Privacy Policy

This Policy applies to personal information we process as a business (for our own marketing, sales, and website operations). Where SecVal processes data on behalf of a client as part of delivering managed security services — for example, log data, alert data, or endpoint telemetry from a client’s environment — SecVal acts as a service provider / processor under the terms of the applicable Master Services Agreement or Data Processing Addendum with that client, not under this Policy.

1. Information We Collect

1.1 Information You Provide to Us

We collect information you choose to give us, including when you:

• Submit an inquiry through our “Talk to a security expert” contact form (name, work email, company, service interest, and any message you include);
• Email, call, or otherwise correspond with our sales, support, or security operations teams;
• Engage us for services, including information provided during onboarding, contracting, invoicing, and ongoing account management (billing contacts, technical contacts, authorized users);
• Apply for a job, respond to a proposal/RFP, or otherwise do business with us;
• Communicate with us by text message, where you have opted in (see Section 5).

1.2 Information Collected Automatically

When you visit our websites, certain information may be collected automatically through cookies, web server logs, and similar technologies, including your IP address, browser and device type, operating system, referring/exit pages, pages viewed, and timestamps. See Section 4 for details on the specific cookies and tracking technologies currently in use.

1.3 Information From Other Sources

We may receive information about you from publicly available sources (such as LinkedIn or your organization’s own website), from business contact and lead-enrichment providers, from channel and referral partners, and from clients who provide contact details for their own authorized users.

2. How We Use Information

We use personal information to:

• Respond to inquiries and provide quotes, proposals, and sales support;
• Deliver, operate, and support the security services you or your organization have purchased (SIEM, MDR, XDR, firewall management, vulnerability management, penetration testing, and compliance assessment services);
• Send service, billing, and account-related communications, including by text message where you’ve opted in;
• Maintain and improve our websites and services, and keep our systems secure;
• Market our services to prospective clients, where permitted, and honor opt-outs;
• Comply with legal obligations, enforce our agreements, and establish, exercise, or defend legal claims.

3. Legal Bases for Processing (EEA / UK / Switzerland)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) and UK GDPR require us to identify the legal basis on which we process your personal data. We rely on the following bases:

• Consent — where you have given clear, affirmative consent, such as opting in to receive text messages or marketing emails. You may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Contract — where processing is necessary to enter into or perform a contract with you or your organization, such as delivering managed security services you’ve purchased.
• Legitimate interests — where processing is necessary for our legitimate business interests (for example, responding to inquiries, securing our websites and services, and direct B2B marketing), provided those interests are not overridden by your own rights and interests.
• Legal obligation — where processing is necessary to comply with a legal or regulatory obligation to which we are subject.

4. Cookies and Tracking Technologies

Cookies are small text files placed on your device. Our website currently sets only strictly necessary/functional resources needed to load the page and its fonts; it does not currently use analytics or advertising cookies. If that changes, we will post an updated cookie notice describing each category of cookie in use (strictly necessary, performance/analytics, functional, and advertising), its purpose, its duration, and how to manage your preferences. Where required by law (including under GDPR/ePrivacy rules for EEA/UK visitors), we will obtain your consent before setting non-essential cookies.

Most browsers let you refuse or delete cookies. Doing so may affect the functionality of our websites. We currently do not respond to browser “Do Not Track” signals, as no common industry standard for honoring them has been adopted; we will revisit this if one is.

5. Text Messaging (SMS) Policy for Customer Support

SecVal uses SMS/text messaging, sent from (331) 306-8989, as one channel to support active clients — for example, to send service ticket updates, security alert notifications, appointment/maintenance-window reminders, and account or billing notices. This section states our SMS policy and is intended to comply with the U.S. Telephone Consumer Protection Act (TCPA) and CTIA messaging guidelines.

5.1 Consent

We will only send you text messages if you have provided prior express consent to receive them. SMS consent is never a condition of purchasing any SecVal service. Text messaging opt-in information and consent will not be shared with third parties for their own marketing purposes.

5.2 Message Types and Frequency

Message types may include support/ticket updates, security alert notifications, scheduling and maintenance-window reminders, and account/billing notices. Message frequency varies based on your account activity and the support matters you have open with us; we do not send recurring marketing texts under this program.

5.3 Costs

Message and data rates may apply, depending on your mobile carrier and plan. SecVal does not charge for text messages, but your carrier’s standard rates apply.

5.4 Opt-Out and Help

You may opt out of receiving text messages at any time by replying STOP to any message from (331) 306-8989, or by contacting us using the details in Section 13. Reply HELP to any message for assistance, or call (331) 306-8989. After you opt out, we will send one final confirmation message and then stop texting you, except as needed to confirm the opt-out or where another SecVal contact channel (phone, email, client portal) is required to deliver time-sensitive security alerts you’ve separately agreed to receive.

5.5 Carrier Liability

Carriers are not liable for delayed or undelivered messages and are not responsible for the content of messages sent through this program.

6. How We Share Information

We do not sell personal information in the ordinary sense of a monetary sale, and we do not share SMS opt-in data with third parties for their own marketing. We may share personal information with:

• Service providers and subprocessors who support our operations (e.g., email, CRM, scheduling, and hosting providers), bound by contract to protect your information and use it only to provide services to us;
• Professional advisors (lawyers, accountants, auditors, insurers) as needed;
• Regulators, law enforcement, or other parties where required by law, legal process, or to protect our rights, property, or safety or that of others;
• A successor entity in connection with a merger, acquisition, financing, or sale of assets, subject to standard confidentiality protections;
• Other parties with your consent or at your direction.

7. Your Privacy Rights

7.1 European Economic Area, United Kingdom, and Switzerland (GDPR / UK GDPR)

If GDPR or UK GDPR applies to you, you have the right to:

• Access the personal data we hold about you and receive a copy of it;
• Rectify inaccurate or incomplete personal data;
• Erasure (“right to be forgotten”) of your personal data, subject to legal exceptions;
• Restrict or object to our processing of your personal data, including processing based on legitimate interests and direct marketing;
• Data portability — receive your data in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible;
• Withdraw consent at any time, where processing is based on consent;
• Not be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects (SecVal does not currently use automated decision-making or profiling to make such decisions about individuals);
• Lodge a complaint with your local data protection supervisory authority, or with the UK Information Commissioner’s Office (ICO) if you are in the UK.

To exercise any of these rights, contact us using Section 13. We will respond within the timeframes required by applicable law.

7.2 California (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), gives you the right to:

• Know/access the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purpose for collection, and the categories of third parties with whom we share it;
• Delete personal information we have collected from you, subject to certain exceptions;
• Correct inaccurate personal information;
• Opt out of the “sale” or “sharing” of personal information — SecVal does not sell personal information and does not share it for cross-context behavioral advertising;
• Limit the use and disclosure of sensitive personal information — SecVal only uses any sensitive personal information it collects to provide the services requested, not for purposes requiring an opt-out under the CCPA;
• Non-discrimination for exercising any of these rights;
• Designate an authorized agent to make a request on your behalf.

To submit a request, contact us using Section 13. We will verify your identity before fulfilling access, correction, or deletion requests, consistent with CCPA requirements.

7.3 Other U.S. State Privacy Laws

Depending on where you live, you may have similar rights to know, access, correct, delete, and obtain a portable copy of your personal data, and to opt out of targeted advertising, the sale of personal data, and certain profiling, under other comprehensive state privacy laws, including Virginia’s Consumer Data Protection Act, Colorado’s Privacy Act, Connecticut’s Data Privacy Act, Utah’s Consumer Privacy Act, Texas’s Data Privacy and Security Act, Oregon’s Consumer Privacy Act, and comparable laws in other states that have since taken effect. We honor applicable requests under these laws using the same contact method in Section 13, regardless of which state’s law technically applies.

8. International Data Transfers and the EU-U.S. Data Privacy Framework

SecVal is based in the United States, and personal information we collect may be stored and processed in the United States. Security Validation LLC self-certifies to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (collectively, the “DPF Principles”) with respect to personal data received from the European Union/European Economic Area, the United Kingdom, and Switzerland in reliance on the DPF — the successor framework to the earlier EU-U.S. and Swiss-U.S. Safe Harbor arrangements. To learn more about the Data Privacy Framework program and to view SecVal’s certification, please visit www.dataprivacyframework.gov.

Where the DPF does not apply, we rely on other recognized transfer mechanisms, including the European Commission’s Standard Contractual Clauses (SCCs) and the UK’s International Data Transfer Addendum, incorporated into our contracts with EEA/UK clients and vendors as needed. In all cases, we take steps designed to ensure your personal data receives a level of protection consistent with this Policy and applicable law wherever it is processed.

9. Data Retention

We retain personal information for as long as needed to fulfill the purposes described in this Policy, including to provide services, meet legal, accounting, or reporting obligations, resolve disputes, and enforce our agreements. Client account and services data is generally retained for the duration of the client relationship plus the period required by our contractual and legal recordkeeping obligations. Website inquiry and marketing contact information is retained until you ask us to delete it or we determine it is no longer needed for the purpose collected.

10. Data Security

As a managed security services provider, we apply administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction, consistent with the security practices we provide to our clients. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

11. Children’s Privacy

Our websites and services are directed to businesses and are not intended for individuals under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us using Section 13 and we will take steps to delete it.

12. Third-Party Links

Our websites may link to third-party websites, including LinkedIn and partner/vendor sites. We are not responsible for the privacy practices of those third parties, and we encourage you to review their privacy policies.

13. Contact Us / Exercising Your Rights

To ask a question about this Policy, exercise a privacy right described above, or opt out of text messages, contact us at:

If you are in the EEA, UK, or Switzerland and are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority or the ICO.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. We will post the revised Policy on this page with an updated “Last updated” date, and, for material changes affecting EEA/UK/Swiss individuals or where otherwise required by law, provide additional notice.