What we collect and what we don’t.

Who is responsible

The data controller is Covert Binary Ltd., an offensive security consultancy registered in Bulgaria. The address below is transliterated from Cyrillic.

What we collect

Only two things, and we ask for neither of them unless you contact us.

• What you send us. Your name, email address and message, and your company if you choose to give it. No law or contract requires you to send us an enquiry; if you do not, we simply have nothing.
• Technical data from your request. Your IP address and the country it resolves to, with the usual request metadata, are processed so the site can be served, kept available and protected from abuse.

Do not send health information, political opinions, other special-category data, or your customers’ personal data. We do not ask for it and we do not need it to scope an engagement.

Why, and on what legal basis

Our basis is legitimate interests — Article 6(1)(f) GDPR. There are three, all narrow:

• Answering you. Replying needs your message and a way to reach you.
• Operating and protecting this site. Diagnosing errors, keeping the site up, and reducing automated abuse of the contact form.
• Keeping a record of the enquiry, because an enquiry is usually the start of a scoping conversation.

You can object to processing on this basis at any time — see your rights, below.

Automated checks accept or reject a form submission: rate limiting, a bot check and field validation. Nothing else about your enquiry is decided automatically, and we build no profile of you.

What this site does not do

• Our own code sets no cookies and writes nothing to your browser’s storage.
• Our pages load no third-party fonts, images, embeds or advertising. The fonts are served from this domain.
• We run no analytics and no tracking pixels.
• We never sell your enquiry and never pass it to anyone for their own marketing.

One exception, and it is on the contact page only: the form’s bot check is served by our security provider and so loads from their domain. It is not an analytics or advertising script.

How long we keep it

We keep an enquiry while it is live and for up to 24 months after it closes, then delete it. Two years covers a procurement cycle that stops and restarts. Ask us at contact@covertbinary.com and we will delete it sooner.

Technical request data is held for a short operational period by the providers described below and is not kept by us beyond that. We do not join it to anything else, and we export it nowhere.

Who else handles it

We keep suppliers to the minimum. By category:

Both act only on our instructions under a written data processing agreement. Where either transfers personal data outside the EEA, the transfer is covered by the European Commission’s standard contractual clauses or an equivalent approved mechanism. We will name a specific provider on request — write to the address above.

Your rights

Under the GDPR you can ask us for a copy of what we hold about you, or ask us to correct it, delete it or restrict what we do with it. You can also object to the processing described here, which rests on legitimate interests rather than your consent.

One address for all of it: contact@covertbinary.com. We respond without undue delay and normally within one month. If we need longer because a request is complex, we will tell you inside that month and explain why. Requests are free. We may need information to confirm who you are.

Complaining

Raise it with us at the address above, or complain to a supervisory authority. In Bulgaria that is the Commission for Personal Data Protection (cpdp.bg). You can also go to the authority in the EU country where you live or work.

Changes to this notice

We update this page when what the site does changes, not on a schedule. The date below is the last time that happened.

Last updated: 7 October 2026.