Privacy Policy
Last updated: 29 September 2026
1. About this policy
This privacy policy explains how Exploitr Limited ("Exploitr", "we", "us" or "our") collects and uses personal data, and the rights you have in relation to it.
It applies to personal data relating to:
- visitors to our website, exploitr.com;
- people who contact us, request information or a quote, or book a call;
- contacts at our clients, prospective clients, suppliers and business partners;
- people whose personal data we process when delivering penetration testing and other security services;
- users of systems we provide or use to manage engagements, including the Exploitr platform; and
- people who apply to work with us.
2. Who we are
Exploitr Limited (trading as Exploitr) is a company registered in England and Wales under company number 15939324.
Registered office: Bradbury House, Mission Court, Newport, NP20 2DW
Exploitr Limited is the controller of personal data where we determine the purposes and means of processing that personal data. This includes personal data we collect and use for our own business purposes, such as responding to enquiries, managing business relationships, delivering our services, operating our systems and website, marketing, recruitment, and complying with our legal obligations.
Where we process personal data on behalf of a client, the client will generally be the controller and Exploitr will generally act as a processor. In those circumstances, the client determines the purposes and means of processing, and Exploitr processes the personal data in accordance with the client's documented instructions and the contractual arrangements between us, including any applicable data protection and security terms.
Exploitr Limited is registered with the Information Commissioner's Office under registration number ZB815039.
3. Personal data we process during security testing
Our principal business is providing penetration testing, vulnerability assessments, red-team exercises and related security services. In the course of providing these services, we may process personal data on behalf of our clients.
Personal data encountered in the course of security testing may include information relating to the client's employees, customers, users or other individuals. We do not use personal data processed on behalf of a client for our own independent purposes, including marketing or advertising.
Some engagements, such as red-team exercises and social engineering assessments, may involve deliberately gathering information about a client's employees. This can include information from publicly available sources or responses to simulated phishing. We carry out these activities only within the scope and rules of engagement agreed in writing with the client, and only on the client's instructions.
Personal data may also be encountered incidentally during security testing. Where this happens, we access and collect only what the relevant testing activity requires. Where evidence is needed to demonstrate a security finding, that evidence may contain personal data visible within the tested environment. We take reasonable steps to minimise or redact personal data in reports where doing so does not undermine the finding.
We may use general knowledge gained from our work, such as attack techniques and vulnerability trends, to inform our security research. We do not use client personal data for this purpose. Any research we publish is prepared so that it does not identify individuals or clients.
The Exploitr platform is our online platform through which clients view findings, access reports and manage engagements. We act as a processor for the engagement data clients hold in the platform, and as a controller for the account information of the people who use it (see Section 4).
The handling, retention and deletion of personal data processed on behalf of a client are governed by the contractual arrangements and data protection terms agreed with that client. Clients can ask us to delete personal data we hold on their behalf, or delete it themselves through the platform, subject to those arrangements. Deleted data may remain in backups before it is permanently removed.
4. Personal data we collect and control ourselves
When we act as a controller, the personal data we collect depends on how you interact with us.
This may include:
Identity and contact information: your name, job title, employer, email address, telephone number, and business address.
Enquiry and engagement information: information contained in enquiries, correspondence, forms and questionnaires, together with notes of calls and meetings, information about your organisation and its requirements, and details of the services you are interested in.
Contract and commercial information: proposals, statements of work, contracts, purchase orders, invoices, payment information and records relating to our business relationship. We do not store full payment card details. Where payments are made by card or through another payment service, payment information is handled by the relevant payment provider.
Account and engagement-management information: where you use a system that we provide or use to manage an engagement, we may process your name, email address, organisation, role, permissions, login information and records of activity within that system.
Website and technical information: IP address, browser and device information, pages visited, referring website and information about how you interact with our website. Some of this information is collected using cookies and similar technologies. See Section 8.
Marketing information: your marketing preferences and records of communications we have sent to you, including whether you have opened or interacted with certain marketing emails.
Recruitment information: CVs, applications, cover letters, employment history, qualifications, certifications, references and notes made during recruitment.
Vetting and screening information: where a role requires it, information from identity and right-to-work checks, criminal record checks (such as a basic DBS check), credit checks, employment history verification and security clearance processes.
Special category data: we do not generally collect special category data. Where we do, we do so only where a condition under UK data protection law applies. For example, we may collect health or disability information so that we can make reasonable adjustments.
We collect most of this information directly from you. We may also obtain business contact information from publicly available sources, professional networking platforms, company websites, referrals and other legitimate business sources. Where we obtain personal data indirectly, we will provide any information required by applicable data protection law about the source of that data and how we use it.
