CVK Group LLC ("we", "us", "our"), doing business as PHP Patch, provides PHP website security and repair services. This policy explains what personal information we collect through phppatch.net (the "Website") and in the course of our business, how we use it, and the choices and rights you have.
Information we collect
Information you give us
- Call bookings. When you book a call through the calendar on our Website we receive your name, work email, the time you chose, your time zone and anything else you add, such as your company or notes. We also record which page you booked from.
- Estimate requests. When you submit a form on our Website we receive your email address and anything else you choose to provide: name, company, platform, hosting provider and your message. We also record which page you sent it from.
- Emails and calls. If you contact us directly, we receive your contact details and whatever your message contains.
- Engagement and billing details. If you hire us, we collect the business contact, billing and tax information needed to write the agreement, invoice and keep records.
Payment information
Payments are processed by Stripe. Card and bank details go directly to Stripe and are never stored on our systems. Stripe gives us limited details about each payment, such as the payer's name, email, billing country, amount and the last four digits of the card. Stripe's own use of your information is described in the Stripe Privacy Policy.
Information collected automatically
The Website does not set cookies or use analytics, advertising tags or tracking pixels, and our fonts and scripts, including the booking calendar, are served from our own domain. Our hosting provider, Amazon Web Services, necessarily processes your IP address and basic request details (such as browser type and the page requested) to deliver the Website and protect it from abuse. We do not combine this with your other information or use it to build profiles.
Browser storage
When you pay for an estimate call, the booking calendar keeps a reference to that payment in your browser's session storage, a cookie-like store limited to the open tab. It lets you return from checkout, choose a time, and change or cancel your booking without paying again. The reference is only sent to our booking service, is never used for tracking or advertising, and is deleted when you close the tab. Because this storage is strictly necessary for a service you asked for, it does not require consent. Stripe sets its own cookies on its checkout page to process your payment and prevent fraud, as described in the Stripe Privacy Policy.
Data on client systems
When we work on a client's servers, we may come across personal information stored in those systems, such as the client's customer records or logs. We handle that data only on the client's instructions, under the client's engagement agreement, and only as far as the work requires. For that data the client is the controller and we act as its processor or service provider. We can sign a data processing agreement on request.
How we use information
| Purpose | Legal basis (where GDPR or UK GDPR applies) |
|---|---|
| Reply to your request and schedule an estimate call | Steps you asked for before entering a contract; our legitimate interest in answering enquiries |
| Deliver services, write reports and support you | Performance of a contract |
| Invoice, collect payment and keep tax and accounting records | Performance of a contract; legal obligation |
| Screen against sanctions lists and prevent fraud | Legal obligation; legitimate interest in preventing fraud |
| Keep the Website and our systems secure | Legitimate interest in protecting our services |
| Send occasional security advisories and service updates | Your consent, or our legitimate interest in contacting existing clients about similar services. You can opt out at any time. |
We do not sell personal information, share it for cross-context behavioral advertising, or use it for automated decisions that have legal or similarly significant effects on you.
Who we share it with
We share personal information only with service providers that help us run the business, under contracts that limit their use of it:
- Amazon Web Services: Website hosting, the request form, the booking calendar and email delivery
- Google: our calendar, where booked calls are stored, and Google Meet for the video call
- Stripe: payment processing and fraud prevention
- Our business email and file storage providers: storing our correspondence and records
- Professional advisers, such as accountants and lawyers, under duties of confidentiality
- Incident response partners, only with the client's agreement, when an engagement uncovers a compromise that needs specialist investigation
We may also disclose information when required by law or legal process, to protect our rights, property or safety or that of others, or as part of a merger, acquisition or sale of the business, in which case this policy will continue to apply to it.
International transfers
We are based in the United States, and our service providers process data in the United States and other countries. Where we transfer personal information from the European Economic Area, the United Kingdom or Switzerland, we rely on safeguards such as the European Commission's Standard Contractual Clauses or the EU-U.S. Data Privacy Framework, as offered by the provider concerned.
How long we keep it
- Raw copies of email received at our domain are deleted automatically after 90 days. The forwarded copy stays in our inbox as correspondence.
- Requests and correspondence that don't lead to an engagement are kept for up to 3 years after our last contact, then deleted.
- Client records, agreements, invoices and payment records are kept for as long as tax, accounting and legal rules require, generally 7 years after the engagement ends.
- Data from client systems is returned or deleted at the end of the engagement, as the engagement agreement specifies.
Your rights
Depending on where you live, you may have the right to:
- know what personal information we hold about you and get a copy of it
- correct inaccurate information
- have your information deleted
- object to or restrict certain processing, including direct marketing
- receive your information in a portable format
- withdraw consent at any time, where we rely on consent
- not be treated differently for exercising these rights
To make a request, email privacy@phppatch.net. We will reply within 30 days, or sooner where local law requires. We may need to verify your identity first, and you may use an authorized agent where the law allows. If you are in the EEA or UK, you can also complain to your local data protection authority. California residents have these rights under the CCPA as amended by the CPRA; we have not sold or shared personal information in the past 12 months.
Security
We protect information with encryption in transit and at rest, access restricted to the people who need it, and private storage that is not reachable from the internet. No system is perfectly secure, so we cannot guarantee absolute security. If a breach affects your personal information, we will notify you and the authorities as the law requires.
Children
Our services are for businesses. The Website is not directed to children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has sent us information, contact us and we will delete it.
Changes to this policy
We may update this policy. We will post the new version here with a new effective date, and if the changes are significant we will tell clients by email.
Contact us
Questions or requests about this policy: privacy@phppatch.net, or write to us at:
CVK Group LLC, doing business as PHP Patch1309 Coffeen Avenue STE 3393
Sheridan, Wyoming 82801
United States
Phone: 307-655-1749
Email: hello@phppatch.net