Legal

Privacy Policy

Effective August 12, 2026Updated August 12, 2026

This Privacy Policy explains how Hexkey ("Hexkey," "we," "us," or "our") collects, uses, discloses, and protects personal information when you visit hexkey.com, contact us, or use our client portal (collectively, the "Site"). It also describes your privacy rights and how to exercise them.

Hexkey provides penetration testing, security assessments, and cybersecurity advisory services. This Policy covers personal information we handle as a controller in connection with the Site and our own business operations. Where we process personal information on behalf of a client as part of a security engagement, we do so as a processor (or service provider) under the terms of the applicable signed service agreement and any data processing agreement, and that agreement—not this Policy—governs that processing.

By using the Site, you acknowledge that you have read and understood this Privacy Policy.

1. Who We Are (Controller)

For personal information handled in connection with the Site, the data controller is:

Hexkey
1000 Brickell Ave, Ste 715
Miami, FL 33131
United States
Email: contact@hexkey.com

2. Information We Collect

We collect personal information in the following ways.

2.1 Information you provide directly. When you fill out a contact or enquiry form, request information, or otherwise communicate with us, we may collect your name, business email address, company or organization name, job title, phone number, and the contents of your message, along with any information you choose to include (such as details about your architecture, systems, timing, or prior testing).

2.2 Client Portal account information. If you are an authorized client user, we collect information needed to provision and secure your account, such as your name, email address, organization, and authentication data. Materials made available to you through the portal (such as findings and reports) are handled under your organization's service agreement.

2.3 Information collected automatically. When you visit the Site, we and our service providers automatically collect certain technical information, which may include your IP address, device and browser type, operating system, referring and exit pages, pages viewed, links clicked, approximate location derived from IP address, and the dates and times of your visits. We collect this information using cookies and similar technologies (see Section 4) and server logs.

2.4 Information from third parties. We may receive limited information from service providers that help us operate the Site, deliver email, and analyze usage, as well as from publicly available sources or referrals in the ordinary course of business development.

We do not intentionally collect special categories of personal data (such as health, biometric, or government-ID data) through the Site, and we ask that you not submit such information through our forms.

3. How We Use Your Information

We use personal information for the following purposes:

To respond to enquiries and communicate with you about your requests, our services, and scheduling;
To provide and secure the Client Portal, including authenticating users, delivering deliverables, and protecting against unauthorized access;
To operate, maintain, and improve the Site, including analyzing usage and understanding how visitors interact with our content;
To ensure security and integrity, including detecting, investigating, and preventing fraudulent, unauthorized, or illegal activity and protecting our systems, users, and rights;
To send business communications, such as responses, service updates, and, where permitted, occasional information about our services (you can opt out of marketing messages at any time);
To comply with legal obligations, enforce our agreements, and establish, exercise, or defend legal claims.

4. Cookies and Similar Technologies

We use cookies and similar technologies to operate the Site and understand how it is used. The categories we use are:

Strictly necessary cookies. Required for the Site to function, including session management, load balancing, and security (such as protecting the Client Portal and preventing abuse). These cannot be switched off through our systems.
Analytics cookies. Used to understand how visitors find and use the Site—for example, which pages are visited and how our content performs—so we can improve it. These are set by us or by analytics providers acting on our behalf. We use this information in aggregated or pseudonymized form wherever practicable.

We do not use advertising or cross-site retargeting cookies on the Site.

Where required by law (for example, in the EU and UK), we request your consent before setting non-essential (including analytics) cookies, and you can withdraw consent or change your preferences at any time through our cookie banner or settings. You can also control cookies through your browser settings; note that blocking strictly necessary cookies may cause parts of the Site to stop working.

For more detail about the specific cookies and analytics providers in use, please contact us at contact@hexkey.com.

5. Legal Bases for Processing (EU/UK)

If you are in the European Economic Area (EEA) or the United Kingdom, we process your personal information only where we have a valid legal basis under the GDPR / UK GDPR:

Consent — where you have given consent, such as for non-essential cookies or certain marketing communications (you may withdraw consent at any time);
Contract — where processing is necessary to take steps at your request before entering into a contract, or to provide the Client Portal and services to your organization;
Legitimate interests — where processing is necessary for our legitimate interests, such as responding to enquiries, securing and improving the Site, and running our business, provided those interests are not overridden by your rights;
Legal obligation — where we must process information to comply with the law.

Where we rely on legitimate interests, you have the right to object as described in Section 9.

6. How We Share Your Information

We do not sell your personal information. We share personal information only as described below:

Service providers. With vendors who perform services on our behalf—such as website hosting, email delivery, cloud infrastructure, and analytics—under contracts that require them to protect your information and use it only to provide services to us.
Professional advisers. With auditors, lawyers, accountants, and insurers where necessary.
Legal and safety. Where we believe disclosure is required by law, regulation, legal process, or governmental request, or is necessary to protect the rights, property, or safety of Hexkey, our users, or others, or to enforce our agreements.
Business transfers. In connection with a merger, acquisition, financing, reorganization, or sale of all or part of our business, in which case personal information may be transferred as part of that transaction, subject to this Policy.
With your direction. Where you ask us to share your information or otherwise consent to sharing.

