Privacy Notice
Version 2026-11-05. This notice applies to people who use purpleteam.support.
Draft for legal review. Items in square brackets must be completed or confirmed before publication.
1. Who we are
The website purpleteam.support and the PurpleTeam services are provided by Intuisco Ltd, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom ("we"). We are the controller of the personal data described here.
Contact for privacy matters: info@intuisco.co.uk.
[Representative in the European Union under Article 27 GDPR, if required: to be completed.]
2. What this notice covers
This notice covers the request form on this website and the way we run the website. It does not cover personal data we process later, if we work together, in a contract with you: that is explained in the contract.
3. What we collect, why, and on what basis
| Purpose | Data | Legal basis |
|---|---|---|
| Reply to your request for PTaaS access, a penetration test, a purple team exercise or consulting, and decide how to proceed | Name, work email, company, role, interest, what you would like tested, free-text message, the language of the site, the date and the version of this notice you saw | Steps at your request before entering into a contract (Article 6(1)(b) GDPR). Where the request comes from a company, our legitimate interest in answering a business enquiry (Article 6(1)(f)). |
| Keep the website secure and stop abuse of the form | A keyed hash of your IP address (we do not store the address itself in the request), and standard web-server logs | Our legitimate interest in the security of the service (Article 6(1)(f)). |
| Show who accessed or changed a request | The email of the staff member, the action and the time. It does not contain the content of your request. | Our legitimate interest in accountability and security (Article 6(1)(f)). |
We do not use your details for marketing, we do not send newsletters, and we do not make automated decisions about you.
You do not have to give us your company or the optional text. The name, email and the choice of what you are interested in are needed to be able to reply.
4. How long we keep it
- Requests are deleted automatically 12 months after we receive them. If we start working together, the data moves into the contract records and follows the retention rules of that contract and of the law. If you ask us to delete it sooner, we do.
- Audit-log entries are kept for 24 months.
- Web-server logs are kept for a short period set in our hosting configuration. [Period to be confirmed.]
5. Who can see it
- Our staff who handle requests, through a password-protected admin area with roles. Only those who need to see requests can.
- Providers that host the website and deliver our email, acting on our instructions. [List of providers and their locations to be completed.]
- Authorities, where the law requires.
We do not sell personal data. [Transfers outside the UK and the European Economic Area, if any, and their safeguards: to be completed.]
6. How we protect it
The connection to the website is encrypted. The free-text fields of a request (what you would like tested and anything else you write) and our internal notes are encrypted in the database. Access to the admin area is limited by role, and what staff view, change, export or delete is recorded in an audit log. We ask you not to send passwords, keys or confidential reports through the form.
7. Your rights
You can ask us to show you the data we hold about you, correct it, delete it, restrict its use, give you a copy you can reuse, or you can object to the processing based on our legitimate interest. Write to info@intuisco.co.uk and quote the reference shown after you sent your request, if you have it. We reply within one month. We may ask for proof that the request comes from you.
If you think we have handled your data wrongly, you can complain to the Information Commissioner's Office (UK, ico.org.uk), or to the data protection authority of your country. In Italy this is the Garante per la protezione dei dati personali (garanteprivacy.it).
8. Cookies
This website uses only the cookies it needs to work and to protect the form from forgery (a session cookie and a security token). It does not use analytics, advertising or social-media cookies, and it loads its fonts and scripts from its own server. See the Cookie Policy.
9. Children
The website is for businesses and is not aimed at children.
10. Changes
If we change this notice, we publish the new version here and update the version date above. The version you were shown is stored with your request.