Whether you have to provide personal data
You are not generally required by law to provide personal data to us. However, some information is needed to enter into or perform a contract with you, such as contact and billing details for an engagement. If you apply for a role, we will need certain information to assess your application and carry out any required checks. If you do not provide this information, we may be unable to proceed.
5. How we use personal data and our lawful bases
We use personal data for the following purposes:
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries and requests | Legitimate interests, or taking steps at your request before entering into a contract |
| Understanding requirements and preparing proposals | Taking steps at your request before entering into a contract, and legitimate interests |
| Delivering contracted services and managing engagements | Performance of a contract where applicable, and legitimate interests in managing and delivering our services |
| Communicating with clients about active engagements | Performance of a contract and legitimate interests |
| Managing access to systems used to deliver or manage engagements | Legitimate interests in maintaining appropriate access and security, and performance of a contract where applicable |
| Maintaining records of engagement activity and communications | Legitimate interests and, where applicable, legal obligations |
| Invoicing, receiving payments and maintaining financial records | Performance of a contract and legal obligations |
| Managing suppliers and business partners | Legitimate interests and, where applicable, performance of a contract |
| Sending marketing communications | Legitimate interests or consent, depending on the circumstances and applicable law |
| Operating and securing our website | Legitimate interests |
| Website analytics and other non-essential cookies | Consent, where required by law |
| Recruiting and assessing applicants | Legitimate interests and taking steps at the applicant's request before entering into a contract |
| Carrying out pre-engagement vetting and screening of candidates, including criminal record checks | Legitimate interests and, where applicable, legal obligation |
| Making reasonable adjustments for applicants | Legal obligation, and the employment condition for special category data |
| Complying with legal and regulatory obligations | Legal obligation |
| Establishing, exercising or defending legal claims | Legitimate interests and, where applicable, legal obligations |
Where we rely on legitimate interests, we have considered those interests against your rights and freedoms and will not rely on this basis where those rights override our interests.
You can ask us for further information about our legitimate interests assessment.
We do not sell, rent or trade personal data.
We do not make decisions about you based solely on automated processing, including profiling, that produce legal or similarly significant effects.
6. Marketing
We may send business contacts information about our services, security research, events and other information that may be relevant to their professional role. We will comply with applicable rules governing electronic marketing. Where consent is required, we will obtain it unless a lawful exception applies.
Where we obtain business contact details from public sources, their public availability does not by itself mean that the individual has consented to receive marketing communications from us.
You can opt out of marketing communications at any time by using the unsubscribe link in a marketing email or by contacting us at contact@exploitr.com.
Unsubscribing from marketing communications does not affect service or administrative communications that we need to send in connection with an engagement or business relationship.
Our marketing emails contain a tracking pixel and may contain tracked links, which tell us whether an email has been opened or a link clicked. We only send marketing emails, and so only use this tracking, where you have signed up to receive them. We do not add anyone as a marketing contact by default. You can withdraw your consent at any time by using the unsubscribe link in our emails or contacting contact@exploitr.com. Many email programs also let you block images, which prevents pixel tracking.
7. Calls and meeting records
We may make notes of calls and meetings to help us understand requirements, manage engagements and maintain records of our business relationships.
Where calls or meetings are recorded or transcribed, we will provide any notices and obtain any consent required by applicable law.
We may use third-party meeting, transcription or meeting-assistance services where appropriate. Where such services process personal data on our behalf, we take appropriate steps to address confidentiality, security and data protection requirements.
8. Cookies and website technologies
Our website uses cookies and similar technologies.
Some cookies are essential for the website to operate, maintain security or provide services you have requested. Other cookies, such as analytics and advertising cookies, are non-essential.
We use CookieYes to manage consent. Non-essential cookies are only set once you have accepted them through our cookie banner, and you can change or withdraw your choices at any time using the cookie preferences button at the bottom left of the page.
We use analytics technologies to help us understand how visitors use our website. Analytics information may include IP addresses and device information and should not be assumed to be anonymous simply because we use the information in aggregate.
For more information about the cookies we use, their purposes and their retention periods, see our Cookie Policy.
9. Who we share personal data with
When we act as a controller, we may share personal data where necessary with:
Service providers. We use third-party service providers to support the operation of our business and the delivery of our services. Depending on the circumstances, these may provide hosting, email, productivity, customer relationship management, accounting, payment processing, communications, document management, recruitment or other business services.
