Privacy Notice, ICO Transparency & Terms of Use (Liability Shield)

1. Strict "AS IS" Educational & Point-in-Time Diagnostic Disclaimer (No Security Guarantee)

All browser-based scanners, calculators, Chrome Manifest V3 extensions, PowerShell/Python/Bash scripts, configuration templates (including BIND, Cloudflare, Nginx, Apache, Microsoft IIS, php.ini, MTA-STS, TLS-RPT, and Entra ID / Intune policies), checklists, PDF handbooks, and asynchronous audit reports provided by FaultyPacket Security Lab ("FaultyPacket", "we", "us") are supplied strictly "AS IS" and "AS AVAILABLE" as point-in-time informational and educational engineering aids.

• No Regulated Legal or Accredited Audit Advice: Nothing on faultypacket.co.uk or inside any downloadable archive constitutes formal legal advice, regulated compliance sign-off, or a guarantee that any domain, server, or cloud tenant is immune from cyberattacks, ransomware, zero-day exploitation, data breaches, email spoofing, or email deliverability rejections.
• Sole Customer Responsibility for Backups, Staging & Change Control: Modifying DNS records (SPF, DKIM, DMARC p=quarantine/p=reject, MTA-STS), web server configurations (Nginx, Apache, IIS, php.ini), or cloud identity rules (Microsoft Entra ID Conditional Access) in production carries inherent operational risk—including legitimate email blocking, service downtime, or user lockouts if misconfigured. You (the user or buyer) are 100% solely responsible for backing up all existing configurations, testing in a non-production/staging or report-only mode (such as DMARC p=none or Conditional Access Report-Only) first, and verifying compatibility before production deployment.

2. Non-Affiliation & Non-Certification Notice (NCSC / IASME / Cyber Essentials / NIS2 / DORA)

FaultyPacket Security Lab is an independent security engineering lab. We are not affiliated with, endorsed by, or acting on behalf of the UK National Cyber Security Centre (NCSC), the IASME Consortium, any official Cyber Essentials Certification Body, or any European Union NIS2 / DORA supervisory authority. Purchasing or running a FaultyPacket readiness pack or pre-audit helps your internal engineering team find and remediate technical blockers prior to assessment, but does not grant official certification or guarantee pass/approval by a third-party assessor.

3. UK Computer Misuse Act 1990 — Authorised Domain & System Use Only

By using any scanner, extension, or script provided by FaultyPacket, you warrant and represent that you are only querying public DNS records or testing domains, servers, and cloud tenants that you own or have explicit written authorisation from the system owner to test, in strict compliance with the UK Computer Misuse Act 1990 and applicable international cybercrime legislation.

4. Hard Contractual Cap on Liability (UK UCTA 1977 & Consumer Rights Act 2015)

To the fullest extent permitted by the laws of England and Wales (including the Unfair Contract Terms Act 1977 and the Consumer Rights Act 2015):

• Exclusion of Consequential & Operational Loss: FaultyPacket shall not be liable under any circumstances (whether in contract, tort, negligence, statutory duty, or otherwise) for any indirect, incidental, special, or consequential loss, loss of profits, loss of revenue, loss of business or goodwill, legitimate email non-delivery or bounces, server or tenant downtime, data loss, cyber incidents, third-party claims, regulatory fines, or failed certification audit/retest fees.
• Hard Financial Cap (Maximum Aggregate Liability): Subject only to liabilities that cannot legally be excluded under English law (such as death or personal injury caused by negligence, or fraud), FaultyPacket's total maximum aggregate liability arising out of or in connection with any tool, extension, digital pack, or service is strictly capped at 100% of the actual price paid by you to FaultyPacket for the specific product or service giving rise to the claim—which is £0.00 for our free browser tools and Chrome extensions, or the £12.00, £19.00, £24.00, £29.00, or £39.00 purchase price paid for a digital compliance pack.

5. UK Consumer Contracts Regulations 2013 (Reg. 37 Digital Download Waiver & Final Sale Policy)

Under Regulation 37 of the UK Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013, the statutory 14-day cooling-off cancellation right does not apply to the supply of digital content once immediate download or key redemption begins. Because FaultyPacket digital compliance packs (£12–£39) are delivered immediately as unencrypted ZIP archives containing full source scripts, templates, and documentation, all sales are final once download or key activation commences, and you expressly consent to immediate digital performance and acknowledge the waiver of the 14-day cancellation right at checkout. In strict accordance with the Consumer Rights Act 2015 (sections 34–42), refunds or replacement archives are provided solely in the event of accidental duplicate billing or a verified corrupt/undelivered archive that cannot be remedied by [email protected].

