Privacy Notice
Effective date: October 2026 | Version 1.1
AppTest Direct Ltd respects your privacy and is committed to protecting personal information that we collect and use.
This Privacy Notice explains how AppTest Direct Ltd collects, uses, stores and shares personal information when you visit our website, contact us, purchase or enquire about our services, participate in a penetration testing engagement, or otherwise interact with us.
1. Who we are
AppTest Direct Ltd is a company registered in England and Wales under company number 17459475, with its registered office at 9 Market Place, Hedon, Hull, England, HU12 8JA.
For personal information that we determine the purposes and means of processing, AppTest Direct Ltd is the data controller.
AppTest Direct Ltd is registered with the Information Commissioner's Office (ICO) as a data controller. Registration reference: ZC284652.
You can contact us about privacy or data protection matters at:
Email: hello@apptestdirect.com
Address: 9 Market Place, Hedon, Hull, England, HU12 8JA.
2. Information we may collect
Depending on how you interact with us, we may collect and process the following categories of personal information.
Identity and contact information.
This may include:
- your name;
- job title;
- organisation;
- business email address;
- business telephone number;
- postal or billing address; and
- other contact information you provide to us.
Order and billing information
This may include:
- details of services purchased or requested;
- quotation and invoice information;
- purchase order details;
- billing contacts;
- transaction information; and
- payment status.
Payment card details may be processed directly by our payment service providers. AppTest Direct does not need to store full payment card details where payment is handled by a third-party payment provider.
Enquiry and correspondence information
This may include information you provide when:
- completing a website form;
- contacting us by email or telephone;
- requesting a quotation;
- submitting an Order by Invoice request;
- communicating with us about an engagement; or
- providing feedback.
Penetration testing engagement information
Where you commission penetration testing, we may collect information required to scope, authorise, manage and deliver the engagement, including:
- names and contact details of customer representatives;
- technical and emergency contacts;
- Test Details and Authority to Test information;
- details of applications, APIs, infrastructure and other authorised targets;
- testing dates and operational requirements;
- test account usernames;
- test credentials where required;
- technical information provided by the Customer;
- correspondence relating to the engagement; and
- information required to manage retesting.
Security testing information
During an authorised penetration test, our testing may encounter or generate information relating to:
- user accounts;
- usernames;
- email addresses;
- IP addresses;
- application data;
- system information;
- logs;
- screenshots;
- request and response data;
- vulnerability evidence; and
- other information necessary to demonstrate or validate security findings.
We will seek to minimise unnecessary access to personal information and will only collect or retain information reasonably required to perform and evidence the authorised security testing.
Website and technical information
When you use our website, we may automatically receive certain technical information, including:
- IP address;
- browser type;
- device information;
- operating system;
- pages visited;
- referring pages;
- approximate location derived from technical information; and
- website interaction information.
Further information about cookies and similar technologies is available in our Cookie Policy.
Marketing and business contact information
We may hold professional contact information relating to customers, prospective customers, suppliers, partners and other business contacts.
This may include information that you provide directly or business contact details obtained from publicly available professional sources, such as:
- company websites;
- professional networking platforms;
- business directories;
- Companies House; and
- other legitimate public business sources.
3. How we obtain personal information
We may obtain personal information:
- directly from you;
- from another person within your organisation;
- through our website and online forms;
- when you place an order or request a quotation;
- through the Test Details and Authority to Test process;
- during delivery of authorised security testing;
- from customers, partners or organisations commissioning services on behalf of another organisation;
- from payment and business service providers; and
- from publicly available professional and business sources.
Where we receive your personal information from another source, we will handle it in accordance with applicable data protection law.
4. How we use personal information
We may use personal information to:
- respond to enquiries;
- provide quotations;
- process orders and payments;
- manage customer relationships;
- validate penetration testing scope;
- verify and record Authority to Test;
- arrange and deliver penetration testing services;
- communicate during an engagement;
- provide penetration testing reports and retest reports;
- manage secure access and credentials;
- provide customer support;
- administer contracts and invoices;
- maintain appropriate business, legal and accounting records;
- maintain the security of our systems and services;
- investigate misuse, fraud or security incidents;
- improve our website, services and business processes;
- manage relationships with suppliers and business partners;
- send relevant business-to-business marketing where permitted by law;
- establish, exercise or defend legal claims; and
- comply with legal and regulatory obligations.
