1. Data Controller

ISMS Calculator is a SaaS product operated by ISMS Calculator (hereinafter referred to as "we", "us", or "the Company").

For any privacy-related inquiries, you may contact us at support@ismscalculator.com.

2. What Data We Collect

When you use ISMS Calculator, we may collect the following information:

Account data: Your name, email address, and profile picture (when authenticating via Google OAuth).
Estimation data: The calculator inputs you provide (company size, industry, maturity ratings, etc.) and the resulting estimates, when you choose to save them.
Assessment & lead data: When you use our free mini-assessment or readiness self-check, we collect the email address you submit (and optional name and company), together with your answers and resulting score, so we can deliver your results and, where you have consented, send you relevant follow-up information.
Consultant introduction requests: When you use the "Request an intro" feature in our Consultant Marketplace, we collect your name, email address, optional company name, and the message you write, in order to forward your request to the specific consultant you selected.
Technical data: IP address, browser type, device information, and usage analytics collected automatically to maintain and improve the service.

3. How We Use Your Data

To provide and maintain the ISMS Calculator service.
To authenticate your identity and manage your account.
To store and retrieve your saved estimates.
To deliver the results of any mini-assessment or readiness check you complete, and to manage leads you voluntarily submit.
To facilitate introductions between you and independent consultants in our marketplace, when you explicitly request them.
To improve the service, fix issues, and develop new features.
To comply with legal obligations applicable under Belgian and EU law.

4. Legal Basis for Processing (GDPR)

We process your personal data based on:

Contractual necessity: Processing required to provide the service you signed up for.
Legitimate interest: Analytics and service improvement.
Consent: Where explicitly given, such as marketplace introduction requests and optional marketing communications.

5. Data Storage and Security

Your data is stored on secure, encrypted servers. We implement industry-standard technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. Each user’s saved estimates are fully isolated and not accessible to other users.

6. Data Retention

We retain your account data and saved estimates for as long as your account is active. You may delete individual estimates at any time. If you wish to delete your account entirely, contact us at the address above.

7. Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the right to:

Access the personal data we hold about you.
Rectify inaccurate or incomplete data.
Request erasure of your personal data.
Restrict or object to certain processing activities.
Data portability in a machine-readable format.
Lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit).

8. Third-Party Services

We may use the following third-party services:

Google OAuth: For social login authentication. Google’s privacy policy applies to their handling of your authentication data.
Email delivery (Resend): To send transactional emails such as password resets, assessment reports, and consultant marketplace notifications.
Analytics providers: To understand usage patterns and improve the service.

9. Consultant Marketplace & Data Sharing

Our Consultant Marketplace lets you request an introduction to independent, third-party ISO 27001 consultants listed in our directory. When you submit a "Request an intro":

We share the details you provide — your name, email address, optional company name, and message — with the specific consultant you selected, so they can respond to you directly.
Each consultant is an independent third party and acts as a separate, independent data controller for the information they receive. Once your request is forwarded, the consultant’s own privacy practices govern how they use your data.
We obtain your explicit consent (via a checkbox) before any introduction request is submitted, and we retain a record of the request to operate, secure, and improve the marketplace.
We do not sell your personal data, and we do not share your marketplace request with consultants you did not choose to contact.

10. Consultant Data-Processing Obligations

Consultants who receive your details through the marketplace are required, as a condition of being listed, to handle that data responsibly. In particular, each listed consultant agrees to:

Use your information solely to respond to and follow up on your introduction request, and not for unrelated marketing without a separate lawful basis or your consent.
Comply with the EU General Data Protection Regulation (GDPR) and all other applicable data-protection laws as an independent data controller.
Keep your information confidential and secure, applying appropriate technical and organizational measures.
Not sell your data or disclose it to further third parties without a lawful basis.
Honour your data-subject rights — including access, correction, and erasure — and delete your details when they are no longer needed.

11. Data Processing Addendum (DPA)

Where a consultant or service provider processes personal data on our behalf (as a processor) rather than as an independent controller, we put an appropriate Data Processing Addendum (DPA) in place in accordance with Article 28 GDPR. The DPA sets out the subject matter, duration, nature and purpose of the processing, the types of data and categories of data subjects, and the obligations and rights of the parties — including confidentiality, security, sub-processor controls, assistance with data-subject requests, and deletion or return of data at the end of the engagement.

If you believe your data has been misused by a listed consultant, please contact us at support@ismscalculator.com and we will investigate and, where appropriate, remove the listing.

12. Cookies

We use essential cookies for authentication (session tokens). We may also use analytics cookies to understand how the service is used. You can control cookie settings through your browser preferences.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting a notice on the service. Continued use of the service after changes constitutes acceptance of the revised policy.