Privacy Policy

Last updated: 24/02/2026

1. Who is responsible for your data

NINE Cybersecurity (“we”) is the controller of the personal data collected through ninecybersecurity.com.

We are not required to appoint a Data Protection Officer. Any questions about this policy can be sent to info@ninecybersecurity.com.

2. What we collect

Information you give us. When you contact us through a form or by email, we receive your name, email address, and anything else you choose to include — typically your company, telephone number and the content of your message.

Technical information. Our hosting infrastructure briefly processes your IP address and browser details to deliver pages and protect the site against abuse. We do not use this to identify you.

Aggregate traffic data. We use cookieless analytics that count page views by country, device type and referral source. This does not identify individual visitors. See our [Cookie Policy].

We do not collect special categories of data, and we ask that you do not send us sensitive information, security findings, credentials or personal data about third parties through this website.

3. Why we process it, and on what basis

We process personal data to respond to enquiries, manage contracted services, keep the website secure, meet invoicing and legal obligations, and—where you have agreed—send occasional service updates. These activities are based on the steps required before a contract, contractual necessity, our legitimate interests, legal obligations, or your consent.

We do not use your data for automated decision-making or profiling.

4. Who else sees it

We do not sell your data, and we do not share it with advertising networks.

We rely on a small number of service providers who process data on our behalf under written agreements:

• Framer B.V., which hosts the website and delivers form submissions to us;

• [our email provider], through which your message reaches us and is stored;

• [our accountant], where invoicing data is legally required.

Where a provider processes data outside the European Economic Area, such transfers are covered by the European Commission’s Standard Contractual Clauses.

We may also disclose data where required by law or by a competent authority.

5. How long we keep it

Enquiries that do not lead to an engagement are kept for [24 months] and then deleted.

Client records are kept for the duration of the relationship. Invoicing and accounting records are kept for ten years, as required by Portuguese tax law.

6. How we protect it

We apply access control, encryption in transit, multi-factor authentication on the accounts used to access your data, and the principle of least privilege. Access to enquiries and client records is limited to those who need it to do the work.

No system is immune. If a breach occurs that is likely to pose a risk to your rights, we will notify the CNPD within 72 hours and, where required by law, inform you.

7. Your rights

You have the right to request access to your data, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable format. Where processing is based on consent, you may withdraw that consent at any time without affecting what was done before.

To exercise any of these rights, write to info@ninecybersecurity.com. We will respond within one month.

If you believe we have handled your data improperly, you may file a complaint with the Comissão Nacional de Proteção de Dados (CNPD) at cnpd.pt.

8. Changes

We may update this policy. The version published here is the one in force, and the date of the last update is shown at the top.