We will not use personal information for purposes that are incompatible with those for which it was collected unless permitted or required by law.
5. Our lawful bases
Under UK data protection law, we must have a lawful basis for processing personal information.
Depending on the circumstances, we may rely on the following lawful bases.
Contract
We may process personal information where this is necessary to enter into or perform a contract with you personally.
Where our contract is with an organisation rather than the individual we are dealing with, we will generally rely on legitimate interests for the processing of relevant business contact information.
Legitimate interests
We may process personal information where necessary for our legitimate business interests, provided those interests are not overridden by your rights and interests.
These interests may include:
- providing and administering our services;
- communicating with business customers and their representatives;
- managing customer and supplier relationships;
- maintaining the security of our systems and services;
- preventing misuse and fraud;
- maintaining appropriate business records;
- improving our services;
- protecting our legal rights; and
- proportionate business-to-business marketing.
Where we rely on legitimate interests, we consider whether the processing is necessary and proportionate and whether your interests, rights or freedoms override our interests.
Legal obligation
We may process personal information where required to comply with legal, regulatory, tax, accounting or other obligations that apply to us.
Consent
Where consent is required, we will ask for it before carrying out the relevant processing.
Where processing is based on consent, you may withdraw that consent at any time.
Withdrawal of consent does not affect processing that was lawful before consent was withdrawn.
6. Penetration testing and customer-controlled data
During a penetration testing engagement, AppTest Direct may encounter personal information held within systems controlled by the Customer.
Depending on the circumstances, the Customer will normally determine why that information is processed and AppTest Direct may process it on the Customer's instructions for the purpose of performing the authorised security testing.
In those circumstances, AppTest Direct may act as a data processor and the Customer may act as the data controller.
Processing undertaken in that capacity will be governed by the applicable contractual and data-processing arrangements between AppTest Direct and the Customer.
AppTest Direct will only access and process information within authorised systems to the extent reasonably necessary to perform the agreed testing.
Where possible, Customers should provide dedicated test accounts and appropriate test data rather than unnecessary live personal information.
7. Credentials and sensitive security information
Customer credentials, vulnerability information, testing evidence and other security-sensitive information are treated as highly sensitive.
Customers should use the secure credential-sharing method provided or approved by AppTest Direct wherever reasonably possible.
We apply appropriate technical and organisational measures to protect information entrusted to us and restrict access to those who reasonably require it.
Credentials will only be retained for as long as reasonably necessary for the active testing activity. Once they are no longer required, they will be securely removed. Where credentials are required for a subsequent retest, the Customer may be asked to provide them again using the approved secure method.
8. Who we share personal information with
We do not sell personal information.
We may share personal information where reasonably necessary with trusted third parties that support our business or help us provide our services.
These may include:
- website and hosting providers;
- email and communication providers;
- cloud and document-storage providers;
- payment processors;
- accounting and financial service providers;
- professional advisers;
- security and technology service providers;
- specialist service providers supporting delivery of our services; and
- regulators, courts, law enforcement agencies or other authorities where required by law.
We only provide service providers with the information reasonably required for the relevant purpose.
Where an organisation processes personal information on our behalf, appropriate contractual and data-protection requirements will be applied where required.
We may also disclose information in connection with a genuine sale, merger, restructuring or transfer of all or part of our business, subject to appropriate confidentiality and data-protection requirements.
9. International transfers
Some of the organisations and technology services we use may process personal information outside the United Kingdom.
Where personal information is transferred internationally, we will take reasonable steps to ensure that an appropriate lawful mechanism and safeguards are in place as required by UK data protection law.
Depending on the destination and circumstances, these safeguards may include:
- UK adequacy regulations;
- approved contractual safeguards;
- the UK International Data Transfer Agreement;
- the UK Addendum to approved standard contractual clauses; or
- another lawful transfer mechanism.
10. How long we keep personal information
We do not keep personal information for longer than reasonably necessary for the purpose for which it was collected.
Retention periods depend on the type of information and why we hold it.
