Privacy Policy

1. Information We Collect

Information You Provide Directly

When you book a briefing through our scheduling link, request a resource, subscribe to our briefing, or email us directly at info@variantsec.com, we collect:

• Name — so we can address you personally.
• Email address — so we can respond and send the meeting invitation.
• Company name (optional) — so we can understand your organizational context.
• Meeting notes — any context you choose to share when booking a call. Please do not include passwords, credentials, or classified information.
• Resource downloads — name, email address, and company when you request a whitepaper or other gated material, so we can deliver it and follow up on your interest.
• Newsletter — your email address if you subscribe to our briefing. We use a double opt-in process; you can unsubscribe at any time via the link in every email.

Information Collected Automatically

We use the following website analytics services.

Cloudflare Web Analytics (cookieless). Cloudflare Web Analytics is a privacy-focused, cookieless analytics service that we use to understand aggregate traffic patterns. It does not:

• Set cookies or use browser storage.
• Track visitors across sites.
• Collect or store personally identifiable information.

HubSpot (consent-based). With your consent, we use HubSpot analytics cookies to understand how visitors use our Site — which pages are viewed, how visitors arrive, and whether they return. These cookies are set only after you opt in via our consent banner, and you can withdraw consent at any time via the “Cookie Settings” link in the footer (see “Cookies and Consent Management” below). If you later submit a form on our Site, HubSpot associates your consented browsing activity on this Site with your contact record, so we can understand which content led to your inquiry.

Google Analytics (consent-based). With your consent, we also use Google Analytics to measure aggregate site usage, such as page views, traffic sources, and visitor flows. These cookies are likewise set only after you opt in via our consent banner, and consent can be withdrawn at any time in the same way.

Your IP address is processed by Cloudflare for content delivery, DDoS protection, and network routing. We do not have access to individual IP addresses through Cloudflare Web Analytics—only aggregate, anonymized metrics such as page views, referrers, and browser types.

Information from Third-Party Sources

When you contact us or become a business lead, we may enrich your contact record with business information obtained through our CRM provider’s data enrichment service (HubSpot Breeze Intelligence), such as your job title, company name, company size, industry, and business contact details. This information originates from publicly available and commercially licensed business sources. We use it solely to understand your organizational context and respond to your inquiry appropriately; we do not enrich records with information about your private life. You may object to this processing at any time (see “Your Rights”).

2. Cookies and Consent Management

Cookies are small text files stored in your browser. We use technically required cookies, which are necessary to operate the Site securely, and — only with your consent — optional analytics cookies.

If you are visiting from the EEA, the United Kingdom, or Switzerland, our consent banner asks for your choice before any optional cookies are set. You can consent per category, decline entirely, or change your decision at any time via the Cookie Settings link in the footer of every page. If you decline, only technically required cookies are set.

Where our consent banner applies (EEA, United Kingdom, Switzerland), we honor Global Privacy Control (GPC): if your browser broadcasts a GPC signal, it is treated as declined consent automatically — no banner interaction is required, and no analytics cookies are set.

Technically required cookies (no consent required)

Analytics cookies (set only with your consent)

3. How We Use Your Information

We use the information we collect to:

• Respond to your briefing request or inquiry.
• Schedule meetings and follow-up conversations.
• Send you product information directly related to your inquiry.
• Send you marketing communications — such as our newsletter, or follow-up emails about resources you have requested — only with your consent or in connection with your inquiry. Every such email contains an unsubscribe link. Our marketing emails may record whether an email was opened and which links were clicked; unsubscribing ends this as well.
• Understand aggregate site traffic and improve the Site.
• Comply with applicable legal obligations.

4. Legal Bases for Processing

If you are located in the European Economic Area (EEA) or the United Kingdom, our legal bases for processing your personal data are:

• Pre-contractual steps (Art. 6(1)(b)) — When you book a briefing or send us an inquiry, you are asking us to take steps prior to potentially entering into a contract. Processing your contact information is necessary to respond to that request.
• Consent (Art. 6(1)(a)) — For optional analytics cookies and for marketing communications such as our newsletter. You may withdraw consent at any time with effect for the future: for cookies via the “Cookie Settings” link in the footer, for emails via the unsubscribe link in every message.
• Legitimate interest — We have a legitimate interest in collecting aggregate, anonymized analytics to operate and improve the Site, and in enriching business contact records with professional information to understand and respond to inquiries, where this does not override your fundamental rights.