6. Data Controller Identity & Zero-Telemetry Architecture

For the purposes of the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), and the Privacy and Electronic Communications Regulations 2003 (PECR):

• Data Controller: FaultyPacket Security Lab (United Kingdom).
• Data Protection & Privacy Contact: [email protected] (responses within 48 hours; statutory DSAR fulfilment within 1 calendar month at £0 fee).
• 100% Browser-Local Diagnostics & MV3 Extensions: When you run a live DNS/DMARC/SPF/MTA-STS scan, score a Cyber Essentials v3.3 checklist, evaluate PHP2Shell exposure, or sanitise ARIA/HTML/JSON/CSV logs on faultypacket.co.uk—or use our Chrome Manifest V3 extensions—all processing happens 100% locally inside your own browser memory. DNS lookups are queried directly from your browser to public DNS-over-HTTPS resolvers (Cloudflare 1.1.1.1 / Google 8.8.8.8). FaultyPacket does not log, store, or transmit your scanned domains or exported table data to any FaultyPacket server.

7. PECR Regulation 6 Zero-Cookie & Zero-Tracker Attestation

We certify in accordance with Regulation 6 of the Privacy and Electronic Communications Regulations 2003 (PECR) and UK ICO guidance on storage and access technologies that faultypacket.co.uk sets zero non-essential cookies, zero analytics cookies (no Google Analytics / GA4, no Meta Pixel, no Hotjar), and zero cross-site advertising trackers. Because no non-essential cookies or local-storage identifiers are placed on your terminal equipment, you are never tracked across sessions.

8. Lawful Bases of Processing (UK GDPR Article 6(1)) & Retention Schedule

9. Sub-Processors & International Transfers (UK IDTA / Adequacy)

We do not sell, rent, or broker personal data under any circumstances. Our minimal infrastructure relies strictly on industry-standard sub-processors bound by the UK International Data Transfer Agreement (IDTA), the UK Addendum to EU Standard Contractual Clauses (SCCs), or UK Adequacy Regulations:

• Cloudflare, Inc. / Cloudflare Ltd (UK/EU Edge): Static Pages hosting, DNS, DDoS protection, and inbound Email Routing.
• PayPal UK Ltd: PCI-DSS Level 1 merchant checkout processing for digital packs and voluntary Lab Fuel contributions (FaultyPacket never sees or touches your payment card numbers).
• Resend, Inc. (AWS eu-west-1 Ireland/Europe Region): Transactional outbound email delivery ([email protected] / [email protected]) configured with open_tracking: false and click_tracking: false.
• Google LLC (Gmail): Encrypted mailbox receipt for inbound support and security correspondence.

10. Your UK GDPR Data Subject Rights & UK ICO Supervisory Authority

Under the UK GDPR and the Data Protection Act 2018, you have the following statutory rights free of charge:

• Right to be Informed (Art. 13–14) & Right of Access / DSAR (Art. 15): Request a copy of any personal data we hold about you (fulfilled within 1 calendar month at £0 fee).
• Right to Rectification (Art. 16) & Right to Erasure / "Right to be Forgotten" (Art. 17): Request correction or deletion of your personal data (subject only to mandatory UK HMRC 6-year invoice retention for completed financial transactions).
• Right to Restrict Processing (Art. 18), Right to Data Portability (Art. 20) & Right to Object (Art. 21).
• Rights Related to Automated Decision-Making & Profiling (Art. 22): FaultyPacket performs zero automated profiling or behavioural scoring of individuals.

How to Exercise Your Rights: Email [email protected]. We respond to all privacy requests within 48 hours.

ICO Data Protection Fee & Supervisory Authority Reference: Because FaultyPacket operates a 100% browser-local diagnostic architecture and only processes minimal core business accounting/order administration records (without CCTV, credit reference brokerage, or behavioural profiling), core accounting/order record administration falls within the core business administration provisions of Schedule 2 paragraph 5 (statutory core-accounting exemption — £0 fee, no £52/yr ICO tier-1 fee required) of the Data Protection (Charges and Information) Regulations 2018. You also have the right at any time to lodge a concern with the UK supervisory authority, the Information Commissioner's Office (ICO), at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF (https://ico.org.uk · Tel: 0303 123 1113). We kindly ask that you contact us at [email protected] first so we can resolve any concern immediately.