Privacy policy

Your information, handled the way we tell clients to handle theirs

Effective and last updated October 10, 2026

1. 1. Who we are and what this covers
2. 2. What we collect
3. 3. How we use it
4. 4. Cookies, tracking and opt-out signals
5. 5. Who we share it with
6. 6. How long we keep it
7. 7. How we protect it
8. 8. Your privacy rights
9. 9. How to make a request or appeal
10. 10. State-specific notices
11. 11. Privacy laws in all 50 states
12. 12. Children, other countries, changes, contact

1. Who we are and what this covers

Fortis CyberSec ("we," "us") provides cybersecurity assessments and managed security services to oil and gas companies. This policy covers personal information we collect through fortiscybersec.com, our forms, email and phone conversations, events, and our marketing to businesses.

It does not cover information we handle for clients under a signed engagement. Client systems data and security findings are governed by the client's contract with us, kept separately from our sales records, and never used for marketing.

2. What we collect

This section is also our notice at collection. We collect the following, and we collected the same categories in the past 12 months:

Sensitive information. We do not ask for, and you should not send, Social Security numbers, financial account numbers, health information, precise location, biometrics or other sensitive personal information. If you send it anyway, we delete it and use it for nothing. We do not knowingly collect consumer health data as defined in Washington, Nevada or Connecticut law.

3. How we use it

• To respond to your questions and requests, and to deliver and discuss your readiness report
• To contact you about our services as a business, which you can stop at any time (see Section 8)
• To prepare proposals, contracts and invoices if you become a client
• To keep our website and forms secure, and to detect fraud and abuse
• To meet legal, tax and accounting obligations and to enforce our agreements

We do not make decisions about you by automated means that have legal or similarly significant effects. The readiness score is a self-assessment calculated from your answers; it informs a conversation and nothing else.

4. Cookies, tracking and opt-out signals

This website does not set cookies, and it does not use analytics, advertising pixels, session recording, social-media plug-ins or other third-party scripts. Our fonts are served from our own server, so loading a page does not send your information to a font provider.

Global Privacy Control and Do Not Track. Because we do not sell or share personal information or track you across other websites, these signals do not change how this site behaves. We still treat a Global Privacy Control signal as a valid request to opt out of sale and targeted advertising for your browser, as California, Colorado and a growing number of other states require.

If we ever add analytics or advertising tools, we will update this policy first and give you a way to opt out before they run.

5. Who we share it with

We disclose personal information only to:

• Service providers that work for us under contracts limiting their use of it: our website hosting company (stores form submissions), our email and productivity provider, and, if enabled, a bot-protection service that checks form submissions. Our customer records are kept on our own systems.
• Security partners, only after you become a client and ask us to bring in a specific partner, and only what that partner needs to do the work. We tell you in writing which partners are involved.
• Professional advisers such as our lawyers, accountants and insurers, under confidentiality duties.
• Authorities when the law requires it, or to protect the rights, property or safety of our clients, our staff or the public.
• A buyer or successor if our business is sold or reorganized, subject to this policy.

We do not sell personal information and do not share it for cross-context behavioral (targeted) advertising, and we have not done so in the past 12 months. We have no actual knowledge of selling or sharing information of anyone under 16. We do not disclose personal information to third parties for their own direct marketing. We do not use personal information to train artificial intelligence or large language models.

Nothing you give us is shared with any oil and gas operating company.

6. How long we keep it

• Form submissions on our web host: moved to our internal records, then deleted from the web host within 90 days.
• Business contact and conversation records: while we are in contact and for up to 3 years after our last communication, unless you ask us to delete them sooner.
• Client contracts, invoices and payment records: 7 years, for tax and legal purposes.
• Security records of refused submissions: 1 year.
• Opt-out and do-not-contact requests: as long as needed to keep honoring them. We keep only the minimum needed to do so.

7. How we protect it

We apply the controls we recommend to clients: encrypted connections, encryption at rest, multi-factor sign-in, least-privilege access, audit logging of every change, server-side validation of every form submission, and tested backups. Our internal records are not reachable from the internet.

No system is perfectly secure. If a breach affects your personal information, we will notify you and the relevant regulators as required by the breach-notification law of the state where you live. All 50 states, the District of Columbia and the U.S. territories have such laws.