In general:
- Test Details, Authority to Test records, approved scope information, final Reports, QA records, relevant testing records and the minimum supporting evidence reasonably required to substantiate reported findings will ordinarily be retained for 12 months from completion of the Engagement;
- raw, duplicate, temporary or unnecessary testing data may be securely removed sooner where it is no longer required for testing, quality assurance, reporting or another legitimate purpose;
- test credentials will be securely removed when they are no longer required for the active testing activity. Where credentials are required for a later retest, the Customer may be asked to provide them again securely;
- information may be retained for longer where reasonably necessary to comply with legal or regulatory obligations, resolve a dispute, support an audit, or establish, exercise or defend legal claims.
Information may be retained for longer where reasonably necessary to comply with a legal obligation, resolve a dispute or establish, exercise or defend a legal claim.
We maintain internal retention procedures for security-sensitive customer and testing information.
11. Marketing
We may contact business customers and professional contacts about AppTest Direct services where permitted by applicable data protection and electronic marketing law.
Where we use personal information for direct marketing, we will rely on an appropriate lawful basis and comply with applicable electronic marketing requirements.
You can ask us to stop sending direct marketing at any time by:
- using the unsubscribe option included in a marketing communication; or
- contacting us using the details in this Privacy Notice.
We will respect marketing objections and may retain limited information on a suppression list so that we do not contact you again inadvertently.
Where we obtain professional contact details from publicly available sources for business-to-business outreach, we will use those details only where we consider the contact relevant and proportionate and will provide an appropriate way to object to further contact.
12. Cookies
Our website may use cookies and similar technologies for essential functionality and, where applicable, analytics or other optional purposes.
Where consent is legally required for non-essential cookies, those cookies will not be used until the required consent has been obtained.
You can find more information about the cookies used on our website and how to manage your preferences in our Cookie Policy.
13. Information security
We take reasonable technical and organisational measures to protect personal information against:
- unauthorised access;
- loss;
- alteration;
- disclosure;
- destruction; and
- misuse.
Measures are selected according to the nature and sensitivity of the information being processed.
Access to customer credentials, vulnerability information, security evidence and other sensitive engagement information is restricted to those who reasonably require access.
No method of electronic storage or transmission can be guaranteed to be completely secure, but we take appropriate steps to manage security risk.
14. Your data protection rights
Depending on the circumstances, you may have rights relating to your personal information, including the right to:
- request access to personal information we hold about you;
- request correction of inaccurate or incomplete information;
- request deletion of your personal information;
- request restriction of processing;
- object to certain processing, including direct marketing;
- request transfer of your information in certain circumstances;
- withdraw consent where processing is based on consent; and
- complain about how your personal information has been handled.
These rights are subject to conditions and exemptions under applicable data protection law and do not apply in every circumstance.
If AppTest Direct is processing your information solely on behalf of one of our Customers during a penetration testing engagement, we may need to refer your request to the relevant Customer as the data controller.
To exercise your rights, contact us using the details provided in this Privacy Notice.
15. AI-assisted technologies
AppTest Direct may use approved AI-assisted technologies to support aspects of service delivery, such as analysis, documentation, report preparation and quality assurance.
The use of AI-assisted technologies remains subject to appropriate human oversight. Penetration testing findings, severity assessments and client-facing outputs are reviewed and validated by appropriately qualified personnel before delivery.
Client confidential information, personal information and sensitive security information will not be submitted to AI-enabled services unless the use is approved, appropriate for the relevant purpose and consistent with applicable contractual and data-protection requirements. Information will be minimised, redacted or otherwise protected where appropriate.
16. Automated decision-making
AppTest Direct does not make decisions about individuals based solely on automated processing where those decisions produce legal or similarly significant effects.
17. Complaints
If you have concerns about how AppTest Direct handles your personal information, please contact us first so that we can investigate.
You also have the right to make a complaint to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection.
Information about your rights and how to make a complaint is available from the ICO at https://ico.org.uk/.
18. Links to other websites
Our website may contain links to websites operated by other organisations.
AppTest Direct does not control those websites and is not responsible for their privacy practices.
You should review the privacy information provided by the relevant organisation when visiting another website.
19. Changes to this Privacy Notice
We may update this Privacy Notice where our services, business processes, technology or legal obligations change.
The latest version will be made available on the AppTest Direct website.
20. Contact us
If you have questions about this Privacy Notice or how AppTest Direct uses personal information, please contact:
AppTest Direct Ltd
Email:
hello@apptestdirect.com
Registered office: 9 Market Place, Hedon, Hull, England, HU12 8JA.
Company number:
17459475