Privacy Policy

CISO Risk Services LLC

Effective Date: March 1, 2026 / Last Updated: March 1, 2026

This Privacy Policy explains how CISO Risk Services LLC ("we," "us," or "our") collects, uses, discloses, and safeguards personal information when you visit our website at cisorisks.com (the "Site"), submit a contact or inquiry form, or apply for a position with us, including by submitting a resume or curriculum vitae ("CV"). This Policy is intended to apply on a global basis and to meet the requirements of applicable data protection laws, including the EU and UK General Data Protection Regulation ("GDPR"), the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), and other comparable state, national, and international privacy laws. By using the Site, you acknowledge the practices described in this Policy.

CISO Risk Services LLC is a cybersecurity consulting firm providing compliance advisory, security operations, and policy development services. For purposes of applicable data protection law, CISO Risk Services LLC is the data controller (or "business" under the CCPA/CPRA) responsible for the personal information described in this Policy.

CISO Risk Services LLC, 270 Carpenter Drive, Suite 550, Atlanta, GA 30328

We collect personal information directly from you through two primary channels on the Site:

When you submit a contact, inquiry, or consultation request form, we collect the information you provide, which may include:

● Full name

● Email address

● Phone number

● Company or organization name

● The content of your message or inquiry, including any details you choose to share about your organization's security, compliance, or operational needs

When you apply for a position with us or otherwise submit a resume or CV, we collect the information contained in those materials, which may include:

● Full name and contact details (email, phone, mailing address)

● Work history, professional experience, and references

● Education history and professional certifications (which, given our industry, may include security clearances or credential identifiers)

● Any other information you choose to include in your resume, CV, cover letter, or related correspondence

Please avoid including sensitive personal information in your resume or cover letter (such as government identification numbers, health information, or information about race, religion, or similar characteristics) unless it is directly relevant and required for a specific role.

When you visit the Site, we and our website platform provider also automatically collect certain technical information through cookies and similar tracking technologies, as described in Section 3 below.

The Site uses cookies and similar tracking technologies to operate reliably and to help us understand how visitors use the Site.

● Essential cookies — necessary for the Site to function properly (for example, maintaining basic session functionality and security).

● Analytics cookies — used to analyze website traffic and usage patterns, such as pages visited, time on site, and general navigation behavior, so that we can optimize your experience and improve the Site.

We do not currently use cookies for third-party advertising or ad-targeting purposes.

When you first visit the Site, a cookie consent banner informs you that the Site uses cookies to analyze website traffic and optimize your website experience, and lets you accept our use of cookies before non-essential cookies are set. Where you accept cookies, your data may be aggregated with other visitor data for analytics purposes. Visitors in the EU, UK, and other jurisdictions that require opt-in consent for non-essential cookies should only see analytics cookies activate after providing that consent through the banner.

In addition to the choice provided through our cookie consent banner, most web browsers allow you to control cookies through their settings, including blocking or deleting cookies. Please note that disabling cookies may affect the functionality of the Site.

GoDaddy Website Builder analytics are utilized on this site.

We use the personal information described above for the following purposes:

● To respond to inquiries submitted through the contact form and to provide requested information about our services

● To evaluate job applications and communicate with candidates about employment opportunities

● To maintain records of business inquiries and applicant communications

● To operate, secure, and maintain the Site

● To comply with legal obligations, including recordkeeping obligations that may apply to our work with regulated clients

● To detect, investigate, and prevent fraudulent, unauthorized, or illegal activity

Where the GDPR applies, we rely on the following legal bases to process your personal information:

● Consent — where you have voluntarily submitted information through the contact form or as part of a job application

● Legitimate interests — to respond to business inquiries, evaluate candidates, and maintain the security of the Site, provided those interests are not overridden by your rights and interests

● Legal obligation — where processing is necessary to comply with applicable law

● Pre-contractual steps — where processing is necessary to take steps at your request prior to entering into a contract, such as evaluating a job application

We do not sell personal information. We may share personal information in the following limited circumstances:

● Service providers — with vendors who support our website hosting, email, applicant tracking, or IT infrastructure, under contractual confidentiality and data protection obligations

● Legal and compliance — where required to comply with applicable law, regulation, legal process, or governmental request

● Business transfers — in connection with a merger, acquisition, financing, or sale of business assets

● With your consent — for any other purpose disclosed to you at the time of collection

As a globally accessible website, information you submit may be transferred to, stored, and processed in the United States or other countries that may have data protection laws different from those in your jurisdiction. Where we transfer personal information out of the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses or an applicable adequacy decision.

We retain personal information collected through the contact form for as long as reasonably necessary to respond to and document the inquiry, and thereafter in accordance with our internal records retention practices. We retain resumes and job application materials for the period permitted by applicable law to evaluate candidates and to defend against potential employment-related claims, after which such materials are securely deleted or anonymized.

Contact form submissions are retained for a maximum of 24 months and resumes are retained for a maximum of 12 months from submission, or longer where required by law.

Subject to applicable law, you have the right to:

● Access the personal information we hold about you

● Request correction of inaccurate or incomplete information

● Request deletion of your personal information

● Object to or restrict certain processing

● Request a copy of your information in a portable format

● Withdraw consent at any time, where processing is based on consent

● Lodge a complaint with your local data protection authority

Subject to the CCPA/CPRA, you have the right to:

● Know what personal information we collect, use, and disclose

● Request deletion of your personal information, subject to certain exceptions

● Request correction of inaccurate personal information

● Opt out of the sale or sharing of personal information (we do not sell or share personal information as those terms are defined under the CPRA)

● Non-discrimination for exercising your privacy rights

To exercise any of these rights, please contact us using the information in Section 12. We may need to verify your identity before fulfilling certain requests. Job applicants may also direct requests regarding application materials to the same contact.

As a cybersecurity consulting firm, we take the security of personal information seriously and apply administrative, technical, and physical safeguards designed to protect information submitted through the Site from unauthorized access, disclosure, alteration, or destruction. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

The Site is not directed to individuals under the age of 16, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can take appropriate action.

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us at:

Mail: CISO Risk Services, 270 Carpenter Drive, Suite 550, Atlanta, GA 30328

Email: info@cisorisks.com

Phone: +1(770)230-0546

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will post the revised Policy on the Site with an updated "Last Updated" date. Material changes will be communicated as required by applicable law.