What we do with what you send us
Short version: we use it to reply to you and to do the work you ask for, we keep it only as long as that takes, and we don't share it.
Who we are
Remedy Nine Limited is the controller for personal data collected through this website. Contact: hello@remedynine.com.
What we collect
- Contact form (/contact/): your name, work email, company if given, the topic, your message, and the IP address and browser the message came from. For PHP2Shell campaign enquiries, a supported social campaign label from the link you followed is included with the message to help us understand which campaign prompted your enquiry. This does not use cookies or advertising pixels.
- Sign-in: your email address, the one-time sign-in links we issue, any passkey you choose to register, and session records (time, IP address, browser).
- Remediation engagements (/remediate/): your name, title, company and address as entered on the NDA, your signature image, the files you upload, and a timeline of the engagement: when the NDA was signed and the Terms of Business accepted, when files arrived, when we changed the stage or posted an update, and when you downloaded a document we delivered.
- Email: whatever you choose to send us.
- Cookies and browser storage: see the Cookies page for the sign-in cookies and the theme and motion preferences kept in your browser.
Why, and on what basis
To answer your enquiry, to sign you in securely, and to carry out the engagement you have asked for or are considering (UK GDPR and EU GDPR Article 6(1)(b), steps taken at your request before and under a contract). Otherwise, our legitimate interest in running the business, keeping it secure and answering people who contact us (Article 6(1)(f)). Uploaded findings are also protected by the mutual NDA and the Terms of Business. We do not ask for consent as a basis for any of this, so there is no consent to withdraw; you can object at any time using the contact below.
How long we keep it
- Contact-form messages: deleted twelve months after they arrive.
- Enquiries not taken forward: deleted, including uploaded files, thirty days after we close them. Enquiries that never get past the NDA are deleted after thirty days of inactivity.
- Engagements: kept for the duration of the work and then handled under the Terms of Business; active work is never deleted automatically.
- Sign-in links and sessions: links expire in fifteen minutes and are removed once used; sessions expire within twenty-four hours at most and are removed when you sign out.
- Deletion log: when we delete an engagement we keep the company name, the reason, file counts and the date. The contact's email address is blanked from that log after twelve months.
- Email correspondence: kept as normal business records for up to twelve months after the last exchange.
Where it lives and who sees it
Records are stored on our UK web hosting in an access-controlled database. Uploaded files and delivered documents are encrypted at rest with a key held separately from the hosting. Only the people working on your enquiry or engagement see them. We do not sell, share or transfer your information to third parties, other than the hosting and email providers that process it on our behalf. Nothing on this site calls out to advertising or analytics services.
Your rights
You can ask what we hold about you, ask us to correct or delete it, or object to our processing: email hello@remedynine.com. You also have the right to complain to your data protection authority: in the UK the ICO, in Jersey the JOIC, in the EU your national authority.