Privacy Policy

Scope

This policy applies to two groups: our customers and visitors to this website. It states what personal information Clear Security collects, how that information is used and how it is protected.

Information collected

Personal information is collected at three points: when you open an account, when you place an order and when you contact us. It consists of your name, business name, address, email address, telephone number and payment details.

Purposes of use

Your information is used for five purposes: processing orders, managing your account, providing customer support, sending relevant product updates and meeting our legal obligations.

Disclosure

Personal data: never sold. Disclosure is limited to three kinds of recipient: delivery partners, payment processors, and anyone to whom disclosure is required by law.

Security

Personal data is protected by appropriate technical and organisational measures. Risks addressed: unauthorised access, loss and misuse.

Your rights

You have five rights over your personal data: access, correction, deletion, objection to certain processing, and restriction of certain processing. Contact us to exercise any of them.

Cookies

Cookies serve two functions on this website: making it work correctly and improving your experience of it. Detail: see the Cookie Policy.

Activity records

Activity record: a log of the actions taken on this website. It is held separately from analytics.

1. Purpose and lawful basis

Purpose: investigating four incident types. (1) A disputed order. (2) A suspected account takeover. (3) Fraud. (4) Automated scraping of the catalogue and its prices.

• Not signed in. Basis: consent, given or refused through the cookie banner. Until a choice is made, the setting is refusal. Refusal is always available.
• Signed in. Basis: our legitimate interests in securing accounts and payments, preventing fraud, and resolving a dispute about the contents of an order or who placed it. Balancing test: these interests have been weighed against yours. Safeguards: the record holds only what these purposes require; typed content is excluded; searches are limited to specifically authorised staff; it expires after six months; each search is itself logged.

2. Content

Recorded:

• Network: IP address.
• Device: device type, operating system and browser (example: “laptop, macOS, Firefox”).
• Actions: order placed, quote requested, checkout started, item added to basket, file downloaded, sign-in, sign-out, failed sign-in attempt.
• Pages: each page visited, with the time of the visit.
• Staff accounts only: each change made to a record, the content of that change, and each access attempt that was refused.

Identification. Signed in: the record is attached to the account. Not signed in: the record is attached solely to a random identifier held in the browser, never to a name, an email address or a postal address, and nothing is recorded unless analytics cookies have been accepted (see the Cookie Policy).

Not recorded:

• Query strings: the part of a web address after the ?. Discarded: it may hold sign-in links or password-reset tokens.
• Input behaviour: scrolling, mouse movement, keystrokes and typed content. None of it is recorded.
• Secrets: security codes, passwords and payment card numbers. Removed before storage.

3. Retention

• Activity records: 180 days, then deleted automatically.
• Audit log: kept for longer, as evidence in case a legal claim has to be defended or resolved. Events copied to it: (1) data exports; (2) refunds issued; (3) changes to access permissions; (4) sign-ins; (5) a staff member viewing a customer record.

4. Access

Named Clear Security staff only, each granted access explicitly for one of three purposes: fraud investigation, security or support. Other staff: no access. Shared with advertisers: no. Sold: no.

5. Your rights

Available requests: (a) a copy of the record held on you; (b) deletion of that record; (c) an objection to its retention, available whenever the basis is legitimate interests. Withdrawal of consent for the analytics part: possible at any time, in the cookie settings of your browser. Requests: email [email protected].

Complaints body: the Information Commissioner’s Office (ICO). Website: ico.org.uk.