How we handle your information

Who we are

ClosedSources is the registered business name (No. 788973) of Igor Bogovic, an independent third-party risk practice trading from 20 Harcourt Street, Dublin, D02 H364, Ireland. For the purposes of the General Data Protection Regulation (GDPR), Igor Bogovic, trading as ClosedSources, is the data controller for any personal data described in this notice. You can reach us at contact@closedsources.com or by post at the address above.

What this website collects

Very little. This site has no forms, no user accounts, and sets no cookies or browser storage. We have verified this at the HTTP level. If that ever changes, we will update this notice first. We use Vercel Analytics and Vercel Speed Insights, two cookie-free services that record aggregate page views, page load performance, and anonymised technical information such as browser type and country. Neither identifies individual visitors, and we cannot trace any of this data back to you.

If you email us

When you contact us, we receive your email address, your name if you include it, and whatever you choose to write. We use this information solely to respond to your enquiry and, if you engage us, to carry out the work you have asked for. The legal basis is our legitimate interest in responding to enquiries (Article 6(1)(f) GDPR) and, where an engagement follows, the performance of a contract (Article 6(1)(b) GDPR).

Our email is hosted with Proton, whose infrastructure is located in the EU and Switzerland, a country the European Commission recognises as providing adequate protection for personal data. Correspondence relating to an enquiry that does not proceed is deleted within 12 months. Records relating to an engagement are retained for as long as the engagement and our legal obligations require.

Personal data in our assessment work

Our assessments draw on public records, which can incidentally include personal data about people connected to a supplier, such as the names of directors in company registries or court records. We process this information under our legitimate interest in delivering the assessment a client has engaged us for (Article 6(1)(f) GDPR), we collect it only from public sources, we include it in a report only where it is relevant to the findings, and we do not use it for any other purpose. The rights described below apply to this data too.

We do not use personal data for automated decision-making or profiling within the meaning of Article 22 GDPR: every finding in our reports is researched, written and reviewed by a person. We do not input personal data into third-party AI tools.

Where this site is hosted

This website is hosted by Vercel Inc., which processes limited technical data such as IP addresses in server logs, retained briefly for security and operational purposes. Our domain's DNS is managed through Cloudflare on a DNS-only basis; site traffic does not pass through Cloudflare's network.

International transfers

Vercel and Cloudflare are US companies. Where they process technical data such as IP addresses in server logs outside the European Economic Area, those transfers are safeguarded by Standard Contractual Clauses under their data processing agreements. Our email correspondence stays with Proton in the EU and Switzerland, as described above.

Your rights

Under the GDPR you have the right to access, correct, or erase personal data we hold about you, to restrict or object to its processing, and to receive it in a portable format. To exercise any of these rights, email us at the address above. You also have the right to lodge a complaint with the Irish Data Protection Commission (dataprotection.ie) or your local supervisory authority.

Changes to this notice

If we change how this site handles personal data, we will update this notice and the date at the top of the page.