Privacy Policy

This Privacy Policy explains how HACKED24 LLC (“HACKED24”, “we”, “us”) processes personal data when you visit hacked24.com, contact us, book a call, or work with us. We serve clients worldwide — so this policy is written to work worldwide: the same principles apply to everyone, and region-specific rights are set out in section 9. Questions at any time: hello@hacked24.com.

1. Who is responsible

HACKED24 LLC, 7901 4th St N STE 300, St. Petersburg, FL 33702, USA — email hello@hacked24.com, phone +1 (727) 632-9990. Where regional data protection law uses the concept, HACKED24 LLC is the controller (GDPR/UK GDPR/Swiss FADP), the “business” (California CCPA/CPRA), or the responsible organization (PIPEDA, LGPD, Australian Privacy Act) for the processing described here. We have not appointed a data protection officer, as we are not legally required to; all privacy matters are handled directly by management under the contact above.

2. Categories of data we process

• Identity and contact data — name, business email, phone number, company, role.
• Communication data — the content of emails, calls, and meeting notes, including the topic you describe when booking a call.
• Contract and billing data — for clients: agreement details, invoicing and payment information.
• Technical data — IP address, timestamps, requested resources, browser/user agent, approximate region derived from IP.
• Usage data — aggregated website analytics, only with your consent.

We collect this data directly from you. We do not collect special categories of data (such as health or biometric data) through this website, and we ask you not to send us such data unsolicited.

3. What we use data for, and on what legal basis

a) Contact and inquiries

Responding to your inquiry and preparing an engagement. GDPR legal bases: Art. 6(1)(b) (pre-contractual steps), Art. 6(1)(f) (legitimate interest in business communication).

b) Scheduling and meetings

Appointments booked online are processed through Microsoft Bookings and Microsoft Teams (Microsoft Corporation) on our behalf; we receive the details you enter. Meetings are not recorded unless all participants agree in advance. GDPR legal basis: Art. 6(1)(b).

c) Service delivery

When we deliver consulting engagements, we process the business contact data of client personnel we work with (names, roles, work contact details, project communication). GDPR legal bases: Art. 6(1)(b) towards our contracting party and Art. 6(1)(f) towards individual client personnel. Access to client systems and any personal data within them is governed by the engagement contract and, where required, a data processing agreement — client system data is processed on documented instructions only.

d) Website operation and security

Hosting on Microsoft Azure; server logs (see section 2, technical data) are kept for operation, stability, abuse prevention, and security analysis, and are deleted on a rolling basis. GDPR legal basis: Art. 6(1)(f).

e) Analytics

With your consent, Google Analytics (Google Ireland Ltd. / Google LLC) helps us understand how the website is used; IP addresses are processed in truncated form. GDPR legal basis: Art. 6(1)(a). Withdrawal is possible at any time via the cookie settings.

f) Legal obligations and claims

Where necessary, we process data to comply with legal obligations (e.g. tax and commercial retention duties, Art. 6(1)(c) GDPR) and to establish, exercise, or defend legal claims (Art. 6(1)(f)).

g) No sale, no profiling, no automated decisions

We do not sell or rent personal data, we do not “share” it for cross-context behavioral advertising within the meaning of the CCPA/CPRA, we do not use data for automated decision-making with legal or similarly significant effects, and we do not send marketing newsletters unless you have explicitly signed up for one.

4. Cookies in detail

We use a consent management platform (CookieYes) that documents your choice. Categories:

• Strictly necessary — required for the website and the consent banner itself to function (including the cookie that stores your consent decision, typically retained for up to 12 months). Basis: legitimate interest.
• Analytics — Google Analytics 4 measurement cookies (typical lifetime up to 24 months), deployed via Google Tag Manager and set only after your consent. We use Google Consent Mode, which means Google tags respect your banner choice before any measurement cookies are written.

Third-party components in detail: Google Tag Manager (Google Ireland Ltd. / Google LLC, USA) is used solely as a tag container to load the services listed here according to your consent; it does not set cookies of its own. Avatar images in blog comments may be served by Gravatar (Automattic Inc., USA), which receives your IP address when such an image loads. Data transfers to Google LLC and Automattic Inc. in the United States rely on the EU–U.S. Data Privacy Framework and/or Standard Contractual Clauses.

