Operator: QSai LLC (CISO Marketplace)
Site / Platform: cisodiy
Domains Covered: cisodiy.pages.dev, ciso.diy, www.ciso.diy
Effective Date: 2026-09-01
Next Scheduled Review: 2027-09-01
Jurisdictions in Scope: EU, US, US-CA, global
1. [Who We Are](#1-who-we-are)
2. [Scope of This Notice](#2-scope-of-this-notice)
3. [Data We Collect and Why](#3-data-we-collect-and-why)
4. [Lawful Basis for Processing](#4-lawful-basis-for-processing)
5. [How We Use Your Data](#5-how-we-use-your-data)
6. [Sharing and Disclosure](#6-sharing-and-disclosure)
7. [International Transfers](#7-international-transfers)
8. [Retention and Disposal](#8-retention-and-disposal)
9. [Cookies, Storage and Analytics](#9-cookies-storage-and-analytics)
10. [Data-Subject Rights](#10-data-subject-rights)
11. [California Residents — CCPA / CPRA](#11-california-residents--ccpa--cpra)
12. [Children's Privacy](#12-childrens-privacy)
13. [Security](#13-security)
14. [Data Breaches](#14-data-breaches)
15. [Changes to This Policy](#15-changes-to-this-policy)
16. [Contact and Complaints](#16-contact-and-complaints)
QSai LLC (CISO Marketplace) ("we", "us", "our") operates the website accessible at cisodiy.pages.dev, ciso.diy and www.ciso.diy (collectively, "ciso.diy") — a store selling licensed digital documents, workbooks and build guides to security practitioners.
For the purposes of the EU General Data Protection Regulation (GDPR) and equivalent legislation, QSai LLC is the data controller for personal data collected through ciso.diy. For the purposes of the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), QSai LLC is the business.
Our designated contact for privacy matters is our Data Protection Officer. Contact details are in [Section 16](#16-contact-and-complaints).
This Privacy Policy applies to personal data collected through ciso.diy and its sub-domains, and to offline correspondence where you are directed to this policy.
It does not apply to third-party sites linked from ciso.diy. It also does not apply to the other CISO Marketplace properties, which publish their own notices — although several share the central sign-in and payment services described in [Section 6](#6-sharing-and-disclosure).
ciso.diy sells digital downloads only. Nothing is shipped, and no shipping policy applies. Purchases are additionally governed by our Terms of Service, our Refund Policy, and the End User Licence Agreement that sets out what your licence permits.
We collect only what is necessary for the purposes below (data-minimisation, GDPR Art. 5(1)(c)).
| Category | Fields | Source | Purpose |
|---|---|---|---|
| Identity | Name, email address | You, at checkout or sign-in | Fulfilling your order and delivering the files you bought |
| Account | Your identifier at our central sign-in service, and a session token | You, via id.cisomarketplace.com | Signing you in; finding what you own so you can re-download it |
| Transaction | What you bought, which licence tier, order and checkout-session identifiers, amount, currency | You, via pay.cisomarketplace.com and Stripe | Fulfilment, your permanent entitlement to re-download, refunds, tax and accounting records |
| Payment | We never receive or store your card details. They are entered directly with Stripe. We receive only a confirmation, the last four digits, and the card brand. | Stripe | Taking payment; matching a refund to the original method |
| Delivery | Your email address, and metadata about the download links issued to you | Derived | Sending your files; re-issuing links from your library |
| Support | Whatever you write to us, and our replies | You | Answering you |
| Usage | Pages viewed, referring site, approximate location (city/region, from IP), device and browser type | Automatic — only after you accept analytics | Understanding which products are useful and where the site is confusing |
We do not knowingly collect special-category data (health, racial or ethnic origin, political opinions, biometrics, and similar). We do not ask for it, and no field on the site invites it.
We do not collect any usage data at all unless you accept analytics. If you choose "Necessary only", or ignore the banner, no analytics loads.
| Lawful basis | When we rely on it |
|---|---|
| Contract (Art. 6(1)(b)) | Taking your order, delivering your files, maintaining your entitlement so you can re-download, and handling refunds |
| Legitimate interests (Art. 6(1)(f)) | Fraud prevention, securing the site, and answering support enquiries. A Legitimate Interests Assessment is documented internally for each |
| Consent (Art. 6(1)(a)) | Analytics, and any marketing email. Withdrawable at any time, without detriment |
| Legal obligation (Art. 6(1)(c)) | Retaining transaction records for tax and accounting |
We do not carry out automated decision-making that produces legal or similarly significant effects.
1. Delivering what you bought — processing the order, issuing download links, and maintaining the entitlement record that lets you re-download later.
