01
Public website scope
The public pages are static content. They do not offer visitor accounts, passwords, payments, uploaded attachments, a public database or user-generated posts. The contact form is the one place where the site accepts input. A submission is checked for automation, rate-limited per network address, and handed to the company mailbox; the website keeps no public record of it and stores no drafts in the visitor’s browser.
Reducing the public application surface helps limit unnecessary processing, but static files do not make a site immune to compromise. The host, domain, administrative access, publication process, dependencies and email systems each need their own protection. A website policy cannot establish the security of a laboratory, manufacturing system or confidential document repository.
02
Transmission and sensitive information
Use the HTTPS address displayed by your browser when visiting this website. HTTPS protects the connection to the service reached by the browser; it does not certify the truth of every claim or the identity of a person emailing you. Hosting and network security depend on the deployed service and configuration.
Ordinary business email should not be assumed to be end-to-end encrypted or suitable for unrestricted health records and commercially sensitive dossiers. Avoid sending passwords, payment-card information, unnecessary identity documents or complete patient files. Ask the company contact for an appropriate transfer arrangement before sending sensitive documents. If you receive an unexpected request for money, credentials or confidential information, verify it through an independently known contact route.
03
How retention is determined
The purpose of retention is to support a current activity or a justified obligation. Enquiry correspondence may be needed to answer, understand the history of a discussion or evidence a business decision. Information associated with a contract, dispute, regulatory request or safety matter may require a different period. An active legal hold may prevent deletion of otherwise eligible records.
Technical connection logs, sent messages, mailbox archives and backups are separate record types. Their availability and deletion depend on the actual service, access and retention settings. Deleting a message from one folder may not immediately erase every backup copy. An identifiable browsing history is not needed solely to anticipate hypothetical requests.
Ask the privacy contact about information relevant to you. Any specific retention period required by law or a separate notice takes precedence for the affected record. Different record categories can therefore have different retention periods.
04
Reporting a website security concern
Use the contact form, saying in the message that it concerns website security. Give the affected public address, the approximate time and a concise description of what you observed. A redacted screenshot may help. Do not include live passwords, session tokens, another person’s information or material obtained from a private system.
This contact route is for reporting observations. It does not authorise intrusion, access to private data, service disruption or testing beyond permission you already hold. If an issue exposes personal information, stop accessing it and report the location without copying the information. No reward programme, security response time or legal safe-harbour undertaking is created by this notice.
05
Incidents, records and rights
A credible concern may require technical investigation, coordination with a service provider and preservation of relevant evidence. Any required notifications to affected people or authorities depend on the applicable legal test and circumstances. The reporting threshold depends on the incident and the law; an informal email does not replace a required notification.
Information provided for a security concern is covered by the privacy policy. Privacy requests, including retention questions, can be made through the privacy rights route. This notice describes website and enquiry-data handling; it does not constitute an independent security assessment or certification.