Last updated: 4 October 2026
w3K LLC (“w3K”, “we”, “us”) is an information technology and security firm. This policy explains what personal information we collect, why, and what you can do about it.
What this policy covers
This is w3K’s master privacy policy. It applies to everything we operate: this website, every other w3K domain and subdomain, the software we build, the systems we host and administer for clients, and the services we deliver on site.
Some products have their own privacy notice, because a particular service needs to say something specific. Those notices add to this policy; they do not replace it. Where a product notice is silent, this document governs. Where the two conflict, the product notice wins for that product only, and the rest of this policy still stands.
If you are not sure which applies to you, assume this one does and contact us.
Two different relationships
How we handle your information depends on how you reach us, and the distinction matters more than it may appear:
- You deal with w3K directly: you visit a site of ours, enquire about work, become a client, or use a service we offer to the public. We are the controller of that information and answerable to you for it.
- Your employer engages w3K: we administer the systems you use at work, or we hold your employment records on their behalf. Your employer is the controller and we are their processor. We act on their written instruction. Send requests about your data to them first; we will help them answer you.
The second case is the common one for staff at organizations we support, and it is why we will not unilaterally change or delete an employment record on request; the decision is the employer’s to make.
What we collect, and why
When you contact us or become a client
Your name, email address, phone number, company, and whatever you choose to tell us. We use it to answer you, quote work, deliver it, invoice it, and keep the records a business has to keep. Client and billing records are held in our client portal.
When you visit a w3K site
Standard web server logs, including IP address, browser, and the pages requested, kept for security and troubleshooting. Cookies strictly necessary for the site to work, and for signing in where a site has accounts. We do not use advertising cookies, we do not sell personal information, and we do not share it for cross-context behavioural advertising. Pages that embed third-party content (a video, a map) may let that provider set its own cookies under its own policy.
When you sign in with Google
Several w3K systems use Google as the only sign-in method, with no separate w3K password. We ask Google for three things (openid, email and profile) and keep two: your email address and the stable numeric identifier Google assigns your account. That identifier is what links you to your record, which is why changing your email address does not lock you out.
We never see and never receive your Google password. We do not request access to your mail, files, or calendar, and could not read them if we tried.
Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. We do not sell that data, use it for advertising, or let people read it except where you ask us to, where security or law requires it, or where it has been aggregated and made anonymous.
When we administer your workplace accounts
Where an employer asks us to run their identity and account administration, we hold what employment administration requires:
- Identity and role: name, preferred name, work and personal email, phone, job title, department, manager, employment status and type, hire and termination dates.
- Sensitive personal details: date of birth, home address, emergency contact name and number, certifications and skills, where the employer needs them.
- Linked platform accounts: which systems you hold an account on, the identifier each assigns you, and whether it is active.
- Credentials: see below.
- An audit record: who did what, to which record, when, and from which IP address.
When we host, support, or secure your systems
Hosting, networking, surveillance, and security work gives us access to systems that contain other people’s data. We access it only to do the work we were engaged for. Security engagements (penetration testing, assessments, incident response) are carried out under written authorization from the system’s owner, and findings go to that owner.
Stored credentials
Some engagements require us to hold account passwords so an administrator can issue them. We are deliberate about this:
- Encrypted with AES-256-GCM, with the key held outside the database, so a copy of the database alone cannot decrypt them.
- Kept in a separate store from the records they belong to, so ordinary queries never carry them.
- Readable only by named roles, not by seniority; an administrator who configures a system is not thereby entitled to read its credentials.
- Every read recorded against the person who performed it.
- Where a provider gives no way to read a password back, what we hold is only ever the last password we set, and our tools say so rather than implying the value is current.
Systems that sign in through an identity provider hold no password with us at all.
Who else sees your data
We do not sell personal information. We disclose it only to:
- Your employer or the client who engaged us, where they are the controller.
- Platforms we administer on their behalf: creating an account necessarily sends the details needed to create it.
- Suppliers who host, protect, or support our systems, under contract and only as needed.
- Professional advisers and authorities, where the law requires it.
Where your data is held
w3K operates its own infrastructure, and client data is held there by default rather than scattered across third-party services. Some services necessarily involve a provider outside the United States; where that happens we use appropriate safeguards for the transfer.
How long we keep it
Client and billing records are kept for as long as the relationship lasts and afterwards for as long as tax, contract, and legal obligations require. Employment records are kept while the employer’s engagement continues, then only where an obligation requires it. Enquiries that do not become work are kept briefly and then deleted.
Audit records are kept longer by design: an audit trail that can be quietly deleted is not an audit trail.
Note that disabling an account is not the same as destroying it. Our tools suspend rather than delete, so a person’s work stays recoverable; permanent deletion is a deliberate, separate act.
Your rights
Depending on where you live, you may have the right to see the personal information we hold about you, to have it corrected or deleted, to limit or object to how we use it, to withdraw consent you previously gave, and to receive a copy in a portable form. Exercising any of these will never lead to discriminatory treatment.
If your employer or another client engaged us, send your request to them; they instruct us, and we will help them respond. Otherwise write to us at the address below. We will reply within the period the applicable law allows, and we may need to verify who you are first.
Security
We encrypt data in transit and encrypt stored credentials at rest. Access is restricted by role and audited. Being a security firm, we would rather tell you plainly what we do than claim to be impregnable: no system is, and anyone who says otherwise is selling something. If we discover a breach affecting your data, we will notify you and the relevant authority as the law requires.
Children
Our services are for businesses and their staff. We do not knowingly collect information from children under 13. If you believe we have, contact us and we will delete it.
Changes
If we change this policy we will update the date at the top. Material changes affecting clients will be communicated to them directly.
Contact
w3K LLC
Email: [email protected]