5. Data Sharing and Disclosure

We do not sell your personal information to third parties. We engage trusted third-party service providers to support the Site. These providers may have access to your information only to perform specific tasks on our behalf and are obligated not to disclose or use it for other purposes:

• Cal.com: Meeting scheduling and calendar integration
• Cloudflare: Website hosting, CDN, DDoS protection, and cookieless web analytics
• Google Fonts: Web font delivery
• HubSpot: CRM, forms, scheduling, email delivery, and consent-based website analytics. Our contracting entity is HubSpot Ireland Ltd., and the data in our account is hosted in HubSpot’s EU data centre in Germany. HubSpot’s U.S. parent company may access data for support and operations; HubSpot is certified under the EU–U.S. Data Privacy Framework and additionally relies on Standard Contractual Clauses.
• Google: Website analytics (Google Analytics). Our provider for visitors from the EEA, UK, and Switzerland is Google Ireland Ltd.; personal data may be transferred to Google LLC in the United States, which is certified under the EU–U.S. Data Privacy Framework. Google Analytics cookies are set only with your consent.

We may share your information only in the following limited circumstances:

• Service providers: With the providers listed above, who are bound by contractual obligations to keep your information confidential and use it only for providing services to us.
• Legal requirements: When required by law, court order, subpoena, or other legal process; to establish or exercise our legal rights; or to defend against legal claims.
• Protection of rights: When we believe disclosure is necessary to investigate, prevent, or take action regarding illegal activities, suspected fraud, or situations involving potential threats to safety or violations of these terms.
• Business transfers: In connection with any merger, sale of company assets, or acquisition. You will be notified of any such change in ownership or control.
• With your consent: When you explicitly agree to share your information for a specific purpose.
• Aggregated data: We may share aggregated, de-identified data that cannot reasonably be used to identify you.

6. Data Retention

• Meeting booking data: Retained for up to 24 months from the date of your last interaction with us, then deleted.
• Analytics data: Aggregate only. No personal data is retained by us through Cloudflare Web Analytics.
• Email correspondence: If we correspond with you by email following a briefing booking or direct inquiry, those emails are retained for up to 5 years after your last interaction with us, then deleted, unless a longer retention period is required by law.
• CRM and inquiry data (HubSpot): Retained for up to 24 months after your last meaningful interaction with us, then deleted or anonymized, unless an active business relationship exists or a longer period is required by law.
• Newsletter data: Retained until you unsubscribe. We then keep a minimal suppression record to honor your objection.
• Consent records: Retained as long as necessary to demonstrate compliance with legal obligations.

7. Your Rights

For EEA and UK Residents (GDPR / UK GDPR)

You have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Request erasure (“right to be forgotten”).
• Restrict processing of your data.
• Data portability—receive your data in a structured, machine-readable format.
• Object to processing based on legitimate interest.
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
• Lodge a complaint with your local data protection supervisory authority.

For California Residents (CCPA / CPRA)

In the preceding 12 months, we have collected the following categories of personal information: identifiers (name, email address, company name) and internet or other electronic network activity information (aggregate, anonymized page-view data via Cloudflare Web Analytics and, where you have consented, cookie-based analytics data via HubSpot and Google Analytics, including cookie identifiers and pages viewed), and, where we enrich business contact records, professional or employment-related information (such as job title, company, and industry) obtained from our CRM provider’s data enrichment service. You have the right to:

• Know what personal information we collect and how it is used.
• Request deletion of your personal information.
• Request correction of inaccurate personal information.
• Non-discrimination for exercising your privacy rights.
• Opt out of the sale of personal information. Note: we do not sell personal information.

We do not track you across third-party websites. Because we do not sell or share personal information, the Global Privacy Control (GPC) opt-out of sale or sharing does not apply to our Site. We do not respond to the legacy Do Not Track (DNT) browser setting.

To exercise any of these rights, contact us at privacy@variantsec.com. We will respond within 30 days.

8. International Data Transfers

Where your data is processed depends on the service. Data in our HubSpot account (CRM, form submissions, email, and website analytics) is hosted in HubSpot’s EU data centre in Germany; other service providers process data in the United States and at globally distributed locations (for example, Cloudflare’s edge network). Where personal data is transferred to the United States or other third countries, we rely on appropriate safeguards, including our providers’ certifications under the EU–U.S. Data Privacy Framework and Standard Contractual Clauses. Our service providers (Cal.com and Cloudflare) maintain Standard Contractual Clauses (SCCs) and other appropriate safeguards for lawful international data transfers. Our service providers may also process data at locations outside the United States (for example, Cloudflare processes requests at globally distributed edge nodes). All such transfers are subject to appropriate safeguards, including Standard Contractual Clauses where applicable.

9. Children’s Privacy

This Site is not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal information, please contact us at privacy@variantsec.com and we will delete the data promptly.

10. Security

We take reasonable measures to protect your personal data, including serving all traffic over HTTPS via Cloudflare, minimizing the data we collect, and using reputable service providers. However, no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Changes to This Policy

We may update this privacy policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. For material changes, we may also post a notice on the Site. Your continued use of the Site after any changes constitutes your acceptance of the updated policy.

12. Contact

For privacy-related inquiries or to exercise your data rights:
privacy@variantsec.com

For general inquiries:
info@variantsec.com

For data-protection inquiries from the European Economic Area or the United Kingdom, you may also contact our EU establishment, Variant Security Germany GmbH, at privacy@variantsec.de.