How I handle your data

Who I am

This site is run by McAlpine Cyber and AI Pty Ltd, an Australian company. I'm Haden McAlpine, and I'm the person who reads what you send. For anything in this notice, email haden@mcalpinecyber.ai.

What I collect

Only what you type into the contact form: your name, work email, organisation, the focus area you pick, and your message. I don't ask for anything else and I don't buy or enrich contact data from anywhere.

Like any web server, Cloudflare processes your IP address and browser details to deliver the site and keep bots out.

Why, and on what basis

• Replying to your enquiry and scoping any work you ask about. This is a step you've asked me to take before a possible contract (UK GDPR and EU GDPR Art. 6(1)(b)).
• Keeping the form free of spam and abuse through Cloudflare Turnstile. This is my legitimate interest in running a secure site (Art. 6(1)(f)).

I won't add you to a mailing list or use your details for marketing.

Who else touches it

• Cloudflare hosts the site, runs the Turnstile bot check, and sends the form to me by email.
• Google Workspace hosts the mailbox your enquiry lands in.
• Google Fonts serves the site's typefaces, so your browser sends your IP address to Google when a page loads.

Nobody else gets it. I don't sell or share personal data.

Where it goes

I'm based in Australia, so that's where your enquiry is read and handled. Cloudflare and Google run global infrastructure, including in the United States. Both rely on the EU-US Data Privacy Framework (and its UK extension) and on Standard Contractual Clauses for transfers out of the UK and EU.

Cookies and analytics

This site sets no advertising or tracking cookies. Cloudflare may set a strictly necessary security cookie as part of its bot protection. If visitor analytics are switched on, they use Cloudflare Web Analytics, which counts page views without cookies and without fingerprinting you.

How long I keep it

Enquiries stay in my mailbox for up to 24 months and are then deleted. If we end up working together, the enquiry becomes part of the engagement record and is kept for as long as the contract and the law require.

Your rights

You can ask me for a copy of your data, or ask me to correct it, delete it, restrict it, or stop using it. Email me and I'll deal with it myself, usually well inside the one month the law allows.

If you're not happy with how I've handled something, you can complain to the UK Information Commissioner's Office, the data protection authority in your EU country, or, in Australia, the OAIC. I'd appreciate the chance to fix it first.