Our commitment to protecting your personal information. 

Who we are and what this policy covers

Liverton Security is a cyber security consultancy headquartered in Wellington, New Zealand. Liverton Security Limited is a New Zealand registered company.

Liverton Security UK Limited is registered in England and Wales. In this policy, "we", "us" and "our" mean both companies.

This policy explains how we collect, use, share and protect personal information when you:

• use our websites, including livertonsecurity.com, livertonsecurity.com/uk and liverisk.livertonsecurity.com
• complete one of our free training modules or request a certificate
• create and use a LiveRisk self-assessment account
• contact us, or buy services, training or software licences from us

It also explains your privacy rights and how to use them. Our websites are not intended for children and we do not knowingly collect information about children.

The laws we follow

As a New Zealand organisation, we handle all personal information in line with the New Zealand Privacy Act 2020 and its Information Privacy Principles, wherever you are. If you are in the United Kingdom, we also comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations. If you are in the European Union, we also comply with the EU General Data Protection Regulation (EU GDPR). In this policy we call these laws together "data protection law".

Where these laws give you different rights, we give you the benefit of whichever offers you more protection.

Who is responsible for your information

Under the New Zealand Privacy Act 2020, Liverton Security Limited, Level 5, 138 The Terrace, Wellington, New Zealand, is responsible for your personal information.

Under UK GDPR, the controller is Liverton Security UK Limited, Suite 99 Milton Keynes Business Centre, Foxhunter Drive, Milton, Keynes, MK14 6GD, United Kingdom, company registration number 14318676. Our registration number with the Information Commissioner's Office is ZC244996.

The information we collect and why

Personal information is any information that identifies you or could be used to contact you. It does not include information that has been anonymised so that you can no longer be identified. We collect the following types of personal information:

We may also use any of your personal information where we need to meet a legal obligation, or to protect your vital interests or those of another person.

We may create statistics from personal information, such as how many people complete a training module. These statistics do not identify you. If we ever combine them with information that does identify you, we treat the result as personal information.

We do not intentionally collect sensitive information, such as details about your health, ethnicity, religious or political beliefs, sexual orientation, biometrics or criminal record. Please do not include this kind of information in notes or messages you send us.

Your LiveRisk results

Assessment answers can show where an organisation's security needs work, so we treat them as confidential. Liverton Security staff do not view individual results.

If you would like our help, you can share your report with us as part of an engagement. Our system administrators only access account data when it is needed to keep LiveRisk running and secure.

Marketing

We only send you marketing emails if you have agreed to receive them, or if you are an existing customer and the law allows us to tell you about services similar to those you have bought. This follows the UK Privacy and Electronic Communications Regulations and the New Zealand Unsolicited Electronic Messages Act 2007.

Every marketing email includes a link to unsubscribe. You can also opt out at any time by contacting us. We do not share your information with other organisations for their own marketing.

How we collect your information

• Directly from you, when you fill in a form, request a certificate, create an account, buy from us, subscribe to updates or contact us.
• Automatically, through cookies, server logs and similar technology when you use our websites.
• From third parties, such as Google Analytics for technical information and our payment providers for transaction information.

Cookies

Our websites use cookies, including Google Analytics cookies, to understand how the sites are used and to improve them. Where the law requires it, we ask for your consent before setting cookies that are not essential. You can refuse or delete cookies through your browser settings. Some parts of our websites may not work properly without cookies.

Who we share your information with

We do not sell your personal information. We share it only with:

• service providers who help us run our business, including Zoho for managing enquiries, Google for website analytics and providers of payment, communication, legal and accounting services
• suppliers and subcontractors, where they need it to deliver a service to you
• legal and regulatory authorities, where the law requires it
• a buyer or seller, if we sell or buy any business or assets, with appropriate safeguards in place

Our service providers may only use your personal information to provide services to us, following our instructions, and must keep it secure and confidential.

Where your information is stored and international transfers

We hold your personal information in New Zealand. LiveRisk runs on our own servers in New Zealand data centres. Zoho stores enquiry details in Australia, and Google processes website analytics data in the United States and other countries.

The European Commission and the UK Government both recognise New Zealand as providing an adequate level of data protection. When personal information is transferred to a country without that recognition, we use appropriate safeguards. These include standard contractual clauses approved by the European Commission, the UK International Data Transfer Agreement or Addendum and, for United States providers, the EU-US Data Privacy Framework and its UK Extension where the provider is certified.

Under the New Zealand Privacy Act 2020, we only disclose personal information outside New Zealand where it will be protected by safeguards comparable to those in New Zealand.

Contact us if you would like more information about the safeguards we use.

Keeping your information secure

We protect your personal information with security controls in line with our ISO 27001 certified information security management system. Access is limited to people who need it for their work, and they are bound by confidentiality.

If a privacy breach happens, we will notify you and the relevant regulator where the law requires it. In New Zealand this means notifying the Privacy Commissioner and affected people as soon as practicable about breaches that have caused or are likely to cause serious harm. In the United Kingdom this means notifying the Information Commissioner's Office within 72 hours where required.

No method of sending information over the internet is completely secure. If we give you a password or licence key, please keep it confidential and do not share it.

How long we keep your information

When we no longer need personal information, we securely delete it or anonymise it.

Your rights

Wherever you are, you can ask us to:

• give you access to the personal information we hold about you
• correct personal information that is wrong or incomplete

If you are in the United Kingdom or the European Union, you can also ask us to:

• delete your personal information
• restrict how we use it
• stop using it, where we rely on our legitimate interests
• give it to you, or another organisation, in a portable format

Where we rely on your consent, you can withdraw it at any time. This does not affect anything we did before you withdrew it. We do not make decisions about you based solely on automated processing.

We respond to requests within 20 working days under the New Zealand Privacy Act and within one month under UK and EU GDPR. We may extend this where the law allows and will tell you if we do. Requests are normally free. We may need to confirm your identity before we act on a request, and we may decline requests where the law allows us to.

To make a request, contact our Privacy Officer using the details below.

Links to other websites

Our websites may link to other websites. Those websites have their own privacy policies and we are not responsible for them. Please check their policies before you give them any personal information.

Changes to this policy

We may update this policy from time to time. We will post the updated version on this page with its review date and, where appropriate, let you know by email. Please also let us know if your personal information changes during your relationship with us, so we can keep it accurate.

Complaints

If you have a concern about how we handle your personal information, please contact our Privacy Officer first and we will do our best to resolve it. If you are not satisfied with our response, you can complain to the relevant regulator:

• in New Zealand, the Office of the Privacy Commissioner at privacy.org.nz
• in the United Kingdom, the Information Commissioner's Office at ico.org.uk or on 0303 123 1113
• in the European Union, the data protection authority in the country where you live or work