Privacy Policy

1. Who We Are & What We Do

The Eland Shield Portal is run by Eland Collective LTD, trading as Eland Shield ("we", "us", or "our"). This policy explains how we collect, use, store, and share personal information when you use the portal's assessments, policy generator, accounts, and contact form. We are the data controller under the UK GDPR and the Data Protection Act 2018. Our address is Greenhithe, Stone, Dartford, DA9 9RZ, United Kingdom. For any privacy question, email contact@elandshield.com.

This policy covers portal.elandshield.com. For the main website and our paid consultancy services, see the Eland Shield privacy policy. The portal does not take payments.

2. What Data We Collect

Depending on how you use the portal, we collect:

• Your business name, your name, and your work email address
• Your answers to assessments, and the scores and reports generated from them
• Whether you're happy for us to contact you with security recommendations
• Business details you enter into the policy generator (such as industry and number of staff)
• Consultation requests, including your phone number and message if you provide them
• If you create an account: your name, email address, and password (stored only as a secure cryptographic hash; we never store your actual password)
• Basic technical information needed to run and protect the service, such as IP addresses in server logs and for rate limiting

We do not collect or process any payment card details. The portal's tools are free to use.

3. How We Use Your Information and Our Lawful Bases

• Providing the tools you use (calculating scores, producing reports and policy documents, running your account): our legitimate interests in delivering the free service you've asked for.
• Following up on an assessment or request you've made, and arranging consultations you book: our legitimate interests in responding to enquiries about our services.
• Sending occasional security recommendations: only where you've ticked the box to say you're happy to hear from us. You can withdraw this consent at any time.
• Keeping the portal secure (for example, preventing abuse and investigating incidents): our legitimate interests in protecting our systems and users.

If you create an account, we ask you to confirm your email address before showing any assessments linked to it, so nobody else can view your results by registering with your address.

4. Who We Share It With

We do not sell or rent your personal information. We share it only with service providers that help us run the portal, under contracts that require them to protect it: our hosting provider (Hostinger), which hosts the website and the UK server our database runs on, and our email delivery provider (Resend). We may also disclose information where required by law or to regulators and professional advisers where necessary.

5. How Long We Keep Your Data

We keep assessment submissions and reports, generated policy packs, and consultation requests for 24 months from the date each record is submitted. Records are deleted through a daily retention check once this period ends, including their associated contact details and consent preferences. You can request earlier deletion at any time by emailing contact@elandshield.com. Downloaded or printed copies are held by you and are not affected by deletion from the portal.

Account details are kept while your account remains open; the 24-month limit applies to your submissions, not your login. You can ask us to close your account and delete its personal information. Session cookies expire after 24 hours, password-reset links after one hour and email-verification links after 24 hours. Technical logs are retained only as needed to operate and protect the service. Records relating to paid consultancy services are covered separately by the main website's policy.

6. Cookies and Local Storage

If you create an account and sign in, we set a single session cookie that keeps you signed in. It is strictly necessary for the login feature to work, expires after 24 hours, and is not used for tracking, analytics, or advertising. We set no other cookies and use no third-party tracking.

7. Your Rights

Under the UK GDPR, you have the right to:

• access the personal information we hold about you
• have inaccurate information corrected
• have your information deleted
• restrict or object to how we use it, including objecting to follow-up contact at any time
• withdraw your consent to marketing at any time
• receive a copy of information you provided in a portable format

To exercise any of these rights, email contact@elandshield.com. We will respond within one month. If you're unhappy with how we handle your information, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk, although we'd appreciate the chance to resolve your concern first.

8. Security & Data Protection

We use appropriate technical and organisational measures to protect your information, including encryption in transit, hashed passwords and session tokens, and restricted admin access. Access is limited to people and providers who need it to operate the service.

9. Data Transfers Outside the UK

Our database runs on a UK server. Some service providers may process information outside the UK; where they do, we use safeguards recognised under UK data protection law, such as the UK International Data Transfer Agreement or Addendum. Visitors outside the UK should be aware that their information is processed in the UK and by the providers described above.

10. Children & Young People

The portal is intended for business professionals, not children under 18. We do not knowingly collect personal information from children. If you believe a child has submitted personal information, contact us so we can investigate and remove it.

11. Changes to This Policy

We keep this policy under review. The date at the top shows when it was last changed. Please keep us informed if the personal information we hold about you changes.