use the website and to improve its content, navigation, and performance.
Umami collects information such as pages visited, referring page, approximate location, browser type, device type, and interactions such as form submissions. It does not use cookies or store information on your device, and it does not store your IP address. Visitors are counted using an anonymized identifier, and we see only aggregate statistics.
We do not use advertising or tracking cookies, and our analytics do not store information on your device, so the website does not display a cookie banner. Our fonts are hosted with the rest of our website rather than loaded from a third-party font service such as Google Fonts, so viewing a page does not send your IP address to a font provider. If we add technologies that require consent, we will update this policy and ask for your consent where the law requires it.
For more information about how Umami handles data, see the Umami Privacy Policy.
6. When we share personal information
We may share personal information with:
- Website hosting, form, content-delivery, and security providers.
- Email, document, collaboration, and business-administration providers.
- Analytics providers included in the final site configuration.
- Professional advisers, including legal, accounting, insurance, and information-security advisers.
- Regulators, courts, law enforcement, or other parties when disclosure is required or permitted by law.
- A buyer, successor, or other relevant party in connection with a merger, financing, reorganization, or sale of all or part of the business, subject to appropriate safeguards.
Our website service providers include:
| Provider | Purpose |
|---|---|
| Webflow | Website hosting, content delivery, and website form operation |
| Cloudflare | Domain name services, network security for our website host (including the _cfuvid security cookie), and form spam protection (Turnstile) |
| Microsoft 365 | Email, collaboration, document management, and inquiry handling |
| HubSpot | Customer relationship management; receives website form submissions so we can respond to and keep track of inquiries |
| Umami | Cookieless, aggregate website usage statistics |
We do not sell personal information. We do not share personal information for cross-context behavioral advertising. If that practice changes, we will update this policy and provide any legally required opt-out mechanism before the change takes effect.
7. International transfers
We may use service providers or work with people located outside the country where you live. This can involve transferring personal information to countries with different data-protection laws.
Where the European Economic Area or United Kingdom transfer rules apply, we use an available lawful transfer mechanism and any required supplementary measures. Depending on the transfer, this may include an adequacy decision, the European Commission's Standard Contractual Clauses, the United Kingdom International Data Transfer Agreement, or the United Kingdom Addendum to the European Commission's Standard Contractual Clauses.
You may contact us for more information about the safeguards used for a particular transfer.
8. How long we keep personal information
We keep personal information only as long as reasonably necessary for the purpose for which it was collected and for related legal, accounting, security, and recordkeeping needs.
The retention period depends on factors such as:
- Whether an inquiry becomes a client engagement.
- The length and nature of the business relationship.
- Whether you have asked us to stop contacting you.
- Contractual, tax, insurance, limitation-period, and regulatory requirements.
- The need to investigate an incident or establish, exercise, or defend legal claims.
When information is no longer needed, we delete it, anonymize it, or securely isolate it until deletion is possible.
9. How we protect personal information
We use administrative, technical, and organizational measures designed to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure. No website, transmission, or storage system can be guaranteed completely secure.
If you believe personal information you provided to us may be at risk, contact admin@prodsecguild.com. To report a potential vulnerability in our website or systems, contact admin@prodsecguild.com.
10. Your privacy rights
Your rights depend on where you live and the law that applies. They may include the right to:
- Ask whether we process your personal information and obtain access to it.
- Correct inaccurate or incomplete information.
- Request deletion of personal information.
- Restrict or object to certain processing.
- Receive certain information in a portable format.
- Withdraw consent where processing is based on consent.
- Opt out of certain targeted advertising, sale, sharing, or profiling practices where applicable.
- Appeal a decision we make about a privacy request where applicable.
- Lodge a complaint with a data-protection or privacy regulator.
Residents of the European Economic Area and United Kingdom may object to processing based on legitimate interests and may complain to the supervisory authority in the country where they live or work, or where they believe an infringement occurred.
If a United States state privacy law applies to us, residents of that state may exercise the rights provided by that law. We will not discriminate against you for exercising an applicable privacy right.
To make a request, email admin@prodsecguild.com. Tell us what right you want to exercise and provide enough information for us to identify the relevant records. We may need to verify your identity and authority before completing a request. An authorized agent may submit a request where permitted by law, subject to verification.
11. Marketing communications
You may unsubscribe from marketing emails by using the link in the message or contacting admin@prodsecguild.com. We may still send non-marketing communications about an inquiry, event registration, service, security matter, or business relationship.
12. Children
The website is intended for business and professional audiences. It is not directed to children, and we do not knowingly collect personal information from children through the website. If you believe a child has provided personal information to us, contact admin@prodsecguild.com.
13. Automated decision-making
We do not use personal information collected through this website to make decisions based solely on automated processing that produce legal or similarly significant effects.
14. Third-party websites
The website may link to third-party websites or services. Their privacy practices are governed by their own notices, not this policy.
15. Changes to this policy
We may update this policy when our practices, services, providers, or legal obligations change. We will post the updated version on this page and revise the Last updated date. If a change materially affects how we use personal information, we will provide additional notice where required.
16. Contact us
Questions or requests about this policy may be sent to:
The Product Security Guild LLC
admin@prodsecguild.com
