Privacy and storage notice

Who is responsible

Lobraico Ltd is the controller for the processing described in this notice. The company is registered in England and Wales under company number 11453703. Its registered office is Belmont Suite, Paragon Business Park, Chorley New Road, Horwich, Bolton BL6 6HG, United Kingdom.

Privacy enquiries can be sent to [email protected].

What this notice covers

This notice covers visitors to perspican.com, people who contact us and business contacts at prospective or existing clients and suppliers. Personal data encountered inside a client's systems during a security engagement is governed by the engagement agreement, rules of engagement and, where applicable, a data processing agreement.

Information we collect

• Enquiry information: your name, email address and the message you send through the contact form or contact widget. If you request a callback, this can also include your company, phone number, selected topic, preferred time, time zone and availability notes.
• Business information: your role, organisation and correspondence when you discuss or purchase our services.
• Technical and security information: IP address, request metadata and security signals needed to deliver the website, rate-limit requests and prevent automated abuse.
• Website measurement information: the page visited, language, approximate location supplied by Cloudflare, the service or content interacted with, progress towards an enquiry, timestamp, short-lived pseudonymous identifiers and signals used to distinguish automated traffic. We use this information for aggregate reporting. The measurement database does not contain names, email addresses, enquiry contents, selected or copied text, clipboard contents, search terms, raw IP addresses or persistent browser identifiers.
• Language preference: when you use the language link, a first-party session cookie stores only en or it so your explicit choice takes priority over the browser's language preference during that browser session.
• Session preference: a short value in browser session storage records whether the contact prompt has already appeared on the current page during that browser session.

Please do not place passwords, private keys, production data or other unnecessary sensitive information in the website forms. Secure exchange methods can be agreed during scoping.

Why we use it

We do not currently use website enquiry details for mailing lists or behavioural advertising, and we do not sell personal information.

Cal.com booking calendar

The booking page contains an embedded calendar provided by Cal.com. When you open that page, Cal.com receives technical request information such as your IP address and browser details. If you make a booking, Cal.com processes the contact details and scheduling information you enter so that the meeting can be arranged. See the Cal.com privacy policy.

Cloudflare services, website measurement and browser storage

This site uses Cloudflare to deliver and protect the website, process contact form requests and route enquiry emails. Cloudflare Turnstile helps distinguish legitimate visitors from automated abuse. In doing so, it may process the IP address and technical information about the browser and request.

Turnstile may run without displaying an interactive challenge. Its security processing is still active when the widget is not visible. See the Cloudflare Turnstile Privacy Addendum.

We operate a first-party, cookie-free measurement system on Cloudflare infrastructure. It records limited information about page usage and interactions so that we can understand, in aggregate, how the site leads to enquiries. Short-lived pseudonymous identifiers may connect related interactions, but they are not used for advertising, individual profiling or tracking across websites. Cloudflare processes the request IP address to deliver and protect the service; Perspican does not retain the raw IP address in the measurement database. Automated-traffic signals may be used to improve the accuracy of aggregate reports.

We may use Cloudflare Web Analytics to obtain aggregate statistics about website usage and performance, such as page views, general traffic sources, country, device type and page-loading metrics. When enabled, the service does not use cookies or local storage and is not used to identify visitors, build individual profiles or track them across different websites. See the Cloudflare Web Analytics documentation.

On a first visit to the homepage, the browser's language setting is used to choose between the English and Italian versions. It does not infer language from location. If you use the language link in the footer, a strictly necessary session cookie remembers that choice until the browser session ends. It is not used for measurement, advertising or cross-site tracking.

The contact prompt uses session storage only to avoid repeating the same prompt on the same page during the current browser session. It is not used for advertising or cross-site tracking, and the browser removes it when the session ends. You can dismiss the prompt at any time using its close button.

We do not currently operate marketing, advertising or behavioural analytics cookies. If this changes, this notice and any required choice mechanism will be updated before the new technology is used.

Who receives the information

Information is shared only where needed with infrastructure, website security and business email providers; professional advisers acting under confidentiality; and public authorities where disclosure is legally required. Current website enquiries are processed through Cloudflare and delivered to Perspican's business email service. They are not stored in a separate website application database. The conversion measurement database contains no enquiry text or direct contact identifiers.

International transfers

Perspican is operated by a UK company and uses suppliers that may process information in other countries. Where data protection law requires it, transfers are based on an adequacy decision or appropriate contractual and organisational safeguards.

How long we keep information

Enquiries that do not lead to an engagement are normally deleted within 12 months of the last meaningful contact. If an engagement or supplier relationship begins, relevant contractual, accounting and correspondence records are kept for the period required by law and for the establishment, exercise or defence of legal claims. Security metadata is kept only for as long as needed to prevent and investigate abuse, subject to the configured retention of the relevant service provider. Engagement evidence and client-system data follow the retention agreed in the engagement documents. Raw conversion measurement rows are deleted automatically after 13 months by a scheduled maintenance task.

Your rights

Depending on the circumstances, you may ask for access to or correction of your personal data, deletion, restriction, portability, or object to processing based on legitimate interests. To make a request, email [email protected]. We may need to verify your identity before acting on a request.

You may complain to the UK Information Commissioner's Office. Where EU data protection law applies, you may also complain to the supervisory authority in the country where you live or work, or where you believe an infringement occurred.

Automated decisions and changes

We do not use the personal information covered by this notice to make solely automated decisions that produce legal or similarly significant effects. We review this notice when our processing or suppliers change and publish the revised date above.