You can change or withdraw your choice at any time via the cookie settings icon on this website. Where your local law follows an opt-out model (for example some US states), declining or withdrawing in the banner has the same effect. Your browser’s settings additionally allow blocking or deleting cookies at any time.

5. Who receives data

We share personal data only as needed and with parties bound to appropriate protections:

• IT service providers (processors) — Microsoft Corporation (Azure hosting, Microsoft 365 email, Bookings/Teams scheduling and meetings), Google (analytics, with consent), CookieYes (consent management). Processors act on our documented instructions under data processing agreements.
• Professional advisers — lawyers, accountants, and auditors, where required and under confidentiality.
• Authorities — only where we are legally obliged to disclose, or where disclosure is necessary to establish, exercise, or defend legal claims.
• Business transfers — in the event of a merger, acquisition, or asset sale, data may be transferred as part of that transaction under continued protection.

We link to external platforms (for example LinkedIn and X) — these are plain links, not tracking embeds; the respective platform’s privacy policy applies once you follow a link.

6. International data transfers

We are a US-based firm delivering worldwide; data is therefore processed in the United States and, depending on your location and our providers’ infrastructure, in other countries. Where the law of your region restricts international transfers — in particular the GDPR, UK GDPR, and Swiss FADP — we rely on recognized safeguards: the EU Standard Contractual Clauses (with the UK Addendum and Swiss adaptations where applicable) and, where our providers are certified, the EU-U.S. Data Privacy Framework including its UK and Swiss extensions. A copy of the relevant safeguards can be requested via the contact above.

7. How long we keep data

• Inquiry correspondence — for the duration of our exchange, then deleted unless a business relationship follows or statutory periods require retention.
• Contract and billing data — for the applicable commercial and tax retention periods (typically 6–10 years depending on jurisdiction).
• Server logs — short rolling deletion.
• Analytics data — according to the configured retention period, currently a maximum of 14 months.
• Consent records — for as long as required to demonstrate consent.

8. Security

We apply technical and organizational measures appropriate to the risk — encrypted transport (TLS), encryption at rest with our cloud providers, multi-factor authentication and least-privilege access on our systems, and the hardening practices we recommend to our own clients. No transmission over the internet is completely secure; if we identify a breach affecting your data, we will act in line with the notification duties applicable in your region.

9. Your rights, by region

European Union / EEA, United Kingdom, Switzerland

Under the GDPR, the UK GDPR, and the Swiss Federal Act on Data Protection (FADP), you have the right to access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interests; consent can be withdrawn at any time with effect for the future. Providing your data is neither legally nor contractually required — but without contact data we cannot respond to you, and without contract data we cannot deliver an engagement. You may lodge a complaint with your supervisory authority — in the EU/EEA the authority of your member state, in the UK the ICO, in Switzerland the FDPIC.

United States

Residents of California and other states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, and Texas) have rights to know/access, correct, and delete personal data, and to opt out of sale, sharing, and targeted advertising. In the categories of the CCPA, we collect identifiers, professional information, internet activity, and commercial information (for clients) — for the purposes in section 3, from the sources in section 2, shared as described in section 5. We do not sell or share personal data and have not done so in the preceding 12 months. You may use an authorized agent to submit requests, and we will not discriminate against you for exercising your rights.

Canada

Under PIPEDA, you have the right to access your personal information, challenge its accuracy, and withdraw consent subject to legal or contractual restrictions. Complaints may be directed to the Office of the Privacy Commissioner of Canada.

Brazil

Under the LGPD, you have rights to confirmation of processing, access, correction, anonymization or deletion, portability, and information about sharing; complaints may be directed to the ANPD.

Australia

We handle personal information consistently with the Australian Privacy Principles; you may request access and correction and complain to the OAIC if you believe your privacy has been interfered with.

Other regions

Wherever you are, we honor the data protection rights applicable to you under your local law — and where no specific law applies, we apply the GDPR standard as our baseline. To exercise any right, email hello@hacked24.com. We answer within the deadlines of your jurisdiction (under the GDPR, within one month). We may need to verify your identity before acting on a request; verification data is used only for that purpose.

10. Children

Our website and services are directed at businesses and are not intended for children under 16. We do not knowingly collect data from children; if you believe a child has provided us data, contact us and we will delete it.

11. Changes to this policy

We update this policy when our services, providers, or the legal situation change. The current version is always available on this page with the date above; for material changes affecting existing contacts, we will inform you directly where reasonably possible.