Where a service provider processes personal data on our behalf, we require the processing to be subject to appropriate contractual, confidentiality and data protection arrangements. Information about the service providers we use to process personal data on our behalf is available on request, where applicable.
Vetting and screening providers. Where a role requires vetting, we share applicant information with screening providers, including credit reference agencies and organisations that process DBS checks, so that they can carry out the checks described in Section 14.
Professional advisers. We may share personal data with accountants, lawyers, insurers and other professional advisers where reasonably necessary.
Authorities and regulators. We may disclose personal data where required by law, regulation or legal process, or where reasonably necessary to establish, exercise or defend legal claims.
Business transfers. If Exploitr, or substantially all of its assets, are acquired, transferred or reorganised, personal data may be transferred as part of that transaction, subject to applicable confidentiality and data protection requirements.
We do not disclose client personal data encountered during security testing for our own purposes. Where third-party processors are used to process client personal data as part of an engagement, their use is governed by our contractual arrangements with the relevant client.
10. International transfers
Some of the organisations we use to provide services or support our business may process personal data outside the United Kingdom.
Where personal data is transferred outside the UK, we will ensure that the transfer is subject to an appropriate safeguard or other mechanism recognised under applicable UK data protection law.
Further information about particular international transfers and the safeguards relied upon may be available on request, where appropriate.
11. How long we keep personal data
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including to meet legal, regulatory, tax and accounting requirements and to establish, exercise or defend legal claims.
Retention periods vary depending on the nature of the information, the purpose for which it is processed and our legal and contractual obligations.
Where we process personal data on behalf of a client in connection with our services, its retention and deletion are governed by the applicable contractual arrangements and data protection terms agreed with that client.
12. Security
We take the security and confidentiality of personal data seriously and use appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful access, alteration, disclosure, loss or destruction.
The measures we apply may vary depending on the nature of the information and the circumstances in which it is processed.
Further information about our security practices may be made available to clients and prospective clients as part of our security and due-diligence processes.
13. Your rights
Under UK data protection law, you may have rights in relation to your personal data, including the right to:
- request access to personal data we hold about you;
- request correction of inaccurate or incomplete personal data;
- request deletion of personal data in certain circumstances;
- request restriction of processing in certain circumstances;
- object to processing based on legitimate interests;
- object to direct marketing;
- request portability of certain personal data where the right applies; and
- withdraw consent where we rely on consent as our lawful basis.
These rights are subject to applicable legal conditions and exemptions. To exercise your rights, contact us at contact@exploitr.com. We may need to verify your identity before responding.
We will respond within the period required by applicable data protection law, typically within one month. Where permitted by law, this period may be extended where a request is complex, or you have made multiple requests. There is normally no charge for exercising your rights.
Requests relating to client data
Where we process personal data on behalf of a client, the client will generally be responsible for responding to requests concerning that data.
If you believe that your personal data has been processed in connection with a security engagement performed for one of our clients, you should normally contact that organisation in the first instance. We will provide appropriate assistance to the client where required by applicable law and our contractual arrangements.
14. Recruitment
If you apply to work with us, we may process information contained in your application, CV, cover letter, employment history, qualifications, certifications, references and interview notes.
We use this information to assess your application, communicate with you during the recruitment process and, where applicable, take steps before entering into an employment or contractor relationship.
Because of the nature of our work, which involves access to clients' systems and sensitive information, some roles are subject to vetting and screening before an offer is confirmed. This may include identity and right-to-work checks, criminal record checks, credit checks, verification of employment history and qualifications, and, where a client requires it, security clearance. We will tell you which checks apply to your role before they are carried out.
We process criminal offence data only where it is necessary and permitted by law. We keep an appropriate policy document explaining how we handle such information.
We retain recruitment information for as long as reasonably necessary for the recruitment process and related purposes, subject to applicable legal requirements.
15. Children
Our website and services are intended for businesses and professionals and are not directed at children.
16. Changes to this policy
We may update this privacy policy from time to time, including where we change our services, technology, suppliers or the way we process personal data.
The latest version will be published on this page with the date it was last updated.
Where we make significant changes that materially affect how we use personal data, we will take reasonable steps to notify affected individuals where required.
17. Contact and complaints
If you have questions about this privacy policy or how we use your personal data, please contact us:
- Email: contact@exploitr.com
- Phone: 0330 223 7127
If you wish to complain about how we have handled your personal data, please email contact@exploitr.com with the subject line "Data protection complaint". We will acknowledge your complaint within 30 days, investigate it without undue delay, and tell you the outcome.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator:
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline number: 0303 123 1113
Website: ico.org.uk/make-a-complaint