Operator: QSai LLC (CISO Marketplace)
Site / Platform: zerotrustciso.com
Domains Covered: zerotrust-1qv.pages.dev, zerotrustciso.com
Effective Date: 2026-11-14
Next Scheduled Review: 2027-11-14
Jurisdictions in Scope: EU, US, US-CA, global
1. [Who We Are](#1-who-we-are)
2. [Scope of This Notice](#2-scope-of-this-notice)
3. [Data We Collect and Why](#3-data-we-collect-and-why)
4. [Lawful Basis for Processing](#4-lawful-basis-for-processing)
5. [How We Use Your Data](#5-how-we-use-your-data)
6. [Sharing and Disclosure](#6-sharing-and-disclosure)
7. [International Transfers](#7-international-transfers)
8. [Retention and Disposal](#8-retention-and-disposal)
9. [Cookies, Storage and Analytics](#9-cookies-storage-and-analytics)
10. [Data-Subject Rights](#10-data-subject-rights)
11. [California Residents — CCPA / CPRA](#11-california-residents--ccpa--cpra)
12. [Children's Privacy](#12-childrens-privacy)
13. [Security](#13-security)
14. [Data Breaches](#14-data-breaches)
15. [Changes to This Policy](#15-changes-to-this-policy)
16. [Contact and Complaints](#16-contact-and-complaints)
QSai LLC (CISO Marketplace) ("we", "us", "our") operates the website accessible at zerotrust-1qv.pages.dev, zerotrustciso.com (collectively, "zerotrustciso.com").
For the purposes of the EU General Data Protection Regulation (GDPR) and equivalent legislation, QSai LLC (CISO Marketplace) is the data controller for personal data collected through zerotrustciso.com. For the purposes of the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), QSai LLC (CISO Marketplace) is the business.
Our designated contact for privacy matters is our Data Protection Officer — see [Section 16](#16-contact-and-complaints).
This Privacy Policy applies to personal data collected through zerotrustciso.com and its sub-domains, and to correspondence where you are directed to this policy.
It does not apply to third-party sites linked from zerotrustciso.com, nor to other properties operated by QSai LLC (CISO Marketplace), which publish their own notices — although several share the central sign-in and payment services described in [Section 6](#6-sharing-and-disclosure).
Purchases are additionally governed by our Terms of Service and our Refund & Return Policy, and licensed products by our End User Licence Agreement.
We collect only what is necessary for the purposes below (data-minimisation, GDPR Art. 5(1)(c)). The categories we collect on this site are payment/billing, personal, account/profile, which in practice means:
| Category | Typical fields | Source | Purpose |
|---|---|---|---|
| Identity | Name, email address | You, at checkout or sign-in | Fulfilling your order and contacting you about it |
| Account | Your identifier at our central sign-in service, and a session token | You, when you sign in | Authentication; finding what you own |
| Transaction | What you bought, order and checkout-session identifiers, amount, currency | You, at checkout | Fulfilment, entitlement, refunds, tax and accounting records |
| Payment | We never receive or store your card details. They are entered directly with our payment processor. We receive a confirmation, the last four digits, and the card brand. | Payment processor | Taking payment; matching a refund to its original method |
| Support | Whatever you write to us, and our replies | You | Answering you |
| Usage | Pages viewed, referring site, approximate location derived from IP, device and browser type | Automatic — only after you accept analytics | Understanding how the site is used |
We do not knowingly collect special-category data (health, racial or ethnic origin, political opinions, biometrics, and similar). We do not ask for it, and no field on the site invites it.
No usage data is collected unless you accept analytics. If you choose "Necessary only", or ignore the consent banner, no analytics loads.
| Lawful basis | When we rely on it |
|---|---|
| Contract (Art. 6(1)(b)) | Taking your order, delivering it, maintaining your account, and handling refunds |
| Legitimate interests (Art. 6(1)(f)) | Fraud prevention, securing the site, and answering support enquiries. A Legitimate Interests Assessment is documented internally for each |
| Consent (Art. 6(1)(a)) | Analytics, and any marketing email. Withdrawable at any time, without detriment |
| Legal obligation (Art. 6(1)(c)) | Retaining transaction records for tax and accounting |
We do not carry out automated decision-making that produces legal or similarly significant effects.