8. Your privacy rights

Wherever you live in the United States, you can ask us to:

• Know and access: confirm whether we hold personal information about you, what it is, where it came from, why we use it, and who we disclosed it to.
• Get a copy in a portable, commonly used format.
• Correct information that is inaccurate.
• Delete personal information we hold about you, subject to legal exceptions such as records we must keep for tax purposes.
• Receive a list of the specific third parties we have disclosed your personal information to.
• Opt out of sale, targeted advertising and profiling. We do none of these, but you may still record your choice.
• Limit the use of sensitive personal information. We do not collect it, but you may still make the request.
• Stop marketing. Every marketing email has an unsubscribe link, and you can ask us not to call.

We will not discriminate against you for using any of these rights. You will not be charged a different price or receive a different level of service.

9. How to make a request or appeal

• How to ask: email info@fortiscybersec.com with "Privacy request" in the subject, or use the contact form. Tell us which right you are using.
• Verification: we confirm your identity by matching the information you give us with what we hold, usually by replying to the email address on file. We ask only for what we need to verify you and use it for nothing else.
• Authorized agents: someone may make a request for you with your signed permission or a power of attorney. We may still ask you to confirm your identity directly.
• Timing: we confirm receipt within 10 business days and respond within 45 days. If we need more time (up to 45 more days), we will tell you why.
• Cost: requests are free. If requests are clearly unfounded or excessive, the law in some states allows a reasonable fee or a refusal, and we will explain.
• Appeals: if we decline your request, reply with "Appeal" in the subject within 60 days. Someone who did not make the original decision will review it, and we will respond in writing within 45 days, explaining the outcome. If you disagree with the result, you may contact your state Attorney General, or in California the California Privacy Protection Agency.

10. State-specific notices

California

California residents, including business contacts and employees of our clients and prospects, have the rights in Section 8 under the California Consumer Privacy Act. Section 2 lists the categories we collect, their sources and purposes; Section 5 lists the categories of recipients (service providers and professional advisers receive identifiers, professional information, communications and internet information for business purposes); Section 6 gives retention periods. We do not sell or share personal information and do not use or disclose sensitive personal information beyond permitted purposes, so we do not display "Do Not Sell or Share" or "Limit the Use" links. Under California's Shine the Light law, we do not disclose personal information to third parties for their direct-marketing purposes. Under CalOPPA, our response to Do Not Track signals is described in Section 4.

Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia

Residents of these states have the rights in Section 8, including the right to appeal in Section 9. We do not sell personal data, sensitive or otherwise, and do not process it for targeted advertising or for profiling that produces legal or similarly significant effects. Oregon, Delaware, Maryland and Minnesota residents may request the list of specific third parties described in Section 8. Minnesota residents may also question the result of any profiling decision; we make none. We do not sell sensitive personal data, so the sale notices required by Texas and other states do not apply. Universal opt-out signals are honored as described in Section 4.

Alabama, Louisiana, Oklahoma and Vermont

These states have enacted privacy laws that take effect between 2027 and 2028 (see Section 11). We already extend their rights to residents of those states.

Nevada

Nevada residents may submit a request directing us not to sell covered information. We do not sell it, but we will record your request if you send one to the address in Section 9.

Florida

The Florida Digital Bill of Rights applies only to very large technology companies, but we extend the rights in Section 8 to Florida residents anyway.

Washington, Nevada and Connecticut consumer health data

We do not collect, share or sell consumer health data as defined in these laws.

Illinois, Texas and Washington biometrics

We do not collect biometric identifiers such as fingerprints, face geometry or voiceprints.

States without a comprehensive privacy law

If your state has no comprehensive privacy law, you still have every right in Section 8 with us, and your state's consumer protection and breach-notification laws still apply.

12. Children, other countries, changes and contact

Children. Our services and this website are for businesses and are not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has sent us information, contact us and we will delete it.

Other countries. We are based in the United States and store information here. If you contact us from outside the United States, your information will be processed in the United States.

Changes. When we change this policy, we update the date at the top. If a change materially affects how we use information we already hold, we will tell you before it takes effect and, where the law requires, ask for your consent.

Accessibility. If you need this policy in another format, contact us and we will provide it.

Contact. Fortis CyberSec, info@fortiscybersec.com (subject "Privacy request"), or the contact form.