How we handle your information

Who we are

ClosedSources is the registered business name (No. 788973) of Igor Bogovic, an independent third-party risk practice trading from 20 Harcourt Street, Dublin, D02 H364, Ireland. For the purposes of the General Data Protection Regulation (GDPR), Igor Bogovic, trading as ClosedSources, is the data controller for any personal data described in this notice. You can reach us at contact@closedsources.com or by post at the address above.

What this website collects

Very little. This site has no forms, no user accounts, and sets no cookies or browser storage. We have verified this at the HTTP level. If that ever changes, we will update this notice first. We use Vercel Analytics and Vercel Speed Insights, two cookie-free services that record aggregate page views, page load performance, and anonymised technical information such as browser type and country. Neither identifies individual visitors, and we cannot trace any of this data back to you.

If you email us

When you contact us, we receive your email address, your name if you include it, and whatever you choose to write. We use this information solely to respond to your enquiry and, if you engage us, to carry out the work you have asked for. The legal basis is our legitimate interest in responding to enquiries (Article 6(1)(f) GDPR) and, where an engagement follows, the performance of a contract (Article 6(1)(b) GDPR).

Our email is hosted with Proton, whose servers are located exclusively in Switzerland, Germany and Norway. Switzerland is outside the EU and EEA; transfers there are covered by the European Commission's adequacy decision for Switzerland. Correspondence relating to an enquiry that does not proceed is deleted within 12 months. Documents and working material from an engagement are deleted 12 months after the engagement ends unless you ask us to keep them. Invoices and accounting records are kept for as long as Irish tax law requires.

If we contact you first

Occasionally we identify a named contact at an organisation from public sources, such as a company's own website or a professional network, so we can flag something we have observed in public records about that organisation or propose working together. In those cases we hold a name, a role, a work email address, and a note of where we found it. Our legal basis is legitimate interests (Article 6(1)(f) GDPR), and because we obtained the details from a source other than you, the first message we send will tell you how we found them (Article 14 GDPR). We keep this for no more than 12 months after our last contact, and if you reply asking us to stop, we will delete it and not contact you again.

Personal data in our assessment work

Our assessments draw on public records, which can incidentally include personal data about people connected to a supplier, such as the names of directors in company registries or court records, or work email addresses that appear in publicly reported data breaches. We process this information under our legitimate interest in delivering the assessment a client has engaged us for (Article 6(1)(f) GDPR), we collect it only from public sources, we include it in a report only where it is relevant to the findings, and we do not use it for any other purpose. The rights described below apply to this data too.

Because this data is drawn from public records rather than obtained from the individuals themselves, contacting each person to notify them would in most cases involve disproportionate effort, and we rely on the exemption in Article 14(5)(b) GDPR. This does not remove your rights: if you believe we hold public-record data about you in connection with an assessment, you can contact us to exercise any of the rights set out below.

We do not use personal data for automated decision-making or profiling within the meaning of Article 22 GDPR: every finding in our reports is researched, written and reviewed by a person. We do not input personal data into third-party AI tools.

Links to LinkedIn

Our footer links to our company page and founder profile on LinkedIn. These are ordinary outbound links: we embed no LinkedIn widgets, buttons, or tracking scripts, so nothing about your visit is shared with LinkedIn unless you choose to click through. If you do, LinkedIn becomes responsible for your data under its own privacy policy, which we do not control.

Where this site is hosted

This website is hosted by Vercel Inc., which processes limited technical data such as IP addresses in server logs, retained briefly for security and operational purposes. Our domain's DNS is managed through Cloudflare on a DNS-only basis; site traffic does not pass through Cloudflare's network.

International transfers

Vercel and Cloudflare are US companies. Where they process technical data such as IP addresses in server logs outside the European Economic Area, those transfers are safeguarded by Standard Contractual Clauses under their data processing agreements. Our email correspondence stays with Proton in Switzerland, Germany and Norway, as described above.

Our sub-processors

We keep our own supply chain short and disclosed. The third parties we rely on to run the practice are:

Our email and storage provider engages its own sub-processors for functions such as payment and customer support, some located outside the EEA, including in the United States. Its current list is published at proton.me/legal/privacy. We do not include client-identifying material in vendor support requests.

How we protect your data

We are a security practice, and we hold our own data to the standard we look for in others. What we keep is stored encrypted at rest with Proton, access is limited to the person carrying out the work, and we keep only what a purpose actually needs for only as long as it needs it. We do not sell personal data, and we do not share it except with the sub-processors listed above or where the law requires it.

Your rights

Under the GDPR you have the right to access, correct, or erase personal data we hold about you, to restrict or object to its processing, and to receive it in a portable format. To exercise any of these rights, email us at the address above. You also have the right to lodge a complaint with the Irish Data Protection Commission (dataprotection.ie) or your local supervisory authority.

Changes to this notice

If we change how this site handles personal data, we will update this notice and the date at the top of the page.