2. Transactional email — order confirmation, download links, and notices about a product you own. These are not marketing and cannot be unsubscribed from while you hold an entitlement, although you may ask us to close your account.
3. Support — answering your questions.
4. Security and fraud prevention — detecting and preventing fraudulent transactions and abuse of download links.
5. Legal and tax compliance — keeping the records we are required to keep.
6. Improving the catalogue — but only from analytics you have consented to, and only in aggregate.
Why entitlements persist. When you buy, we record that you own that product at that licence tier. That record is what lets you sign in months later and download the current version at no further charge, as our Terms promise. Deleting it would remove your access to something you paid for, which is why transaction data is retained rather than deleted on a short schedule ([Section 8](#8-retention-and-disposal)).
We do not sell your personal data, and we do not share it for cross-context behavioural advertising. We run no advertising on ciso.diy and no ad network is present.
We share data only with the following processors, each under a written data-processing agreement:
| Processor | What they process | Why |
|---|---|---|
| Cloudflare, Inc. | Site hosting, request logs, and storage of the product files | Serving the site and the downloads |
| Stripe, Inc. | Your name, email and payment details | Taking payment. Card details go to Stripe directly and never reach us |
| id.cisomarketplace.com (QSai LLC) | Sign-in identity | Authentication across the CISO Marketplace estate |
| pay.cisomarketplace.com (QSai LLC) | Orders and entitlement records | Checkout, and knowing what you own |
| Resend | Your email address and message content | Sending order and delivery email |
| Google LLC (Google Analytics) | Usage data as described in Section 3 | Analytics — only if you accept. See [Section 9](#9-cookies-storage-and-analytics) |
We may also disclose personal data where required by law — a court order, subpoena or regulatory demand — or to protect someone's safety. In a merger, acquisition or sale of assets, data may transfer to the successor under equivalent protections, and you will be notified as required.
We may share aggregated or de-identified information that cannot reasonably identify you.
We operate across the EU, the US and globally, and your data may be processed outside your home jurisdiction — principally in the United States.
For transfers from the EEA, UK or Switzerland we rely on the European Commission's Standard Contractual Clauses (2021 SCCs) or the UK International Data Transfer Agreement, together with any applicable adequacy decision. Where we rely on a derogation under GDPR Art. 49, we apply it narrowly and only where a specific condition is met.
You may request a copy of the relevant transfer mechanism at privacy@cisomarketplace.com.
We keep personal data only as long as necessary, or as long as the law requires, under our Data Retention & Disposal Policy (SEC-DRP-001).
| Data | Retention |
|---|---|
| Transaction and entitlement records | 7 years from the transaction, for tax and accounting. Entitlements remain active throughout, so you keep the ability to re-download |
| Account and identity data | For the life of your account, then 24 months |
| Download-link metadata | 12 months |
| System and access logs | 12 months |
| Support correspondence | 24 months after the matter is closed |
| Analytics data | 14 months, in Google Analytics' own retention settings |
| Consent records | 24 months after the consent is withdrawn or replaced |
Where a longer statutory period applies, or where data is under legal hold, retention extends until that ends. When a period expires, data is securely destroyed by a method appropriate to the medium, in line with ISO 27001 A.8.10.
ciso.diy uses two kinds of client-side storage, and one analytics service.
Browser storage (not cookies). Your sign-in token, cached profile and shopping cart are held in your browser's localStorage, and a short-lived verifier during sign-in is held in sessionStorage. These never leave your browser except when you sign in or check out, and clearing your browser data removes them.
Cookies. We set one first-party cookie, csm_consent, recording your consent choice so we do not ask again. It lasts 180 days. If you accept analytics, Google Analytics sets its own cookies on this domain.
Analytics. We use Google Analytics 4. Google is a third party and processes this data on our behalf under its own terms. We have disabled advertising features and Google Signals, and IP addresses are anonymised.
| Category | Purpose | Consent required |
|---|---|---|
| Strictly necessary | Sign-in, cart, security, and remembering your consent choice | No |
| Analytics | Understanding how the site is used | Yes |
There is no advertising or marketing category. We do not run interest-based advertising, do not participate in an ad network, and have no third-party tracking pixels.
On your first visit a consent banner offers Accept analytics or Necessary only. Analytics does not load unless you accept. If the banner does not load, analytics does not load either.
To change your choice, clear the csm_consent cookie in your browser and reload; the banner will ask again. Most browsers also let you block or delete cookies entirely, and browser storage can be cleared from the same settings.
We honour Global Privacy Control and Do Not Track signals for analytics.
