Privacy notice
Last updated 1 September 2026
This notice explains what personal data we collect through this website, why we collect it, how long we keep it, and how you can have it removed. It is written to be read rather than to be defensible, so if anything here is unclear, tell us and we will fix the wording.
Who we are
ISAREADY publishes information security readiness resources and tools. For any question about this notice or about data we hold, write to isaready@outlook.fr.
Who is responsible
ISAREADY is responsible for the personal data described here. Registered in Morocco.
What we collect, and why
Readiness self-assessment
Your answers are held in your browser while you work through the assessment. Nothing is sent to us until you complete it. On completion we store the answers, the calculated result, and the non-identifying context you provided — country, organisation size, supplier type, role and timeline — against an anonymous session identifier.
When you request your detailed report we additionally store your first name, work email and company, and link them to that assessment.
Two separate decisions. Acknowledging this notice is what allows us to send the report you asked for — nothing more. Marketing permission is a second, optional, unticked box, and declining it does not affect your report in any way. We store the two decisions separately, each with the wording and version shown at the time (current version: 2026-09-08), so we can always show what you actually agreed to. An acknowledgement is never treated as marketing permission.
Your report link contains a random access token. Anyone holding the full link can open the report, so treat it as confidential; we can invalidate it on request.
Checklist download and newsletter
We store the email address you provide, and your name and company if you supply them, so we can send the requested material. Newsletter subscriptions use double opt-in: you receive a confirmation email and nothing further is sent unless you confirm.
Contact form
We store your name, email, and the company, country, topic and message you provide, so we can answer you. We also store a one-way hash of your IP address for abuse prevention — the address itself is not retained.
Analytics
We record first-party events about how the site is used — for example that an assessment was started or completed — against an anonymous session identifier. These records contain no name, email or IP address.
Third-party analytics (Google Analytics, where configured) load only if you accept the analytics category in the cookie banner. If you do not, no third-party analytics script is injected. See our cookie notice.
Legal basis
- Delivering what you asked for — your readiness report, the checklist, or a reply to your enquiry. Necessary to provide the service you requested.
- Marketing communications — sent only on your consent, given by ticking an unticked box, and withdrawable at any time.
- Security and abuse prevention — our legitimate interest in keeping the service available and free of automated abuse.
Who we share it with
We use a small number of processors, and we do not sell personal data to anyone.
- Hosting — our infrastructure provider hosts the site and its database.
- Email delivery — Resend delivers transactional and, where consented, marketing email.
- Analytics — Google Analytics, only where you have accepted analytics cookies.
- Spam protection — Cloudflare Turnstile, where configured, to verify form submissions.
How long we keep it
These are the periods this deployment actually enforces. A nightly job applies them, and the figures below are read from the same configuration that job uses — so this section cannot describe a policy the system does not implement.
| Data | Kept for | Then |
|---|---|---|
| Assessment answers and results | 2 years | Deleted, and the report link stops working |
| Your details where you gave no marketing permission | 1 year | Deleted |
| Your details after you unsubscribe | 3 years | Anonymised. We keep the fact that this address opted out, so it cannot be re-added by a later import |
| Contact messages, once closed | 2 years | Deleted |
| Anonymous usage events | 400 days | Deleted. They contain no identifier that resolves to a person |
| Record of emails sent to you | 3 years | Deleted. Kept longer because it evidences what you consented to |
You can ask us to delete your data sooner than any of these periods, and we will.
Your rights
Depending on where you are, you may have the right to access the data we hold about you, have it corrected or deleted, restrict or object to its processing, receive it in a portable form, and withdraw consent at any time. Withdrawing consent does not affect processing that already happened.
To exercise any of these, write to isaready@outlook.fr. We will respond within one month. You may also complain to your local supervisory authority.
Unsubscribing
Every marketing email contains a one-click unsubscribe link. You can also use our unsubscribe page directly.
Changes to this notice
We update this notice when our processing changes. The date at the top reflects the current version. Material changes affecting people who have given consent will be communicated directly.
A note on scope
This notice describes our actual practices. It is not a legal opinion, and we make no claim that this website is certified or verified as compliant with any particular regulation. If you believe something here is inaccurate or insufficient, please tell us.