Start a conversation

Privacy Policy

Last updated: 29 October 2026

1. Who we are

NOETIX ("we", "us", "our") is a digital risk advisory firm specialising in cybersecurity, privacy, AI governance and GRC. This Privacy Policy explains how we collect, use and protect your personal information when you visit noetix.eu or use our assessment tools.

2. Information we collect

  • Contact form submissions: details you provide voluntarily (see section 6a).
  • AI Readiness assessment submissions: details and answers you provide voluntarily (see section 8).
  • Essential technical data: our hosting provider processes basic request data (such as IP address, browser type and timestamps) to deliver the site and protect it from abuse. We do not use third-party analytics, tracking pixels or advertising tools.

3. How we use your information

  • To respond to your enquiries and provide requested information about our services.
  • To generate and send you your AI Readiness report.
  • To maintain the security and operational integrity of our website.
  • To comply with applicable legal obligations.

We do not sell, rent or share your personal information with third parties for marketing purposes.

4. Legal basis for processing

  • Consent (Art. 6(1)(a) GDPR): when you submit the contact form or the AI Readiness assessment.
  • Legitimate interest (Art. 6(1)(f) GDPR): website security and abuse prevention.
  • Legal obligation (Art. 6(1)(c) GDPR): where required by applicable law.

5. Data retention

Contact enquiries and AI Readiness submissions are stored with a 24 month retention review date. When that date passes, the record is deleted automatically. We may retain a record for longer only where an active client relationship or a legal obligation requires it.

Abuse prevention data (a salted one-way fingerprint derived from your connection, never a stored IP address) is deleted by a daily scheduled clean-up once it is more than 24 hours old. Hosting provider request logs are retained according to that provider's standard retention.

6. Your rights

Under the GDPR you have the right to access the personal data we hold about you, to have it corrected or erased, to restrict its processing, to receive it in a portable format, to object to processing based on legitimate interests, to withdraw consent at any time (without affecting processing before withdrawal), and to lodge a complaint with a supervisory authority, in particular in the Member State where you live or work.

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. Assessment scores are calculated automatically from your answers and are indicative only.

To exercise these rights, contact us at info@noetix.eu. Quoting the reference shown after you submit a form helps us locate your record quickly.

6a. Website contact form

When you submit the contact form we collect your name, email address, how you are contacting us, your area of interest, your message, your consent flag and your browser user agent string.

  • System of record: the enquiry is stored in our database hosted by Cloudflare (Cloudflare D1, EU jurisdiction). You are shown a confirmation and a short reference only after the record has been saved.
  • Internal notification: where configured, a short internal email alerts our team. It deliberately omits your message content.
  • Abuse prevention: we apply a hidden form field, a minimum completion time and rate limits based on a salted one-way fingerprint of your connection. Raw IP addresses are not stored.
  • Lawful basis: your explicit consent, given through the consent checkbox.

7. NOETIX NIS2 Compliance Assessment

The NIS2 Compliance Assessment at noetix.eu/nis2 is a self-assessment tool operated by NOETIX. It replaces the earlier tool at noetixnis2.com, which is being retired.

  • Data collection: your first name, optional last name, work email address, company, optional job title and country, your entity classification (and, if you used the guided questions, your size band and sector), your answers to the assessment questions, whether you requested a consultation, your consent flag and your browser user agent string.
  • Scoring: scores are calculated directly from your answers by our own code. No AI model is used.
  • Data storage: the submission and results are stored in our database hosted by Cloudflare (Cloudflare D1, EU jurisdiction), with a 24 month retention review date as described in section 5.
  • Browser storage: your entity classification and answers (never your personal details) are kept in your browser's localStorage so you can resume an unfinished assessment. They are removed when you submit or start again.
  • Internal notification: where configured, a short internal email notifies our team with your reference, company, email, classification, overall score and whether you asked for a consultation, never your full answer set.
  • Lawful basis: your explicit consent, given before you start the questions. You may withdraw it and request deletion at any time by emailing info@noetix.eu.
  • No tracking: the tool uses no analytics, advertising or tracking technologies.

8. NOETIX AI Readiness Assessment

The AI Readiness Assessment at noetix.eu/ai-governance/readiness is a self-assessment tool that gives an indicative AI maturity score structured around the EU AI Act, ISO/IEC 42001, NIS2 and DORA. It is currently unavailable; while it is, no data is collected through it. The points below apply when it is available.

  • Data collection: organisation name, sector, headcount, your work email address, your answers to the ten questions, your consent flag and your browser user agent string.
  • Scoring: scores are calculated directly from your answers by our own code.
  • AI processing: your organisation profile, answers and scores (not your email address) are sent to Anthropic's Claude API solely to draft the narrative of your report. Anthropic acts as our processor.
  • Data storage: the submission, the generated report and your contact details are stored in our database hosted by Cloudflare (Cloudflare D1, EU jurisdiction). Your report is shown only once that record has been saved.
  • Progress storage: your answers are held in your browser's memory only while you complete the assessment. Nothing is written to cookies or localStorage.
  • Internal notification: where configured, a short internal email notifies our team with your organisation, email, sector, headcount and maturity result only, never your full answer set.
  • Lawful basis: your explicit consent, given before submission. Consent is required to use the tool, and you may withdraw it and request deletion at any time by emailing info@noetix.eu.

9. Processors

We use the following service providers to process data on our behalf, under data processing terms:

  • Cloudflare: hosting, content delivery, security and the database for website enquiries, AI Readiness and NIS2 assessment submissions.
  • Anthropic: the Claude API, used only to draft AI Readiness report narratives. Inputs and outputs are not used to train Anthropic's models under its commercial terms.
  • Resend: where configured, delivery of internal notification emails.

Some processors may process data outside the EU/EEA. Where they do, transfers are made under appropriate safeguards such as the EU Standard Contractual Clauses or an adequacy decision.

Neither this website nor our assessment tools use third-party analytics services, social media trackers or advertising networks.

10. Data security

We apply appropriate technical and organisational measures to protect personal information against unauthorised access, alteration, disclosure or destruction. This website and both assessment tools are served only over HTTPS.

11. Changes to this policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date.

12. Contact

For any privacy-related queries, contact us at info@noetix.eu. See also our Cookies Policy.