1. Who I am
Mersek Cyber is a trading name of Piotr Zareba, a sole trader based in Liverpool, UK. For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), the controller of your personal information is Piotr Zareba, trading as Mersek Cyber.
- Email: hello@mersek.co.uk
The best way to contact me about this notice, or about how your information is used, is by email at the address above.
2. What information I collect
When you contact me
If you use the contact form or email me, I receive your name, email address, business name (if you give it) and anything you write in your message. The contact form on this website does not store anything. It opens your own email app, and your message reaches me as a normal email.
When you book a call
If you book a call, the booking service collects your name, email address, the time you choose and any notes you add.
When you become a client
To deliver a service I may hold:
- contact details for you and the colleagues I deal with, such as names, job titles, work email addresses and phone numbers;
- business and billing details, such as your business name and address, the agreed scope and authorisation, quotes, invoices and payment records;
- technical information about your systems that I review with your written permission, such as security settings, user account names, device details, domain and email records, and whether staff work email addresses appear in known data breaches;
- the reports, fix plans and notes I produce for you.
I ask for read-only access wherever possible and only look at what the agreed scope needs. I do not need, and will not deliberately access, the content of your emails or files.
When you visit this website
This website does not use analytics, advertising or tracking cookies, and it does not load anything from third parties. The site is hosted on Cloudflare, which processes technical information such as your IP address, browser type and the pages requested so it can deliver the site and protect it from attacks. Cloudflare may set a strictly necessary security cookie for this purpose.
3. Where I get information from
Most information comes directly from you. When I work for a business, I may also receive information about its staff from the business itself, and I may use publicly available sources, such as public domain and email records and data breach notification services, to check for exposure.
4. Why I use your information and my lawful basis
Under UK data protection law I must have a lawful basis for using personal information. These are the purposes and bases I rely on:
| Purpose | Lawful basis |
|---|---|
| Replying to enquiries and arranging calls | Legitimate interests (responding to people who contact me about my services). If you are contacting me as an individual about a service for yourself, steps taken at your request before entering into a contract. |
| Delivering services I have been engaged to provide, including reviews, fixes, reports and monitoring | Contract, where you are my client. Legitimate interests, where I deal with you as a member of staff of my client business. |
| Invoicing, accounts and tax records | Legal obligation. |
| Keeping records of the work I have done and the authorisation I was given, in case of questions or disputes | Legitimate interests (being able to show what work was agreed and done). |
| Running and securing this website | Legitimate interests (keeping the website available and secure). |
| Sending occasional news or updates, if you ask to receive them | Consent. You can withdraw it at any time. I do not send marketing emails without your consent. |
Where I rely on legitimate interests, I have considered whether my interests are balanced against yours, and I only use the minimum information needed.
When I act for your business: while reviewing or changing your systems, I may handle personal information on your behalf and under your instructions. In that case I act as your processor, and the terms are set out in our written agreement.
5. Who I share information with
I do not sell your information. I only share it with service providers who help me run the business, and only as much as they need:
| Provider | What for |
|---|---|
| Cloudflare, Inc. | Website hosting, domain name services, security and email forwarding |
| Cal.com, Inc. | Online booking of calls |
| Google (Gmail) | Email mailbox. Messages sent to hello@mersek.co.uk are forwarded to it |
I may also share information with professional advisers such as an accountant, or with HMRC, regulators, the police or other authorities where the law requires it.
6. International transfers
Some of the providers above are based in, or use systems in, countries outside the UK, including the United States. Where that happens, I rely on UK adequacy regulations or on the safeguards the provider offers, set out in its data processing terms, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
7. How long I keep information
| Information | How long |
|---|---|
| Enquiries and booking details that do not lead to work | 12 months from our last contact |
| Client records: scope, authorisation, reports, fix plans and correspondence | 6 years after our work together ends |
| Raw technical data collected during a review, such as configuration exports or scan results | Deleted within 90 days of delivering the report, unless we agree otherwise in writing |
| Invoices and accounting records | At least 5 years after the 31 January submission deadline for the relevant tax year, as HMRC requires |
| Website technical logs | As set by Cloudflare’s own retention periods |
When information is no longer needed, I delete it securely.
8. How I keep information safe
Security is what I do, so I apply it to my own business. Accounts are protected with strong, unique passwords stored in a password manager and with multi-factor authentication. Access to client systems is limited to what the agreed scope needs and removed when the work ends.
9. Your rights
Under UK data protection law you have the right to:
- access the personal information I hold about you;
- ask me to correct information that is wrong or incomplete;
- ask me to erase your information in certain circumstances;
- ask me to restrict how I use your information in certain circumstances;
- object to me using your information where I rely on legitimate interests;
- ask for your information to be transferred to you or another organisation in certain circumstances (data portability);
- withdraw consent at any time, where I rely on consent.
I do not make decisions about you based solely on automated processing. You do not usually have to pay to exercise your rights. I will respond within one month. To make a request, email hello@mersek.co.uk.
10. How to complain
If you are unhappy with how I have used your information, please contact me first at hello@mersek.co.uk and I will try to put it right.
You can also complain to the Information Commissioner’s Office (ICO):
- Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
- Helpline: 0303 123 1113
- Website: ico.org.uk/make-a-complaint
11. Changes to this notice
I may update this notice from time to time. The latest version will always be on this page, with the date it was last updated at the top.