1. Delivering what you bought or requested — processing the order and maintaining the record of what you are entitled to.
2. Transactional email — confirmations, receipts, delivery, and notices about something you own. These are not marketing.
3. Support — answering your questions.
4. Security and fraud prevention — detecting and preventing fraudulent transactions and abuse.
5. Legal and tax compliance — keeping the records we are required to keep.
6. Improving the site — but only from analytics you have consented to, and only in aggregate.
We do not sell your personal data, and we do not share it for cross-context behavioural advertising. We run no advertising on zerotrustciso.com and no ad network is present.
We share data only with processors engaged under written data-processing agreements, in these categories:
| Category | What they process | Why |
|---|---|---|
| Hosting and infrastructure | Site delivery, request logs, file storage | Serving the site |
| Payment processing | Your name, email and payment details | Taking payment. Card details go to the processor directly and never reach us |
| Authentication | Sign-in identity | Signing you in across our properties |
| Transactional email | Your email address and message content | Sending order and service email |
| Analytics | Usage data as described in Section 3 | Only if you accept. See [Section 9](#9-cookies-storage-and-analytics) |
A current list of the specific providers is available on request at [email protected].
We may also disclose personal data where required by law — a court order, subpoena or regulatory demand — or to protect someone's safety. In a merger, acquisition or sale of assets, data may transfer to the successor under equivalent protections, and you will be notified as required.
We may share aggregated or de-identified information that cannot reasonably identify you.
QSai LLC (CISO Marketplace) operates across EU, US, US-CA, global, and your data may be processed outside your home jurisdiction.
For transfers from the EEA, UK or Switzerland we rely on the European Commission's Standard Contractual Clauses (2021 SCCs) or the UK International Data Transfer Agreement, together with any applicable adequacy decision. Where we rely on a derogation under GDPR Art. 49, we apply it narrowly and only where a specific condition is met.
You may request a copy of the relevant transfer mechanism at [email protected].
We keep personal data only as long as necessary, or as long as the law requires, under our Data Retention & Disposal Policy.
| Data | Retention |
|---|---|
| Transaction records | 7 years from the transaction, for tax and accounting |
| Account and identity data | For the life of your account, then 24 months |
| System and access logs | 12 months |
| Support correspondence | 24 months after the matter is closed |
| Analytics data | 14 months, in the analytics provider's own retention settings |
| Consent records | 24 months after the consent is withdrawn or replaced |
Where a longer statutory period applies, or where data is under legal hold, retention extends until that ends. When a period expires, data is securely destroyed by a method appropriate to the medium, in line with ISO 27001 A.8.10.
Where an account grants continuing access to something you have purchased, the record of that entitlement is retained for as long as the access is offered — deleting it would remove access you paid for.
Browser storage. Sign-in state and any cart contents are held in your browser's localStorage, and short-lived values during sign-in in sessionStorage. These are not cookies, are not transmitted with every request, and clearing your browser data removes them.
Cookies. We set a first-party cookie recording your consent choice, so we do not ask again. If you accept analytics, the analytics provider sets its own cookies on this domain.
Analytics. Where analytics is enabled on this site it runs only on consent, with advertising features and cross-site signals disabled and IP addresses anonymised.
| Category | Purpose | Consent required |
|---|---|---|
| Strictly necessary | Sign-in, cart, security, and remembering your consent choice | No |
| Analytics | Understanding how the site is used | Yes |
There is no advertising or marketing category. We do not run interest-based advertising, do not participate in an ad network, and have no third-party tracking pixels.
On your first visit a consent banner offers you the choice to accept analytics or continue with necessary cookies only. Analytics does not load unless you accept; if the banner does not load, analytics does not either.
To change your choice, clear the consent cookie in your browser and reload — the banner will ask again. Most browsers also let you block or delete cookies entirely.
We honour Global Privacy Control and Do Not Track signals for analytics.
