Website privacy notice
How we handle personal data about the people who visit this website, send us an enquiry or book a pilot, and the business contacts at our customers. For these, we decide how the data is used: we are the controller.
Draft v0.3 (October 2026), replacing v0.2 of 12 December 2024. This draft is for review by our legal advisers. It is not legal advice and is not yet in force. Effective date: [PLACEHOLDER: effective date].
This notice does not cover the monitoring data that our customers collect with the CNA service. For that data the customer is the controller and we act on its instructions: see the service privacy notice.
Who we are
| Controller | Rossi Networks Limited, trading as CNA (Continuous Network Assessment) |
|---|---|
| Company number | 11590609, registered in England and Wales |
| Registered office | Unit 36 Silk Mill Industrial Estate, Brook Street, Tring, HP23 5EF, United Kingdom |
| ICO registration number | 00015926133 |
| Privacy contact | info@cnassess.co.uk |
Email us at the address above, or write to us at the registered office, about anything in this notice or to exercise your rights.
What we collect
| When | What we collect | Where it comes from |
|---|---|---|
| You email or call us | Your contact details and what you tell us. | You |
| Your organisation is a customer or is evaluating CNA | Business contact details (name, work email, work phone, role, organisation) of the people we deal with on contracts, pilots, invoices and support. Records of our dealings with them. | You, or a colleague at your organisation |
| You visit this website | The request data any web server receives, processed by our website host, Cloudflare, to deliver the site and protect it from attacks: your IP address, the page requested, your browser type and the time. We do not receive or keep these logs. | Your browser |
This website sets no cookies and runs no analytics or third-party tracking. See Cookies.
Please do not send us special category data (for example about health) by email. We do not need it.
Why we use it, and our lawful basis
UK data protection law requires a lawful basis for each use of personal data. Ours are:
| Purpose | Lawful basis |
|---|---|
| Replying to your enquiry, and arranging a pilot you ask for | Legitimate interests: responding to business enquiries. Where you are contracting with us yourself, taking steps at your request before a contract. |
| Delivering the service, managing the customer account, invoicing and support | Contract with your organisation. For you as its contact: legitimate interests in running that contract. |
| Telling business contacts about CNA products, events and updates | Legitimate interests: business-to-business marketing. Every message lets you opt out, and you can object at any time; we then stop. |
| Keeping the website and our systems secure, using access logs | Legitimate interests: protecting the website and detecting misuse. |
| Keeping financial and contract records | Legal obligation (tax and company law). |
| Establishing, exercising or defending legal claims | Legitimate interests. |
Where we rely on legitimate interests, we have weighed them against your rights and expectations as a business contact. Ask us for details of that assessment.
How long we keep it
| Data | Kept for |
|---|---|
| Enquiries that do not lead to a contract | [PLACEHOLDER: confirm retention for enquiries; review suggests 24 months after last contact] |
| Contract, invoicing and account records | 7 years after the contract ends |
| Marketing contact details | [PLACEHOLDER: confirm retention for marketing contacts and for the opt-out (suppression) list] |
| Website request data | Not kept by us. Cloudflare keeps it only as long as it needs to run and secure its network. |
At the end of the period the data is securely deleted or anonymised.
Who we share it with
- Our service providers, who process it on our instructions: website hosting and email. They are listed on the sub-processors page.
- Professional advisers, such as lawyers and accountants, where needed.
- Authorities, such as regulators, courts or law enforcement, only where the law requires it.
We do not sell personal data, and we do not share it with others for their own marketing.
International transfers
The website is served by Cloudflare, Inc. from its worldwide network. Cloudflare is based in the USA and covered by the UK Extension to the EU–US Data Privacy Framework (the UK–US data bridge). Ask us for details of these safeguards.
Security
This website is static: it runs no server code and holds no database. Pages are served over HTTPS, and the site collects nothing from you: enquiries reach us by email. Access to enquiries and customer records is limited to the staff who need it.
Your rights
You have the right to:
- access the personal data we hold about you;
- have inaccurate data rectified;
- have your data erased, where we no longer have a reason to keep it;
- restrict how we use it while a concern is resolved;
- portability: receive data you gave us in a common machine-readable format;
- object to uses based on legitimate interests, and to direct marketing at any time.
Send requests to info@cnassess.co.uk. We reply within one month, which the law allows us to extend in some cases; we will tell you if we do. There is normally no fee.
Complaints
If you are unhappy with how we have handled your personal data, please complain to us first, at info@cnassess.co.uk. Under the Data (Use and Access) Act 2025 we will acknowledge your complaint within 30 days, look into it, and tell you the outcome without undue delay.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk/make-a-complaint.
Automated decisions
We make no decisions about you with legal or similarly significant effects solely by automated means, and we do not profile website visitors.
Cookies
This website sets no cookies. See Cookies.
Changes to this notice
Each version shows its number and effective date. We will notify customers of material changes by email before they take effect. This version: Draft v0.3 (October 2026), effective [PLACEHOLDER: effective date].