We do not disclose personal information to third parties for their own independent marketing purposes.

7. Data Retention

We keep personal information only for as long as necessary to fulfill the purposes described in this Policy, including to provide the Site and Client Portal, comply with our legal, tax, and accounting obligations, resolve disputes, and enforce our agreements. When personal information is no longer needed, we securely delete or anonymize it. Retention periods vary depending on the type of information and the reason we hold it. Materials handled under a client engagement are retained in accordance with the applicable service agreement.

8. Data Security

As a security-focused organization, we maintain administrative, technical, and organizational measures designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. These measures include access controls, encryption in transit, logging, and least-privilege practices. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. If you have reason to believe your interaction with us is no longer secure, please contact us immediately at contact@hexkey.com.

9. Your Privacy Rights (EU/UK / GDPR)

If you are located in the EEA or the UK, you have the following rights, subject to certain conditions and exemptions:

Access — to obtain confirmation of whether we process your personal information and a copy of it;
Rectification — to have inaccurate or incomplete information corrected;
Erasure — to have your personal information deleted in certain circumstances;
Restriction — to restrict our processing in certain circumstances;
Portability — to receive your personal information in a structured, commonly used, machine-readable format and to have it transmitted to another controller where technically feasible;
Objection — to object to processing based on our legitimate interests, and to object to direct marketing at any time;
Withdraw consent — where we rely on consent, to withdraw it at any time without affecting the lawfulness of processing before withdrawal.

To exercise these rights, contact us at contact@hexkey.com. You also have the right to lodge a complaint with your local data protection authority (in the UK, the Information Commissioner's Office). We would, however, appreciate the chance to address your concerns before you do so.

10. Your Privacy Rights (California / U.S. State Laws)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), provides you with the following rights, subject to certain exceptions:

Right to know — to request the categories and specific pieces of personal information we have collected, the sources, the purposes for collecting it, and the categories of third parties with whom we share it;
Right to delete — to request deletion of personal information we collected from you;
Right to correct — to request correction of inaccurate personal information;
Right to opt out of sale or sharing — you have the right to opt out of the "sale" or "sharing" of personal information. We do not sell or share your personal information as those terms are defined under the CCPA/CPRA;
Right to limit use of sensitive personal information — we do not use or disclose sensitive personal information for purposes that would trigger this right;
Right to non-discrimination — we will not discriminate against you for exercising your rights.

Categories of personal information. In the past 12 months, we may have collected the following categories of personal information as defined by the CCPA/CPRA: identifiers (such as name and email address), professional or employment-related information (such as company and job title), internet or other electronic network activity information (such as browsing and interaction data), and geolocation data (approximate, from IP address). We collect this information for the business purposes described in Section 3 and disclose it to service providers as described in Section 6.

To exercise your California rights, contact us at contact@hexkey.com. We will verify your request by matching the information you provide against the information we hold. You may use an authorized agent to submit a request on your behalf, subject to verification. Residents of other U.S. states with comprehensive privacy laws may have similar rights and can contact us using the same details.

11. How to Exercise Your Rights

To make any privacy request, email us at contact@hexkey.com with enough detail for us to understand and respond to your request. We will respond within the timeframes required by applicable law. We may need to verify your identity before acting on your request and may decline requests where an exception applies, in which case we will explain why.

12. International Data Transfers

Hexkey is based in the United States, and we and our service providers may process personal information in the United States and other countries whose data protection laws may differ from those in your jurisdiction. Where we transfer personal information from the EEA or the UK to a country that has not been deemed to provide an adequate level of protection, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses (and the UK Addendum or International Data Transfer Agreement where applicable). You may contact us for more information about these safeguards.

13. Children's Privacy

The Site is intended for businesses and professionals and is not directed to children. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact us at contact@hexkey.com and we will take appropriate steps to delete it.

14. Third-Party Links

The Site may contain links to third-party websites and services. This Privacy Policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party sites you visit.

15. Do Not Track

Some browsers offer a "Do Not Track" (DNT) signal. Because there is no common industry standard for interpreting DNT signals, the Site does not currently respond to them. We will honor legally recognized opt-out preference signals (such as Global Privacy Control) where required by applicable law.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date above and, where required, provide additional notice. Material changes will become effective when posted on the Site. We encourage you to review this Policy periodically.

17. Contact Us

If you have questions or requests regarding this Privacy Policy or our handling of your personal information, please contact us:

Hexkey
1000 Brickell Ave, Ste 715
Miami, FL 33131
United States
Email: contact@hexkey.com
Website: hexkey.com