Depending on where you live, you have the rights below. We respond within 30 calendar days (GDPR) or 45 calendar days (CCPA, extendable once by 45 days with notice).
| Right | What it means | How to exercise it |
|---|---|---|
| Access | Confirmation of whether we hold your data, and a copy | Email [email protected] |
| Rectification | Correcting inaccurate or incomplete data | Update your account details, or email us |
| Erasure | Deletion where there is no lawful reason to keep it. Note that deleting an account may end access to things you have purchased, and we must keep transaction records for tax purposes | Email [email protected] |
| Restriction | Pausing processing in defined circumstances | Email [email protected] |
| Portability | Your data in a structured, machine-readable format | Email [email protected] |
| Object | To processing based on legitimate interests, or to direct marketing. Marketing objections are absolute | Unsubscribe link, or email us |
| Withdraw consent | For analytics or marketing, at any time, without affecting prior lawful processing | Clear the consent cookie; unsubscribe link for email |
| Non-discrimination | We will not treat you differently for exercising a privacy right | A standing commitment |
Verification. We verify identity before acting on a request, proportionately to the sensitivity involved, and will not demand excessive data to do it. You may use an authorised agent with written proof of authorisation.
Appeals. If we decline, we will explain why. Email [email protected] with the subject "DSAR Appeal". You may also complain to a supervisory authority ([Section 16](#16-contact-and-complaints)).
This section supplements the rest of this policy for California residents.
In the preceding 12 months we have collected: identifiers (name, email, IP address, account identifier); commercial information (purchase history); and internet activity (pages viewed) — the last only where analytics consent was given. Specific fields are in [Section 3](#3-data-we-collect-and-why), and we collect them for the purposes in [Section 5](#5-how-we-use-your-data).
We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined by the CPRA. We therefore do not offer a "Do Not Sell or Share My Personal Information" link, because there is nothing to opt out of. If that ever changes, this policy will be updated and the required mechanism provided before any such processing begins.
Where we collect account sign-in credentials, the CPRA treats them as sensitive personal information. We use them only to sign you in. We do not use or disclose sensitive personal information to infer characteristics about you, so the right to limit its use does not arise. We do not collect precise geolocation.
You have the rights to know, delete, correct, and non-discrimination, exercisable as set out in [Section 10](#10-data-subject-rights). We respond within 45 calendar days, extendable to 90 with notice.
Under California Civil Code §1798.83 you may request information about disclosures for third-party direct marketing. We make none.
zerotrustciso.com is not directed to children under 16 (or under 13 where COPPA applies). We do not knowingly collect data from children. If you believe we have, email [email protected] and we will delete it promptly.
We apply technical and organisational measures appropriate to the risk, consistent with GDPR Art. 5(1)(f):
No transmission over the internet is completely secure. Use a strong, unique password, and tell us promptly if you suspect unauthorised use of your account.
If a personal-data breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours of becoming aware where feasible (GDPR Art. 33), or within the applicable US state deadline; and notify you without undue delay where the risk is high (GDPR Art. 34). We maintain a breach register and conduct a post-incident review.
If you discover or suspect a breach involving your data, email [email protected].
We review this policy at least annually — next scheduled review 2027-11-14 — and whenever our processing, our technology, or the law changes materially.
For material changes we will update the effective date, post a notice on zerotrustciso.com for at least 30 days, and where the change materially affects your rights or the law requires it, seek fresh consent or notify you by email.
Previous versions are available on request.
Data Protection Officer
QSai LLC (CISO Marketplace)
Email: [email protected]
Please mark your subject line ("DSAR Request", "Cookie Query", "CCPA Request") so we can route it. We acknowledge within 5 business days.
Supervisory authorities (GDPR). If you are in the EEA or UK you may complain to your local data-protection authority — in the UK, the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to address your concern first.
California. You may contact the California Privacy Protection Agency (cppa.ca.gov) or the California Attorney General (oag.ca.gov/privacy).
Document ID: DP-PP-MASTER-001
Owner: Data Protection Officer
Classification: Public
Effective Date: 2026-11-14
Next Review: 2027-11-14