Privacy Policy

This privacy policy explains how Zayn Otley Cybersecurity Training ("we", "our", "us") collects, uses, and protects your personal information when you use our website at zaynotley.com.

Data We Collect

1. Appointment Booking Information (via Calendly)

When you book a consultation or training session through our Calendly widget, the following information is collected:

• Personal Information: Name, email address, phone number (if provided), appointment preferences (date, time), and any additional information you provide
• Third-Party Processor: All appointment booking data is processed through Calendly
• Data Location: Calendly stores appointment data on their servers (United States)
• Purpose: To schedule, manage, and confirm consultation appointments

2. License Purchases and Payment Information (via Stripe)

When you register for a course through our Stripe checkout links, the following information is collected:

• Personal Information: Name, email address, billing address
• Payment Information: Credit/debit card details, payment method information (processed securely by Stripe)
• Third-Party Processor: All payment processing is handled by Stripe
• Data Location: Stripe stores payment data on their secure servers
• Purpose: To process course registrations and payments

3. Website Usage Data

Our website may collect:

• Browser type, version, and operating system
• Device type and screen resolution
• Pages visited and time spent
• IP address for security purposes

Note: We do not use Google Analytics or cookie-based trackers. We run Plausible Analytics, which is cookieless and only collects anonymous, aggregated usage data.

Third-Party Services

Calendly (Appointment Scheduling)

Stripe (Payment Processing)

Plausible Analytics

• Service: Privacy-friendly analytics platform (no cookies, no personal data)
• Data Collected: Aggregated page views, referrers, device/OS/browser info, country-level location and custom events (e.g. Calendly form clicks)
• Purpose: Understand which pages are accessed so we can improve content and validate demand
• Retention: Aggregated metrics only; no IP addresses or visitor-specific identifiers are stored
• Privacy Policy: plausible.io/data-policy

Google Fonts

• Service: Web font delivery for Inter font family
• Data Collection: Google may collect usage statistics
• No Cookies: Google Fonts API does not set cookies

Browser Storage

Local Storage

• Theme Preference: Stores your light/dark mode preference
• Data Stored: Single value ('light' or 'dark')
• Retention: Until you clear browser data
• No Personal Data: Theme preference is not personally identifiable

Cookies

Our Cookies

We do not set any first-party cookies on our website.

Third-Party Cookies

Calendly and Stripe may set cookies when you interact with their services:

• Calendly: May set cookies when using the booking widget
• Stripe: Sets cookies during checkout to prevent fraud and ensure secure payment processing

You can control these through:

1. Your browser settings (block third-party cookies)
2. Opting out via Calendly's privacy settings
3. Using browser privacy extensions

Your Rights (GDPR & Data Protection)

You have the right to:

• Access: Request a copy of personal data we hold
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your data
• Restriction: Request restriction of processing
• Data Portability: Receive data in machine-readable format
• Object: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent at any time

Data Security

Technical Measures

• HTTPS Encryption on all connections
• Content Security Policy to restrict resource loading
• Security headers (X-Frame-Options, X-Content-Type-Options)
• Permissions Policy to restrict browser APIs
• No passwords stored (we don't maintain user accounts)

International Data Transfers

Calendly (United States)

• Appointment data may be transferred to and processed in the United States
• Calendly complies with applicable data protection regulations
• Standard contractual clauses apply for EU data

Stripe (Global)

• Payment data is processed in the United States and globally via Stripe's secure infrastructure
• Stripe is PCI-DSS Level 1 certified
• Stripe complies with GDPR and other international data protection laws
• Standard contractual clauses and adequate safeguards in place for international transfers

Children's Privacy

Our website and services are not directed at children under 13 (or 16 in the EEA). We do not knowingly collect personal information from children.

Changes to This Policy

We may update this privacy policy to reflect changes in our practices or applicable laws. Material changes will be communicated via:

• Updating the "Last Updated" date at the top
• Displaying a notice on our website for 30 days

Contact Information

Summary

What we collect:

• Appointment details (name, email, phone) via Calendly widget
• Course registration and payment information via Stripe checkout
• Basic website usage data (no tracking cookies)
• Theme preference in browser localStorage

How we use it:

• Schedule training consultations
• Process secure course registrations and payments
• Improve website performance
• Remember your light/dark mode preference

Your data is:

• ✅ Encrypted in transit (HTTPS)
• ✅ Processed by Calendly for appointments and Stripe for payments
• ✅ Payment card details never stored by us (handled securely by Stripe)
• ✅ Not sold or shared with advertisers
• ✅ Protected by security headers and policies
• ✅ Deletable upon request

For questions or data requests: zayn@zaynotley.com