Neko Venture Partners Limited T/A Red Penetration, a UK-based cybersecurity consultancy and Công Ty TNHH Red Penetration Testing Services T/A Red Penetration, a partner company based in Vietnam are deeply committed to safeguarding personal data and upholding individuals' privacy. The following policy outlines our approach to collecting and managing personal data during our interactions with clients, while ensuring full respect for their rights and compliance with relevant legislation.

Unless otherwise specified in a contract, UK and worldwide clients will have a relationship with Neko Venture Partners Limited and domestic Vietnamese clients will have a relationship with Công Ty TNHH Red Penetration Testing Services. Both companies trade under the Red Penetration brand. Data may be shared between the two companies where contractually permitted and necessary for administration tasks and operational delivery of services.

Should you have any questions regarding this policy or wish to make a subject access request or exercise any other rights in accordance with the UK Data Protection Act 2018 and the European Union General Data Protection Regulation, please utilize our Contact Us page.

Alternatively, written requests can be sent to:

Data Protection Officer, Neko Venture Partners Limited, 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ

You possess the right to file a complaint about our management of your personal data with the UK Information Commissioner's Office (ICO). For more information, please visit: https://www.ico.org.uk/concerns.

Definition of Personal Data

Personal data refers to information that can directly (e.g., name, date of birth, address) or indirectly (e.g., IP addresses, cookies, etc.) identify an individual. For a more detailed definition, please refer to the Information Commissioner's Officer's web page (https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/key-definitions/what-is-personal-data/).

Collection of Personal Data

Red Penetration collects personal data, as defined above, during our operations. We do not gather special categories of personal data, such as race, beliefs, or sexual orientation.

The information we collect is primarily based on:

Legitimate interests (e.g., to provide you with direct marketing related to services similar to those you have engaged with us or inquired about). Fulfillment of contractual obligations (e.g., providing services you've purchased from us).

In the absence of your consent to provide personal data as part of a contract's fulfillment (e.g., providing our services or receiving payment), we may be unable to effectively complete the contract.

Our collection of personal data serves the following purposes:

• Business Contacts
• Operations
• Marketing

When you contact Red Penetration via phone, email, our website, or social media channels, we collect the name, job title, company name, address, email address, and telephone numbers of the contacting party. Throughout our ongoing interactions, we may also collect personal details of other individuals within your business, if required for service delivery or marketing. In cases without a legitimate interest, you must opt-in to receive marketing communications from us, and you can withdraw this consent at any time using the "unsubscribe" feature in our communications.

The collection of this information aims to provide proposals, engage in negotiations, and potentially deliver business services based on your contact.

We may share this information with our staff, associates, and necessary suppliers (e.g., solicitors and accountants) only when essential for service delivery under any existing commercial relationship. If no commercial agreement is established for our services, we will not share your information with third parties unless legally required.

We will retain this information in our Customer Relationship Management systems, email communications, and other systems and applications for as long as necessary, including meeting legal, regulatory, accounting, or reporting obligations.

All marketing emails will contain an opt-out option (via an unsubscribe link), and you may also request not to receive marketing communications from us via any source through our Contact Us page.

Use of this Website

Additionally, when you contact Red Penetration through the "contact us" page, we may collect the contacting party's name, job title, company name, address, email address, and telephone numbers or additional information if provided.

We may use cookies on our website for analytical purposes and to enhance the user experience. More details on our cookie policy can be found on our cookie policy page.

Additionally, we may collect information when you visit our website, including but not limited to your IP address, location, access time, browser, operating system, and visited pages.

This site uses Google recaptcha v3 to prevent spam via the contact form. Data sent to Google is subject to its privacy policy at https://policies.google.com/privacy

Information submitted via forms on the Red Penetration website is forwarded to staff members only, and we will retain it only for as long as necessary to meet legal, regulatory, accounting, or reporting requirements.

Sharing of Personal Data

We do not share client personal data with third parties unless legally required, requested by the client or necessary for successful service delivery. Legitimate business purposes for sharing your personal data include:

• Engaging subcontractors to deliver services as agreed under our terms and conditions.
• Using professional services like accountants or solicitors for our company's ongoing operation.
• Involving external certification service providers.
• Engaging external third parties, acting as data processors, to provide IT, application, and telephony services.

We do not sell your personal data to any other organization.

Storage of Personal Data

We may store your personal data on:

• Cloud-based email services.
• Cloud-based Customer Relationship Management (CRM) services.
• Cloud-based accountancy services.
• Cloud-based storage and backup services.
• Cloud-based Infrastructure as a Service for our internal services.
• Cloud based logging, security monitoring and antispam services.
• Systems used for detecting or preventing attacks against us and our customers, partners, suppliers, agents or their data.
• Telephony services, including Skype and Twilio.

When using these services, the data collected from you may be transferred to and stored at a destination outside the European Economic Area (EEA). When transferring your personal data outside the EEA, we ensure that our suppliers comply with GDPR legislation to afford a similar level of protection.

Special data handling instructions for assessment data can be arranged on a per-contract basis, including direct GnuPG communication with specific staff members and personalized data storage and retention requests. Data is routinely stored in UK domiciled cloud environments and can be restricted to UK services if required.

Retention of Personal Data

Personal data is retained only as long as needed to provide our services to you or fulfill our legal obligations as mentioned above. Once personal data is no longer required, it will be deleted from our storage facilities. Our data retention policy is available upon request.

Information Security of Personal Data

As a cybersecurity consultancy, Red Penetration is dedicated to the information security of the personal data it collects, processes, and stores. We are currently implementing an ISO27001 based ISMS with the aim of obtaining certification in the future.

We have implemented technical security controls and information handling policies to define how data is protected within the organization.

Your Rights

Under the terms of the UK Data Protection Act 2018, you have several rights concerning our handling of your personal data:

• The right to be informed: You have the right to be informed about how your data is being processed.
• The right to access: You can request us to provide a copy of any personal data we hold about you via a subject access request.
• The right to rectification: You can request the update of inaccurate or incomplete data we hold.
• The right to erasure (also known as 'the right to be forgotten'): You can request that we delete your data in certain circumstances, such as when it is no longer necessary, unlawfully processed, or no longer meets the lawful ground for its collection. This includes cases where you withdraw consent for us to hold your data.
• The right to restrict processing: You can request that we limit the way an organization uses your personal data.
• The right to data portability: You can request your personal data and, where possible, have it transmitted directly to another data controller, where applicable.
• The right to object: You can object to the processing of personal data collected on the grounds of legitimate interests or the performance of a task in the interest/exercise of official authority.
• Rights related to automated decision making, including profiling: You can challenge and request a review of processing or profiling for decisions made without human involvement.

These rights are defined by the ICO at the following URL: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/

Additional details can be found at the following URL: https://gdpr-info.eu/chapter-3/

Subject Access Requests

You have the right to obtain a copy of all personal data we hold about you (subject access request). We do not charge for providing access to personal data. However, unfounded or excessive requests may lead to the application of an administrative fee at our standard admin hourly rate or a refusal to comply with the request in such circumstances. To ensure security, we may need to confirm your identity using a passport or other government-approved identification method.

To request a copy of the personal data we hold on you, please use our Contact Us page or email hello redpenetration.com.