Privacy Policy

Open Security is run by me, Alex Chamberlain. I provide hands-on cybersecurity monitoring and management for small and medium businesses. You can reach me at [email protected].

Website visitors

I do not use cookies for tracking or advertising. Cloudflare may set strictly necessary cookies for security (DDoS protection, bot detection).

Free Security Scan users

Scan results are not stored permanently. Email addresses provided for reports may be used as a potential business lead. You may request deletion at any time.

Contact form and email

Clients (managed security services)

For clients using my managed security services, I process additional data as described in the Data Processing Agreement (DPA) that is part of the service contract. In that context, you are the Controller and I am the Processor.

Payment processing

Payments are processed by Stripe, Inc. When you make a payment, your payment data (credit card, bank details) is handled directly by Stripe. I never see or store your full payment details. I receive a transaction confirmation and basic billing information. See Stripe's privacy policy.

• Delivering services — security scans, managed monitoring, reports
• Communication — responding to inquiries, sending security alerts
• Billing and administration — invoicing, contract management
• Legal compliance — tax, bookkeeping, data breach notification
• Security — protecting my website and platform from abuse
• Service improvement — understanding how my services are used

I share personal data only with the following parties, and only to the extent necessary:

I do not share data with any other third parties unless required by law or with your explicit consent.

All primary data processing takes place within the European Economic Area (EEA), specifically in Germany (Contabo). Where data is transferred to the United States (Cloudflare, Stripe), appropriate safeguards are in place:

• EU-U.S. Data Privacy Framework certification
• Standard Contractual Clauses (SCCs) approved by the European Commission

I regularly verify that these safeguards remain in effect.

After the retention period expires, I delete the data or anonymize it so it can no longer be linked to you.

You have the following rights regarding your personal data:

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Dutch Data Protection Authority:

I take the security of your data seriously. Measures include:

• Encryption of data in transit (TLS 1.2+); data at rest protected by strict access controls
• Access control with multi-factor authentication where available
• Cloudflare Zero Trust for application access
• Fail2ban for brute-force protection
• Regular security updates and patching
• Infrastructure hosted exclusively in the EU (Contabo, Germany)
• Logical data isolation between clients

No method of transmission over the internet is 100% secure. While I use commercially acceptable means to protect your data, I cannot guarantee absolute security.

This website only uses essential cookies — specifically Cloudflare security cookies required for the site to function. I do not use any analytics, tracking, or marketing cookies.

My services are not directed at children under the age of 16. I do not knowingly collect personal data from children. If you believe I have inadvertently collected data from a child, please contact me and I will delete it promptly.

I may update this Privacy Policy from time to time. When I make material changes, I will update the "Last updated" date at the top. For clients, I will notify you via email if changes affect the processing of your data.