Depending on where you live, you have the rights below. We respond within 30 calendar days (GDPR) or 45 calendar days (CCPA, extendable once by 45 days with notice).
| Right | What it means | How to exercise it |
|---|---|---|
| Access | Confirmation of whether we hold your data, and a copy | Email privacy@cisomarketplace.com |
| Rectification | Correcting inaccurate or incomplete data | Update your details at id.cisomarketplace.com, or email us |
| Erasure | Deletion where there is no lawful reason to keep it. Note that deleting your account ends your ability to re-download products you own, and we must keep transaction records for tax purposes | Email privacy@cisomarketplace.com |
| Restriction | Pausing processing in defined circumstances | Email privacy@cisomarketplace.com |
| Portability | Your data in a structured, machine-readable format | Email privacy@cisomarketplace.com |
| Object | To processing based on legitimate interests, or to direct marketing. Marketing objections are absolute | Unsubscribe link, or email us |
| Withdraw consent | For analytics or marketing, at any time, without affecting prior lawful processing | Clear the csm_consent cookie; unsubscribe link for email |
| Non-discrimination | We will not treat you differently for exercising a privacy right | A standing commitment |
Verification. We verify identity before acting on a request, proportionately to the sensitivity involved, and will not demand excessive data to do it. You may use an authorised agent with written proof of authorisation.
Appeals. If we decline, we will explain why. Email privacy@cisomarketplace.com with the subject "DSAR Appeal". You may also complain to a supervisory authority ([Section 16](#16-contact-and-complaints)).
This section supplements the rest of this policy for California residents.
In the preceding 12 months we have collected: identifiers (name, email, IP address, account identifier); commercial information (purchase history); and internet activity (pages viewed on ciso.diy) — the last only where analytics consent was given. Specific fields are in [Section 3](#3-data-we-collect-and-why).
We collect these for the purposes in [Section 5](#5-how-we-use-your-data).
We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined by the CPRA. We therefore do not offer a "Do Not Sell or Share My Personal Information" link, because there is nothing to opt out of. If that ever changes, this policy will be updated and the required mechanism provided before any such processing begins.
We collect account sign-in credentials, which the CPRA treats as sensitive personal information. We use them only to sign you in. We do not use or disclose sensitive personal information to infer characteristics about you, so the right to limit its use does not arise.
We do not collect precise geolocation.
You have the rights to know, delete, correct, and non-discrimination, exercisable as set out in [Section 10](#10-data-subject-rights). We respond within 45 calendar days, extendable to 90 with notice.
Under California Civil Code §1798.83 you may request information about disclosures for third-party direct marketing. We make none.
ciso.diy is a professional tool sold to security practitioners and is not directed to children under 16 (or under 13 where COPPA applies). We do not knowingly collect data from children. If you believe we have, email privacy@cisomarketplace.com and we will delete it promptly.
We apply technical and organisational measures appropriate to the risk, consistent with GDPR Art. 5(1)(f) and our internal information-security policies:
No transmission over the internet is completely secure. Use a strong, unique password, and tell us promptly if you suspect unauthorised use of your account.
If a personal-data breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours of becoming aware where feasible (GDPR Art. 33), or within the applicable US state deadline; and notify you without undue delay where the risk is high (GDPR Art. 34). We maintain a breach register and conduct a post-incident review.
If you discover or suspect a breach involving your data, email privacy@cisomarketplace.com.
We review this policy at least annually — next scheduled review 2027-09-01 — and whenever our processing, our technology, or the law changes materially.
For material changes we will update the effective date, post a notice on ciso.diy for at least 30 days, and where the change materially affects your rights or the law requires it, seek fresh consent or notify you by email.
Previous versions are available on request.
Data Protection Officer
QSai LLC (CISO Marketplace)
Email: privacy@cisomarketplace.com
Please mark your subject line ("DSAR Request", "Cookie Query", "CCPA Request") so we can route it. We acknowledge within 5 business days.
For questions about a purchase, a licence or a refund rather than privacy, contact compliance@ciso.diy.
Supervisory authorities (GDPR). If you are in the EEA or UK you may complain to your local data-protection authority — in the UK, the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to address your concern first.
California. You may contact the California Privacy Protection Agency (cppa.ca.gov) or the California Attorney General (oag.ca.gov/privacy).
Document ID: DP-PP-MASTER-001
Owner: Data Protection Officer
Classification: Public
Effective Date: 2026-09-01
Next Review: 2027-09-01
Revised from v1.0 (2026-06-14) following an audit of the site against the published text. Changes: unfilled template placeholders replaced with the actual data categories and retention periods; advertising cookies and the "Do Not Sell or Share" link removed as not applicable; Google Analytics named as a third-party processor and stated as consent-gated; sub-processors named; browser storage described; the entitlement model explained as the reason transaction data persists; and the Shipping Policy reference removed, this being a digital-only store.