CORDON Privacy Policy

Effective date: October 2026 · Version: v1.0

This policy explains what personal data PNH Security Engineering Consultants ("PNH", "we") collects through the CORDON website and application, why, how long it is kept, and what you can ask us to do with it. It sits alongside the CORDON Terms of Use. PNH is the controller for the data described here.

1. What we collect. Only what the Service needs to run:

• Account — your email address, and the name and organisation PNH or you record for your account. Your password is stored only as an Argon2id hash; we cannot read it.
• Quote and screening requests — the name, work email, company and message you send from the quote form, and that you accepted the Terms of Use and this policy. They are emailed to PNH.
• Technical records — the IP address and browser user-agent of a sign-in, the IP recorded when you accept the Terms, and server logs of requests (method, path, status, duration, account identifier).
• Billing — the plan you bought and a Stripe customer and payment reference. Payment card details are entered on Stripe's own checkout and never reach our servers.

Your assessments stay with you. The CORDON application runs in your browser. Assessments are saved to and opened from your own computer as files, and nothing you enter in the application is sent to our server. The browser's local storage keeps only the portfolio list (facility names, grades and the inputs needed to reopen each one) until you clear it, the assessor name, title and organisation you last entered, and whether you have seen the introduction.

We do not use advertising or analytics trackers, we set no third-party cookies, and the only cookie we set is the one that keeps you signed in — strictly necessary, and removed when you sign out.

2. Why we hold it, and on what basis.

• To provide the Service — giving you access to the application and managing your licence. Performance of our contract with you.
• To answer your request — replying to a quote or screening request. Steps taken at your request before a contract.
• To keep it secure — rate limiting, sign-in throttling, and abuse investigation. Our legitimate interest in a service that is not trivially abused.
• To take payment — through Stripe. Performance of contract, and our legal obligation to keep financial records.
• To evidence acceptance — recording that you accepted the Terms. Our legitimate interest, and our legal obligation to keep the record.

3. Address lookup. When you look up an address in the application, your browser sends the address you typed directly to the OpenStreetMap Nominatim and Overpass services and, when needed, to Wikidata. Those services receive the query, your IP address and the address of this site, under their own privacy policies. PNH does not receive or store the query. If you prefer, enter coordinates by hand instead.

4. Who else processes it. Only these, and only to run the Service:

• Stripe, Inc. — payments and subscription management.
• Our transactional email provider — delivery of invitation, verification, password-reset and quote-request emails. It receives the email address and the message.
• Our hosting provider — the server the website and its database run on.
• Have I Been Pwned — when you choose a password, we check it against a public corpus of passwords exposed in data breaches. Your password is never sent. Only the first five characters of its SHA-1 hash leave our server, and the comparison happens here.

We do not sell personal data, and we do not share it for advertising. Where a processor is outside your jurisdiction, transfers rely on that provider's standard contractual clauses.

5. How long we keep it.

• Account and licence records — for as long as your account exists, then as described in §7.
• Records of terms acceptance — 7 years.
• Sign-in records — up to 90 days after a session expires.
• Payment-event records — 90 days in this application; Stripe keeps its own for as long as its financial obligations require.
• Sent emails — a record of the message and when it was delivered, for 30 days. Quote requests are kept by PNH as business correspondence.

6. Your rights. Subject to local law, you may ask us to give you a copy of your data, correct it, delete it, restrict or object to our use of it, or receive it in a portable form. Two of these are self-service on your dashboard, and take effect immediately:

• Download my data — a JSON file of the account data described in §1.
• Delete my account — see §7.

For anything else, or to complain, write to pnhsec@pnhsec.com. If you are in the UK or the EEA you may also complain to your data protection authority. California residents have the rights described in the CCPA, including the right not to be discriminated against for exercising them; we do not offer financial incentives for data.

7. Deleting your account. Deleting your account immediately and irreversibly removes your account record, your sessions, your licence records and your acceptance records. There is no grace period and no recovery. Assessment files on your own computer and your browser's local storage are not affected; clear them yourself if you wish. You must cancel any active subscription first, or Stripe would continue to bill a licence with nothing left to use it. Stripe retains its own payment records regardless, as it is legally required to.

8. Security. Passwords are hashed with Argon2id. Session tokens are stored only as digests, so a database disclosure does not yield usable sessions. The site is served over HTTPS with HSTS and a content security policy, and the application may connect only to the three map services named in §3. No system is perfectly secure, and we do not claim otherwise.

9. Children. CORDON is a professional tool and is not directed at, or intended for use by, anyone under 18.

10. Changes. We will post a new version here and, where the change is material, notify you by email or through the Service.

Contact: PNH Security Engineering Consultants · pnhsec.com · pnhsec@pnhsec.com · +1-818-253-9557