Your Data Rights

1. Your rights at a glance

• Right of access (Article 15) — see what personal data we hold about you
• Right to rectification (Article 16) — correct inaccurate or incomplete data
• Right to erasure (Article 17) — have your personal data deleted
• Right to restriction (Article 18) — limit our processing of your data
• Right to data portability (Article 20) — receive your data in a machine-readable format
• Right to object (Article 21) — object to specific processing activities
• Right to withdraw consent — withdraw consent for processing based on consent

2. Remove your data from our systems

Each system that holds your personal data has its own removal mechanism. Below are the steps for each one. If you want comprehensive deletion across every system, see section 2.4.

2.1 Email database (Brevo)

QSECDEF uses Brevo (Sendinblue SAS, France) to send newsletters and member communications. Two removal options are available.

Option A — Unsubscribe from emails

Every email we send contains an unsubscribe link in the footer. Clicking that link stops further emails. Your contact record is retained marked as opted-out (this is required so we do not accidentally re-import you in the future).

Option B — Full removal from our email database

To remove your contact record entirely from Brevo:

Send an email to info@qsecdef.com with the subject line "REMOVE FROM BREVO" from the email address you wish to remove. We action the deletion within one working day and reply to confirm. Your record is purged from the Brevo database and is not retained or re-imported.

A self-service removal form is being deployed. Until it is live, the email mechanism above is the working channel and is actioned within one working day.

2.2 Membership account (Mighty Networks)

The QSECDEF community is hosted on Mighty Networks. To cancel your membership and delete your member account:

1. Log in at qsecdef.com
2. Click your profile image in the top right, then Account Settings
3. Click Membership, then Cancel Membership
4. Follow the on-screen confirmation prompts

Cancelling your membership stops your subscription. To also delete your personal data from Mighty Networks:

5. From Account Settings, click Privacy, then Delete Account, OR
6. Email info@qsecdef.com with the subject "DELETE MIGHTY NETWORKS ACCOUNT" and we will action the deletion within one working day

If you are cancelling within the refund window, you can also request a refund — see our Refund Policy for the seven-day commercial guarantee and the fourteen-day EU and UK statutory cancellation rights.

2.3 All other systems

For deletion across every other system where we hold your data — including Stripe transaction metadata, Cloudflare authentication logs, our hosted directories, and contact form enquiries — send an email to info@qsecdef.com with the subject line "ERASURE REQUEST".

Please include:

• The email address used
• Any other identifiers you used (member ID, contact form submission date, organisation name)

We acknowledge within two working days and complete the erasure within one calendar month per UK GDPR Article 12(3), or notify you of any extension required for complex requests.

2.4 Full erasure across all systems

If you want to be removed everywhere in one request, send a single email to info@qsecdef.com with the subject line "FULL ERASURE REQUEST". We coordinate the deletion across all systems and confirm completion in one reply.

3. Where your data lives

Each system below holds a different category of personal data. Removing from one system does not automatically remove from another — that is by design, because Stripe transaction records are required to be retained under financial regulation while your Mighty Networks profile is not.

Full sub-processor list with transfer mechanisms: /trust/sub-processors/.

4. What we cannot delete

4.1 Financial transaction records

Stripe (our downstream payment processor) is legally required to retain transaction records for up to ten years for tax, anti-money-laundering, and chargeback dispute purposes. This is a statutory override of the Article 17 right to erasure. The retained record contains transaction metadata only — it does not include card details, which are held by Stripe under PCI DSS.

4.2 Anonymised aggregate statistics

Aggregate statistics derived from tool usage on this site (for example: distribution of Mosca calculator inputs, common Q-day estimate ranges, frequency of cryptographic algorithm look-ups) are retained indefinitely as a public-interest benchmark dataset. These statistics cannot be linked back to any individual and fall outside UK GDPR scope under Article 4(5).

Tool results that are tied to a member account or email address — for example a saved Mosca calculation in your member dashboard — are personal data and can be erased on request.

4.3 Backup snapshots

Sub-processor backup systems may retain copies of your data for up to ninety days past production erasure. Backups are not accessible for ad-hoc deletion. We instruct rotation-out on the standard schedule. This is disclosed openly because some organisations would rather know than be surprised.

5. Response time

Per UK GDPR Article 12(3):

• Acknowledgement: within two working days of receipt
• Completion: within one calendar month, extendable by a further two months for complex requests, with notification to you of the extension and the reason

Related Trust Centre pages

• Privacy Notice — what we collect, how we use it, legal bases
• Sub-processors — who processes your data and where
• Refund Policy — seven-day money-back guarantee, EU and UK fourteen-day statutory rights
• Compliance Posture — three-state framework matrix

Contact

info@qsecdef.com