Privacy policy.

We collect only the personal information necessary to process your enrollment and support your certification journey:

• Full name, email address, and job title (provided during enrollment)
• Cybersecurity experience level (selected from predefined options)
• Consultation booking details, including optional topic notes
• Account authentication data, including hashed credentials and session tokens
• Usage data such as pages visited and form interactions, collected via server logs

We do not collect sensitive personal data such as Social Security numbers, financial account numbers, or biometric data.

We process your personal information under the following legal bases:

• Consent: You voluntarily provide your information when submitting an enrollment request or booking a consultation.
• Contract performance: Processing is necessary to deliver the training services you requested.
• Legitimate interests: We retain usage data to monitor security, prevent fraud, and improve our services.
• Legal obligation: We may retain records to comply with applicable laws and regulations.

• Processing and confirming your enrollment request
• Providing access to official ISC2 training materials
• Scheduling and conducting student consultations
• Sending training advisor follow-up communications
• Maintaining security, audit logs, and abuse prevention

We do not sell, rent, or share your personal information with third parties. Your data is used exclusively for enrollment, training access, and support. We may disclose information only when required by law, court order, or to protect the rights, property, or safety of Klean IT, our users, or others.

We protect your personal information using industry-standard security controls aligned with NIST SP 800-53 and CISSP best practices:

• AES-256 encryption for data at rest
• TLS 1.3 encryption for all data in transit
• Role-based access control (RBAC) on all stored records
• HMAC-signed, short-lived submission tokens on all forms
• IP-based rate limiting and honeypot bot detection
• Server-side input validation, sanitization, and encoding

You have the following rights regarding your personal information:

• Access: Request a copy of the personal data we hold about you
• Correction: Request that we correct inaccurate or incomplete data
• Deletion: Request that we delete your personal data, subject to legal retention requirements
• Portability: Request a machine-readable copy of your data for transfer to another provider
• Objection: Object to the processing of your data for specific purposes
• Withdrawal: Withdraw consent to processing at any time

To exercise any of these rights, contact us at kleanitnnovationconsultants@gmail.com.

We retain your personal information only as long as necessary to fulfill the purposes described in this policy. Training records are retained for seven years; audit logs for two to five years. Detailed retention schedules are documented in our internal Data Retention Policy.

We use only essential cookies required for authentication and session management. We do not use third-party tracking cookies, advertising pixels, or analytics that collect personally identifiable information.

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated effective date. We will provide at least 30 days’ notice before material changes take effect. Continued use of the portal after the effective date constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or your personal data, contact us at: