Your information.
A clear explanation.
ThreatShield is part of ITS Consulting — ITS Consulting Ltd in the UK and ITS Consulting LLC in the US.
About this website
This public website explains ThreatShield’s platform and services. It is separate from the authenticated reporting platform, which has its own account and service context.
Information you choose to share
If you email us, send our contact form or ask to arrange a conversation, we use the information you provide to respond to your enquiry and discuss relevant services. The contact form sends your name, work email, company and message to the ThreatShield sales team for review. To protect the form from abuse, we also record your browser’s user-agent string and a one-way keyed hash of your IP address, not the address itself. The form page also carries a signed timestamp so that submissions sent faster than a person could complete the form are discarded, and asks a short arithmetic question whose answer is checked by our servers. When our first-party booking form is available, it collects your chosen time, name, work email and company to verify your address and arrange the meeting. A short-lived verification question and email code help protect the form. Pending requests expire after 24 hours. Unlinked confirmed or cancelled booking leads are removed 12 months after the scheduled meeting. Visitor identifiers in our booking records for unresolved calendar holds are redacted after 12 months, while a reconciliation record remains for staff review. Booking leads linked to CRM records follow the account retention policy. You can still contact us by email.
Technical information and cookies
Our hosting service may process technical request information, such as IP address, browser details and access times, to deliver and protect the website. When booking is enabled, the booking endpoint sets a strictly necessary signed cookie for six hours. It is HttpOnly, Secure, SameSite=Lax and limited to /api/booking. The cookie contains a random visitor key, expiry and signature, rather than your name or email; it keeps availability, verification and confirmation requests together for abuse controls. The public site does not set analytics or advertising cookies or load third-party tracking or booking widgets automatically.
When security-probe monitoring is enabled, requests for clearly non-public paths may be classified and sent to our security operations team with the observed source IP address and response status. Raw source IP security evidence is retained for 30 days. SOC tickets keep event IDs and a fingerprint rather than the raw source IP. The requested URL, query string and any token in it are not included in that security event or ticket. This is separate from the optional website usage statistics below.
Optional website usage statistics
We use first-party, aggregate statistics to improve this website: which public pages are viewed, which page a visit started on, broad sources such as search or email, the referring website's domain name (not the full address), your browser's time zone as an approximate location, a device type and browser family worked out from your browser's user-agent (which we do not store), transitions between public pages, approximate visible time, and counts of booking steps (started, code requested, confirmed) by the broad source and first page of the visit. To attribute those booking counts, this browser tab keeps the broad source and first page of the visit in session storage; it is cleared when the tab closes and is never sent with, or linked to, your booking details. We do not use a visitor ID, analytics cookie, full referrer URL, query string, IP address, raw user-agent or device fingerprint for these statistics, and each of these details is only ever counted in daily totals. We report on the last 30 UTC days and remove older aggregate counters on a scheduled cleanup. They are not combined with client account activity or used to target advertising.
You can object at any time. Apart from that session-only attribution, your browser stores only the choice to turn these statistics off, and turning them off also clears it. The preference stays on this device until you change it or clear browser data. Global Privacy Control and Do Not Track signals also turn this measurement off.
Optional visitor journeys
If you allow this separate measurement, we connect public pages viewed in this browser tab into a short journey. We record page order, broad arrival source and approximate visible time. A random tab-session identifier is created only after your choice; it is not a name, account, CRM contact, IP address, device fingerprint, full referrer, query string or advertising identifier. A journey rotates after 30 minutes of inactivity or 24 hours, and server-side records are deleted after seven days. We do not join them to client logins, reports, booking leads or CRM records.
This is off until you actively allow it. Your yes/no choice is saved in this browser until you change it or clear browser data. This browser keeps the temporary identifier in the current tab; our server stores it only to group those public-page visits. You can withdraw permission here at any time; browser privacy signals also stop collection. Previously recorded journeys are automatically removed within seven days. For information requests or deletion, contact privacy@threatshield.global.
Sharing and protection
We do not sell or rent personal information. Relevant information may be shared with service providers supporting an enquiry or service, to meet legal obligations, or to protect rights and security. We use appropriate safeguards for the information we handle.
Questions and requests
To ask about your information or request access, correction or deletion, contact privacy@threatshield.global. Requirements and available rights depend on the context and applicable law.
Changes
We may update this notice as the website or our information practices change. This notice describes the public website introduced in September 2026.