Privacy Policy

1. Introduction & Data Controller Overview

Cankal Software and IT Consultancy Ltd.("Cankal Software", "we", "our", or "us") is a company incorporated in the United Kingdom dedicated to artificial intelligence transformation, SaaS engineering, computer vision solutions, and cybersecurity advisory.

We are committed to protecting the privacy, confidentiality, and security of all personal data we process in full compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the EU GDPR, and the Privacy and Electronic Communications Regulations (PECR).

For the purposes of data protection legislation, Cankal Software and IT Consultancy Ltd. is the Data Controller. If you have any enquiries regarding this policy, you may contact our privacy team directly at info@cankalsoftware.com.

2. Personal Data We Collect

Depending on how you interact with our website, free online tools, or consultancy services, we may collect and process the following categories of data:

• Direct Enquiries & Contact Communications: When you submit a project enquiry or consultation request via our contact form or direct email, we collect your full name, work email address, company name, telephone number (if provided), and project description. We hold this correspondence solely to evaluate your scope and respond to your communication.
• Free Tool Usage Data (AEO, Website Health, CVE & OWASP Scanners): When you use our public tools (such as the AEO Scanner, Website Health & Structure Audit, Vulnerability Check, or 2026 OWASP Top 10 Audit), you input public website domains or URLs. Note: Our scanners perform passive, read-only analysis of public HTTP response headers, DOM semantics, and HTML entirely in-memory. We do not store, harvest, or monetise scanned website contents or discovered vulnerabilities for unauthorised third parties.
• Automated Telemetry & Device Information: Standard server logs, anonymised IP addresses, browser specifications, operating system details, timestamps, and referral paths captured via Google Analytics 4, Microsoft Bing Webmaster Tools, and server diagnostics.
• Security & Bot Prevention Data: Google reCAPTCHA v3 interaction tokens to detect automated spam submissions on our forms.

3. Lawful Bases for Processing (Article 6 UK GDPR)

We only process your personal data where we have a recognised legal justification under Article 6 of the UK GDPR:

4. Data Sharing & Third-Party Sub-processors

We never sell, rent, or trade your personal information. We only disclose data to trusted service providers operating under strict confidentiality and data processing agreements:

• Cloud Hosting & Infrastructure: Sovereign enterprise UK and European cloud infrastructure and data centres.
• Email & Communications: Authenticated SMTP relays and transactional email providers (e.g. Nodemailer) for direct enquiry handling.
• Search Engine & Webmaster Analytics: Microsoft Corporation (Bing Webmaster Tools & Microsoft Analytics) and Google LLC (Google Analytics 4 & Google Search Console) for website indexing diagnostics and anonymous usage insights.
• Security & Abuse Prevention: Google LLC (reCAPTCHA v3 bot verification).
• Marketing Analytics: Meta Platforms Ireland Ltd. (Meta Pixel) for conversion attribution.
• Legal & Regulatory Authorities: Where strictly mandated by court order or statutory UK law enforcement.

5. International Data Transfers & Page Analysis

Our free online diagnostic tools (AEO Scanner, Website Health & Structure Audit, Vulnerability Check, and 2026 OWASP Top 10 Audit) execute transient, real-time analyses purely in-memory on our UK and European servers. We do not store, copy, or transfer scanned target website data across international borders. The passive inspection results are sent directly back to your active browser session and are discarded immediately upon completion of the scan.

Where standard aggregated analytics data (such as Google Analytics 4 or Microsoft Bing Webmaster Tools) is processed, adequate protections are maintained through the UK International Data Transfer Agreement (IDTA), UK Addendum to the EU Standard Contractual Clauses (SCCs), or relevant UK adequacy regulations.

6. Data Retention & Security Standards

We retain personal communication records only for as long as necessary to fulfil the business purposes for which they were collected or to comply with statutory accounting requirements (e.g. 6 years for financial transaction invoices).

We employ enterprise-grade technical and organisational security measures, including TLS 1.3 encryption in transit, strict Content-Security-Policies, role-based access control, and adherence to UK NCSC Cyber Essentials guidelines.

7. Your Statutory Rights & Data Management (UK GDPR)

Cankal Software operates on a strict data-minimisation principle. We do not maintain user account registries or consumer profiling databases. The only personal information we process corresponds to direct email enquiries or consultation requests sent intentionally by you.

Under United Kingdom data protection law, you possess full control over any communications or information you share with us:

• Right of Access & Review: Request a full copy of any email correspondence or enquiry records we hold.
• Right to Rectification: Request prompt correction of inaccurate or updated contact details.
• Right to Erasure ("Right to be Forgotten"): Request the permanent deletion of your emails, enquiry logs, and communication history from our active systems.
• Right to Restrict Processing: Limit how we process your communication data while reviewing your request.
• Right to Data Portability: Receive an export of your enquiry data in a standard, machine-readable format.
• Right to Object: Object at any time to communication follow-ups or direct enquiries.

To exercise any of these rights, or to request the immediate review or deletion of your communication records, please contact us directly at info@cankalsoftware.com. Our team will review and resolve your request directly and without delay.