Privacy Policy

Last updated on 13 Oct 2026

Privacy Policy

This Privacy Policy describes how We collect, use and share Your information when You use Our Website, and tells You about Your privacy rights and how the law protects You.

We use Your personal data to run and improve the Website and to respond to Your enquiries. By using the Website, You agree to the collection and use of information in accordance with this Privacy Policy.

Who We are

  • Controller — Falx Ltd, a company registered in England and Wales (company number 14908727), whose registered office is at Wellington House, Aviator Court, Clifton Moor, York YO30 4UZ, and whose office is at One Embankment, Leeds LS1 4DW.
  • Contact — For anything privacy-related, email contact@falx.co or use https://falx.co/contact.

Definitions

For the purposes of this Privacy Policy:

  • Company (referred to as either “the Company”, “We”, “Us” or “Our”) refers to Falx Ltd, as above.
  • Cookies are small files placed on Your Device by a website, containing details of Your browsing activity on that website, among other uses.
  • Country refers to: United Kingdom
  • Device means any device that can access the Service, such as a computer, a mobile phone or a digital tablet.
  • Personal Data is any information that relates to an identified or identifiable individual.
  • Service refers to the Website, including its pages, the website checker tool, enquiry forms and account sign-in.
  • Service Provider means any person or company that processes data on behalf of the Company — for example, the providers that host the Website, store form submissions or manage cookie consent.
  • Usage Data means data collected automatically when You use the Service, such as pages visited, time spent and diagnostic data.
  • Website refers to Falx, the security-led managed IT and cyber security consultancy website, accessible from https://falx.co
  • Website checker means the “Check my site” tool on Our Website, which runs a quick automated check of a website address You submit and reports what it finds.
  • You means the individual accessing or using the Service, or the company or other legal entity on whose behalf they do so, as applicable.

What We collect and why

Enquiry and audit forms

  • What You give Us — When You use the contact form or request a full audit after a website check, You provide Your first and last name, email address, the services You are interested in, how You heard about Us (optional) and the details of Your enquiry.
  • Where it goes — Submissions are stored by Google Forms and Google Sheets (Google LLC). Each form is protected by a Cloudflare Turnstile check, which analyses device and browser signals to tell humans apart from bots.
  • Lawful basis — Our legitimate interest in responding to enquiries and running the business, and steps taken at Your request before entering into a contract.
  • Kept for — 24 months from Your last enquiry, then deleted.

Website checker

  • What You give Us — The website address You ask Us to check. The checker fetches that site’s public pages, headers and cookie notices to produce its report.
  • What We log — Each check is logged with the submitted address, the time of the check and a summary of the findings (for example, “FAIL: outdated CMS”). Results are also cached for about 10 minutes so repeat checks of the same address answer quickly.
  • What We do not store — Your IP address is used only while Your check is running, to enforce rate limits against abuse. It is never written to the log.
  • Where it goes — The log lives in Cloudflare’s key-value store (Cloudflare, Inc.) and entries delete themselves automatically after 180 days.
  • Lawful basis — Our legitimate interest in operating the checker, understanding how it is used and protecting it from abuse. The checker notice on the page tells You about this logging before You use it.

Accounts

  • What happens — If You sign up or sign in, Your account details (such as name and email address) are handled by Our sign-in provider, Clerk, Inc., under its own terms. The client dashboard is a separate application with its own notices.
  • Lawful basis — Performance of the account contract with You.

Cookies and analytics

  • Consent first — A CookieYes banner asks for Your choices before any non-essential cookies or trackers run. Until You choose, everything non-essential stays off, including analytics.
  • What runs with consent — Cloudflare Zaraz (which loads measurement tools for Us) and Google Analytics, governed by Google Consent Mode v2: Your CookieYes choices decide whether analytics and advertising storage are granted or denied.
  • Changing Your mind — Re-open the consent banner at any time from the cookie settings link in the Website footer. Full detail, including the cookies each category sets, is in Our Cookie Policy.
  • Lawful basis — Your consent, given through the banner. Withdrawing consent is as easy as giving it.

Technical and security data

  • What happens automatically — Cloudflare, which hosts and protects the Website, processes request data such as IP addresses and browser information to deliver pages, block attacks and keep the Service reliable.
  • Lawful basis — Our legitimate interest in a secure, working Website.

