Privacy Policy
Last updated: 4 November 2026
Who we are
The Security Advisor (thesecurityadvisor.co.uk) is a trading name of Chestnut Risk Ltd, a company registered in England and Wales with company number 16928424. We're the "controller" of the personal information described here, and we're registered with the Information Commissioner's Office (ICO), registration number CSN0097523.
Questions about your information, or requests to use your rights: [email protected].
What we collect and why
| Information | Why we use it | Legal basis |
|---|---|---|
| Account: email address and password (stored securely, never readable by us) | To create and secure your account and let you sign in | Contract |
| Profile: display name, and optionally headline, location, "about you" and photo | Shown publicly on your profile and next to your reviews | Contract |
| Reviews you write, and courses or providers you add | Published publicly to help others choose training | Contract / legitimate interests |
| Reports you send about reviews | To deal with misuse of the site | Legitimate interests |
| CV service orders: name, email, your answers at checkout, and the CV and details you send us | To provide the service you bought and contact you about it | Contract |
| Payment records (we never see your full card details) | Taking payment, refunds and keeping accounts | Contract / legal obligation |
| Company claims: your name, job title, work email, phone number and anything you send us to show you represent the company | To check you represent the company before its profile is published, and to contact you about it. Not shown publicly. | Legitimate interests |
| Company profiles (once approved): the company's logo, description, website and any contact details you choose to add | Shown publicly on the company's profile | Legitimate interests |
| Advertising enquiries: your name, company, email and message | To reply to your enquiry | Legitimate interests |
Your display name, profile and reviews are public: please don't include anything in them you don't want others to see.
Who we share it with
We don't sell your information. We use trusted providers to run the site, and they only process it on our instructions:
- Supabase: hosts our database, accounts and file storage. Your data is stored in their London (UK) data centre.
- Stripe: processes payments for our CV services. Stripe also handles some payment information under its own privacy policy.
- Our website hosting provider: serves the website pages.
- Microsoft 365: handles our email, including CVs you send us.
Some of these companies are based in the USA. Where your information is handled outside the UK, they use approved safeguards (such as the UK International Data Transfer Agreement or the UK–US data bridge) to protect it.
We may also share information if the law requires it.
How long we keep it
- Account, profile and reviews: until you ask us to delete your account.
- CVs and details for our CV services: 36 months after we deliver your CV, so we can help with changes or tailoring, then deleted.
- Payment and order records: 6 years, as required for tax and accounting.
- Company claims: while you manage the company's profile. Claims we don't approve are deleted within 12 months.
- Enquiries: as long as needed to deal with them, and no more than 2 years.
Cookies and storage on your device
We don't use advertising or tracking cookies, and we don't use analytics. Your browser stores a small amount of information that the site needs to work: your sign-in session, and a note if you dismiss the "install the app" message. These are strictly necessary, so we don't need to ask for consent. If we add analytics in future, we'll update this policy and ask you first.
Adverts on the site are simple links and images: they don't track you.
Your rights
You have the right to:
- Ask for a copy of your information.
- Have it corrected (you can edit your profile yourself at any time).
- Have it deleted, including your account and reviews.
- Object to or restrict how we use it.
- Receive it in a portable format.
To use any of these rights, email [email protected]. We'll respond within one month.
If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to put things right first.
Keeping it safe
Passwords are stored securely using industry-standard hashing. Our database only allows each member to change their own information, and locked content and downloads are only released to members who've unlocked them.
Age
Accounts are for people aged 18 and over.
Changes
We'll update this page if anything changes, and show the date at the top.
See also our Terms of Service.