Privacy Policy | Dan Sorensen

Who is responsible

DanSorensen.info is operated by Dan Sorensen, who is the controller of personal data collected through this site. Questions or requests: info@nexussecurityadvisors.com. Consulting engagements run through Nexus Security Advisors, which has its own privacy notice.

What this site does not do

No advertising pixels, fingerprinting or social media widgets.
No analytics or session recording for visitors in the EU, EEA, UK or Switzerland, or for anyone whose browser sends Do Not Track or Global Privacy Control.
No embedded videos, maps or fonts from third parties. Fonts and images are served from this site.
No sale or sharing of personal data, as those terms are defined in U.S. state privacy laws, and no use of your data for targeted advertising or profiling.
No automated decision-making that has legal or similarly significant effects on you.

What is collected, and why

When you browse. Like any web server, the hosting provider (Cloudflare) processes your IP address, browser user agent, the page requested and the time, to deliver the page and protect the site from attacks. I see only aggregate traffic counts in Cloudflare's dashboard, not information about individual visitors. Legal basis (GDPR): legitimate interest in running a secure website, Art. 6(1)(f).

Analytics. To learn which pages are useful, the site uses PostHog, a product analytics service hosted in the United States. It records page views and general interactions such as clicks, scrolling and page changes, with technical data like browser type and approximate location, and may make a session recording of how pages are used with everything typed into forms hidden. It sets a first-party cookie and a local storage identifier so visits can be counted once. Your IP address is used only to work out approximate location and is then discarded. Analytics requests pass through this site's own domain to PostHog. The same PostHog project serves nexussecurityadvisors.com, so a visit that moves between the two sites can be seen as one. Analytics never runs for visitors whose browser time zone is in Europe, or when your browser sends Do Not Track or Global Privacy Control, and you can block it with an ad blocker without affecting the site. Legal basis: legitimate interest in understanding and improving the site, Art. 6(1)(f).

When you use the contact form. The form asks for your first and last name, email address, organization, the topic and your message. It does not ask for a phone number or anything else. Your consent box confirms you want a reply. Legal basis: steps you request before a possible agreement, Art. 6(1)(b), and your consent, Art. 6(1)(a). You can withdraw consent at any time.

Bot protection on the contact page. The contact page alone uses Cloudflare Turnstile to block spam bots. Cloudflare processes technical signals such as your IP address, TLS fingerprint and user agent to tell people from bots, and states that it does not use them to identify, profile or target individuals. See the Turnstile Privacy Addendum. Legal basis: legitimate interest in keeping the form free of abuse.

When you email me. I receive whatever you include in the email.

Who processes it

Cloudflare, Inc.: hosting, content delivery, security and Turnstile bot checks.
PostHog, Inc.: website analytics and session recording, as described above.
Zoho Corporation: contact-form submissions are stored in Zoho CRM, and email is handled by Zoho Mail, so I can reply and keep track of the conversation.

These providers act on my instructions under their data processing terms. I don't send your information to anyone else unless the law requires it.

Where it is processed

Data is processed in the United States and wherever these providers operate. For visitors in the EU, EEA, UK or Switzerland, transfers rely on the providers' standard contractual clauses or another transfer mechanism recognized under applicable law.

How long it is kept

Contact-form inquiries and related email are kept while we're in touch and deleted within 24 months of our last contact, unless they become part of a business engagement or the law requires a longer period. The contact form itself stores nothing on this website; it passes your message straight to the CRM.

Your rights

Wherever you live, you can ask me to:

tell you what personal data I hold about you and give you a copy (access and portability),
correct it (rectification),
delete it (erasure),
limit or object to how it is used (restriction and objection), and
withdraw consent you gave earlier.

Email info@nexussecurityadvisors.com. I'll confirm your request and respond within 30 days, and may ask for enough information to verify it's you. You won't be treated differently for using these rights. If you're in the EU, EEA or UK, you can also complain to your local data protection authority. Residents of California and other U.S. states with privacy laws have these rights too, including the right to know and to delete; this site does not sell or share personal information.

Global Privacy Control and Do Not Track

This site treats Global Privacy Control (GPC) signals as a valid opt-out of sale and sharing. The site doesn't sell or share personal data, and when your browser sends GPC or Do Not Track, the analytics script does not run at all. The site's GPC support is declared at /.well-known/gpc.json.

Children

This site is meant for professionals and is not directed to children under 16. I don't knowingly collect their personal data. If you believe a child has sent me information, email me and I'll delete it.

How the site is secured

Every connection is encrypted with HTTPS and HSTS. A strict Content Security Policy allows scripts only from this site, including the analytics relay (plus Cloudflare's bot check on the contact page), and other security headers block framing, MIME sniffing and unneeded browser features. To report a security issue, see security.txt.

Changes to this policy

If this policy changes, the updated version will appear on this page with a new date. Material changes will be noted at the top.