How We use Personal Data

  • To respond to You — Handling Your enquiries and audit requests, and contacting You about them by email or phone.
  • To run the checker — Producing reports, caching results and logging submissions as described above.
  • To run accounts — Providing sign-in and client areas to registered users.
  • To improve the Service — Understanding which content and tools visitors use, measuring campaigns and fixing problems, using analytics only where You have consented.
  • To keep things safe — Rate-limiting, bot detection and investigating misuse.

We do not sell Your personal data, and We do not use it for automated decision-making with legal or similarly significant effects.

Who We share it with

  • With Service Providers — Google (form and spreadsheet storage), Cloudflare (hosting, security, analytics delivery, bot protection and the checker log), CookieYes (consent management) and Clerk (sign-in and accounts). Each processes data only on Our instructions.
  • For business transfers — If the Company is involved in a merger, acquisition or asset sale, Your Personal Data may transfer with the business. We will give notice before it becomes subject to a different Privacy Policy.
  • For legal reasons — Where the law requires it, or in response to valid requests from public authorities, and where necessary in good faith to comply with a legal obligation, protect Our rights or property, investigate wrongdoing, protect personal safety or guard against legal liability.
  • With Your consent — For any other purpose, only with Your consent.

International transfers

Some of Our Service Providers process data outside the UK, including in the United States (Google, Cloudflare, CookieYes, Clerk).

We only allow such transfers where the destination is covered by UK adequacy regulations or where appropriate safeguards are in place, such as the UK International Data Transfer Agreement or the EU Standard Contractual Clauses, alongside the providers’ own security measures. Your use of the Service and submission of information represents Your agreement to that transfer as described here.

How long We keep data

  • Form enquiries — 24 months from Your last enquiry.
  • Website checker log — 180 days, then automatic deletion.
  • Analytics data — Only for as long as Your consent stands and per the retention settings of the analytics tools; withdrawing consent stops further collection.
  • Consent records — Kept while needed to prove Your choices were respected.
  • Accounts — While Your account is active, under Our sign-in provider’s terms.

We also keep information where the law requires it (for example, tax or accounting records), to resolve disputes and to enforce Our agreements. Usage Data is generally kept for shorter periods, except where it is needed for security or improving the Service.

Your rights

Under UK data protection law You have the right to:

  • Access — Ask for a copy of the Personal Data We hold about You.
  • Rectification — Ask Us to correct inaccurate or incomplete data.
  • Erasure — Ask Us to delete Your data where there is no good reason to keep it.
  • Restriction — Ask Us to pause processing in certain circumstances.
  • Objection — Object to processing based on legitimate interests, and to direct marketing at any time.
  • Portability — Receive data You provided in a portable format where processing is automated and based on consent or contract.
  • Withdraw consent — Where We rely on consent (such as cookies and analytics), withdraw it at any time without affecting what came before. Use the cookie settings link in the footer.
  • Complain — Complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk. We would appreciate the chance to help first — contact Us at contact@falx.co.

To exercise any of these rights, email contact@falx.co. We will respond within one month. Please note We may need to keep certain information where We have a legal obligation or lawful basis to do so.

Security of Your Personal Data

The security of Your Personal Data is important to Us. We use commercially reasonable measures — encrypted connections, access controls, bot protection and rate limiting — to protect it. But no method of transmission over the Internet or electronic storage is completely secure, and We cannot guarantee absolute security.

Please do Your part: do not send passwords, credentials or other highly sensitive data through the enquiry forms or the website checker.

Children’s Privacy

Our Service is intended for users over 18 and does not address children. We do not knowingly collect personally identifiable information from anyone under 18. If You are a parent or guardian and believe Your child has provided Us with Personal Data, please contact Us and We will remove it.

Our Service may contain links to other websites that are not operated by Us. If You click a third-party link, You will be directed to that third party’s site. We strongly advise You to review the Privacy Policy of every site You visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third-party sites or services.

Changes to this Privacy Policy

We may update Our Privacy Policy from time to time. We will post the new version on this page and update the “Last updated” date above. Where changes are significant, We will also give a prominent notice on the Website before they take effect.

You are advised to review this Privacy Policy periodically. Changes are effective when posted on this page.

Contact Us

If you have any questions about this Privacy Policy, You can contact us: