Privacy notice
Last updated: 20 October 2026
This notice explains what personal data we collect when you visit our website, send us an enquiry or a message, or buy services from us, what we do with it and what rights you have.
Contents
- Who we are
- What we collect
- How we use it and our lawful bases
- How long we keep it
- Who we share it with
- International transfers
- Data we handle for our clients
- How we keep it secure
- Your rights
- Automated decisions
- Children
- Changes to this notice
Who we are
Continental Data is owned and operated by Avanzado Capital Limited, a company registered in England and Wales (company number 12469366), registered office 85 Booth Road, London, England, NW9 5JU. We are the controller of the personal data described in this notice, which explains how we use it under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
For any question about this notice or your data, email info@continental-data.co.uk.
What we collect
- Contact-form messages and emails: your name and email address, your phone number and company if you choose to give them, the topic you choose and your message.
- Enquiries: through our enquiry form, the services you are interested in, your answers to our scope questions, your chosen currency, and your billing contact details (name, organisation if any, email address, phone number and billing address).
- Orders: once you go ahead, the scope and price we confirm, the currency, invoices, and your order history with us.
- Scope details: the information you give us to scope services, which may include system identifiers such as domain names, IP addresses, application URLs and cloud tenant names, and the names and contact details of your staff who are involved.
- Customer status: whether you are buying as a business or a consumer, and, for consumers, whether you asked us to start services within the cancellation period.
- Payment status: whether and when you paid, the amount and the payment reference. Card details are entered on our payment provider's page and never reach us.
- Server logs: when you visit our website our server records your IP address, the time, the page requested and your browser type. We keep these for no more than 30 days.
- Admin audit trail: a record of which of our staff viewed or changed an enquiry or order, and when.
Your enquiry list and chosen currency are kept in your own browser and are not sent to us until you submit an enquiry. See our cookies page.
How we use it and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Replying to your enquiry or contact-form message and preparing a scope and price | Steps at your request before entering a contract; otherwise our legitimate interest in responding to people who contact us |
| Sending your scope confirmation and payment link, confirming payment, delivering services, invoicing (using your billing address), handling cancellations and refunds | Contract, or steps at your request before entering a contract |
| Verifying that you are authorised to have targets tested | Contract, and our legitimate interest in complying with the Computer Misuse Act 1990 and protecting third parties |
| Keeping accounting and tax records | Legal obligation |
| Keeping our website and systems secure, preventing fraud and misuse, and keeping an audit trail of staff access | Legitimate interests (security and fraud prevention) |
| Following up with business contacts about our services after an enquiry or engagement | Legitimate interests (developing our business). You can object at any time. We do not send marketing emails to consumers without consent. |
| Handling complaints and legal claims | Legitimate interests (establishing, exercising or defending legal claims), and legal obligation where it applies |
Where we rely on legitimate interests, we have balanced them against your rights and you can ask us for details. If you do not give us the information we need to scope and deliver services, we cannot provide them.
How long we keep it
| Data | How long |
|---|---|
| Enquiries that do not lead to an order | 12 months from our last contact |
| Contact-form messages | 12 months, unless the message leads to a contract or is a complaint, in which case we keep it for as long as the related order or complaint record |
| Complaints | 6 years after the complaint is closed, in case of claims |
| Orders, invoices and payment records | 6 years from the end of the financial year in which the contract ends, for tax and legal purposes |
| Scope details and client correspondence | 6 years after the engagement ends, in case of claims |
| Enquiries withdrawn or declined before a contract is formed | 12 months |
| Web server logs | Up to 30 days |
| Admin audit trail | For as long as the related enquiry or order is kept |
After these periods we delete or anonymise the data, unless we need to keep it longer because of a legal claim or a legal requirement.
Who we share it with
We do not sell your data. Access to enquiries and orders in our admin system is restricted to authorised staff. We share personal data only with:
- Our hosting provider, which runs the server and database where enquiries and orders are stored.
- Resend, our email delivery provider, which sends enquiry and contact-form notifications to us and our emails to you.
- Our payment provider, which takes your payment through the secure payment link and tells us whether it succeeded.
- Professional advisers such as accountants, lawyers and insurers, where needed.
- Authorities such as HM Revenue & Customs, the police or a court, where the law requires it or to protect our rights.
- A buyer of our business, if we sell or reorganise it, under equivalent protections.
Our service providers act on our instructions under contracts that require them to keep your data secure.
To show prices in other currencies our server fetches exchange rates from a public feed. No personal data is sent in that request.
International transfers
Resend is based in the United States, so the emails it sends, including your name, email address and the content of your enquiry or message, are processed there. We rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it, or otherwise on the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, together with the additional safeguards those require. If any other provider processes your data outside the UK, we will use one of these safeguards or rely on a UK adequacy decision. You can ask us for a copy of the relevant safeguard.
Data we handle for our clients
When we deliver services, we may handle personal data that belongs to our clients, for example in logs, mailboxes or systems we test or monitor. In that case our client is the controller and we act as its processor under a written data processing agreement. That processing is governed by that agreement and by our client's own privacy notice, not by this notice. If you are an individual whose data our client holds, please contact the client first.
How we keep it secure
We use measures appropriate to the risk, including encrypted connections (HTTPS) for our website and payment links, access to the admin area limited to authorised staff with an audit trail, keeping card data out of our systems entirely, keeping server software up to date, and limiting how long we keep data. If a data breach is likely to put your rights at risk, we will tell the Information Commissioner's Office and, where required, you.
Your rights
Under UK data protection law you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected (rectification);
- have your data deleted (erasure) in some circumstances;
- restrict how we use your data in some circumstances;
- receive data you gave us in a portable format (portability), where we process it under contract or consent;
- object to our use of your data based on legitimate interests, and to direct marketing at any time;
- withdraw any consent you have given, without affecting what we did before.
To use any of these rights, email info@continental-data.co.uk or use our contact page. We will respond within one month, and may ask you to prove your identity. There is usually no charge.
If you are unhappy with how we have handled your data, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.
Automated decisions
We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects. Every enquiry, order and refund is reviewed by a person.
Children
Our website and services are not intended for children under 18, and we do not knowingly collect their personal data.
Changes to this notice
We may update this notice. The date at the top shows when it last changed. If we make a significant change that affects you, we will tell you by email where we can.
Last updated: 20 October 2026