UK GDPR & DPA 2018 / DATA PROTECTION PROTOCOL

Privacy Policy Strict UK GDPR & zero prompt logging.

Operated by Tarquin Barnsby (TarquinBarnsby.com) • Effective: 1 January 2026

1. Data Controller Identity

The data controller responsible for personal data processed through OhmCode.uk is Tarquin Barnsby, operating in London, United Kingdom. For privacy questions, contact [email protected].

2. Lawful Basis & Categories of Data Collected

We process personal data strictly in compliance with Article 6 of the UK GDPR under the lawful basis of Contractual Necessity (to provision security scans, user accounts, and billing) and Legitimate Interests (to protect our infrastructure against DDoS attacks and brute-force abuse):

• Account Credentials: Email addresses, hashed authentication passwords (using military-grade Scrypt with random salts);
• Telemetry & Security Scans: Target hostnames, HTTP security headers, CORS origin configurations, SSL certificate validation states, and remediation patch history;
• Billing Records: Subscription status and transaction identifiers processed securely by Stripe Payments UK, Ltd. (OhmCode never stores raw payment card numbers);
• Security Audit Logs: IP addresses and user-agent strings retained strictly for 30 days to enforce rate limiting and account lockout defence.

3. Zero Data Brokerage & Security Protections

We strictly never sell, rent, or trade your personal data, source code, or vulnerability telemetry to third parties, data brokers, or ad networks.

All data in transit is protected by TLS 1.3 encryption with strict HTTP Strict Transport Security (HSTS). Database records are stored in an isolated, encrypted SQLite volume on a secure London droplet.

4. Your UK GDPR Statutory Rights

Under the UK GDPR and Data Protection Act 2018, you possess the right to:

• Access: Request a copy of all scan records and account details held on your behalf;
• Rectification: Request correction of inaccurate data;
• Erasure (Article 17): Request the permanent deletion of your account and all associated scan history;
• Data Portability: Export your vulnerability findings in standard JSON or SARIF 2.1.0 formats.