Privacy Policy

Last updated: 3 November 2026

Who we are

The Security Advisor (thesecurityadvisor.co.uk) is a trading name of Chestnut Risk Ltd, a company registered in England and Wales with company number 16928424. We're the "controller" of the personal information described here.

Questions about your information, or requests to use your rights: admin@thesecurityadvisor.co.uk.

What we collect and why

Information	Why we use it	Legal basis
Account: email address and password (stored securely, never readable by us)	To create and secure your account and let you sign in	Contract
Profile: display name, and optionally headline, location, "about you" and photo	Shown publicly on your profile and next to your reviews	Contract
Reviews you write, and courses or providers you add	Published publicly to help others choose training	Contract / legitimate interests
Reports you send about reviews	To deal with misuse of the site	Legitimate interests
CV service orders: name, email, your answers at checkout, and the CV and details you send us	To provide the service you bought and contact you about it	Contract
Payment records (we never see your full card details)	Taking payment, refunds and keeping accounts	Contract / legal obligation
Advertising enquiries: your name, company, email and message	To reply to your enquiry	Legitimate interests

Your display name, profile and reviews are public: please don't include anything in them you don't want others to see.

Who we share it with

We don't sell your information. We use trusted providers to run the site, and they only process it on our instructions:

Supabase: hosts our database, accounts and file storage. Your data is stored in their London (UK) data centre.
Stripe: processes payments for our CV services. Stripe also handles some payment information under its own privacy policy.
Our website hosting provider: serves the website pages.
Microsoft 365: handles our email, including CVs you send us.

Some of these companies are based in the USA. Where your information is handled outside the UK, they use approved safeguards (such as the UK International Data Transfer Agreement or the UK–US data bridge) to protect it.

We may also share information if the law requires it.

How long we keep it

Account, profile and reviews: until you ask us to delete your account.
CVs and details for our CV services: 36 months after we deliver your CV, so we can help with changes or tailoring, then deleted.
Payment and order records: 6 years, as required for tax and accounting.
Enquiries: as long as needed to deal with them, and no more than 2 years.

Cookies and storage on your device

We don't use advertising or tracking cookies, and we don't use analytics. Your browser stores a small amount of information that the site needs to work: your sign-in session, and a note if you dismiss the "install the app" message. These are strictly necessary, so we don't need to ask for consent. If we add analytics in future, we'll update this policy and ask you first.

Adverts on the site are simple links and images: they don't track you.

Your rights

You have the right to:

Ask for a copy of your information.
Have it corrected (you can edit your profile yourself at any time).
Have it deleted, including your account and reviews.
Object to or restrict how we use it.
Receive it in a portable format.

To use any of these rights, email admin@thesecurityadvisor.co.uk. We'll respond within one month.

If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to put things right first.

Keeping it safe

Passwords are stored securely using industry-standard hashing. Our database only allows each member to change their own information, and locked content and downloads are only released to members who've unlocked them.

Age

Accounts are for people aged 18 and over.

Changes

We'll update this page if anything changes, and show the date at the top.