// privacy notice
Privacy.
What this site collects, why, where it is held and how to ask about it. XSource Security is a sole-trader business in Christchurch, New Zealand, and handles personal information under the New Zealand Privacy Act 2020.
What is collected
Contact form. When you send a message through the form on the home page, the name, email address and message you enter are sent to XSource Security by email and stored in the site’s form log. Nothing else on this site asks you for personal information.
reCAPTCHA. The form is protected by Google reCAPTCHA, which sends your IP address, browser information and interaction data to Google to tell people from bots. Google’s Privacy Policy and Terms of Service apply to that processing.
Server and network logs. The web host and the Cloudflare network in front of it keep standard request logs (IP address, user agent, requested page, time) for security and operations. Fonts are loaded from Google Fonts, which receives your IP address when the page loads.
Cookies. This site sets no advertising or analytics cookies. Cloudflare and reCAPTCHA may set technical cookies needed for bot protection.
Why it is collected
To answer the message you sent, to scope and quote an engagement if you ask for one, and to keep the site running and protected from abuse. Your details are not sold, shared for marketing or used for anything unrelated to your request.
Where it is held and for how long
The site is hosted in the United States (HostGator) behind Cloudflare. Email correspondence is held for as long as needed to deal with your request and any engagement that follows, and for up to 24 months after the last exchange for record-keeping. Form log entries are deleted within 12 months.
Engagements
Information shared during an audit (source code, credentials, findings, reports) is covered by the engagement agreement and its confidentiality terms, not by this notice.
Your rights
Under the Privacy Act 2020 you can ask what personal information XSource Security holds about you, ask for it to be corrected, or ask for it to be deleted. Send the request by email to eva@xsourcesec.com and it is answered in writing within 20 working days. If you are not satisfied with the answer, you can complain to the Office of the Privacy Commissioner.
Changes
This notice is updated when the site or its processing changes. Last updated: September 2026.