Privacy Notice

This notice reflects the current technical and operating design of the website and assessment. It should be reviewed whenever the service, data practices, or third-party providers materially change.

The site may collect your name, organization, work email address, role, and the information you include in your message. It is used to respond to the inquiry and manage the resulting business communication.

The Follow-Up form collects your name, organization, work email address, and optionally your role. You may select up to two Technology Flywheel areas, or indicate that you are not sure where the issue fits, and you may describe what you would like to work through.

What you write is used to prepare for and respond to that conversation. It is read by Michael through an authenticated administrative view and is not included in notification emails.

The form asks you not to send passwords, account details, security configurations, incident evidence, client information, or regulated information. Please do not send them by reply email either.

A short code in the link, such as a workshop or session code, records the context you arrived from. It identifies the event or channel, never you, and is stored with your submission so Michael knows which conversation it follows.

An unrecognized code is treated as no attribution at all.

A Connect page collects your name and work email address, and optionally your organization, role, and mobile number, when you choose to share them. It is used so Michael can save your contact information and respond in connection with that interaction.

Sharing your details does not subscribe you to general marketing communications.

The Cyber First Aid checklist runs entirely in your browser. Your answers are not sent to Mickom, not stored, and not used to produce a result. The page has no record of them.

The assessment collects your name, work email address, organization, role, assessment responses, and the result generated from those responses. This information is used to produce your readiness view, operate the assessment, and evaluate and improve the clarity and usefulness of the assessment methodology.

If you separately indicate that you are open to a conversation about your result, the contact information you provided may be used for that follow-up. Completing the assessment by itself is not treated as consent to receive general marketing communications.

The site records limited technical and operational information needed to serve, secure, and troubleshoot the application, such as pages requested, approximate timing, and error diagnostics.

Information collected through the site is used to respond to messages, produce assessment results, operate and secure the service, troubleshoot problems, and improve the assessment and website experience.

• No advertising or cross-site behavioral tracking
• No sale of assessment responses or contact information to data brokers
• No marketing list created simply because someone completes the assessment
• No publication of identifying assessment results as proof, a case study, or a testimonial without permission
• No request for passwords, production credentials, payment-card information, protected health information, or detailed vulnerability data

Please do not submit sensitive or regulated information through the website or assessment.

Mickom may review assessment responses and feedback to evaluate question clarity, result usefulness, response patterns, and the assessment methodology. Where information is aggregated or de-identified so that it no longer identifies a person or organization, it may be retained and analyzed for longer periods to improve the assessment.

Public claims, case studies, testimonials, or client-identifying examples are not created from an individual organization’s assessment data without permission.

The current assessment-data retention settings are:

• Incomplete assessment sessions: 30 days
• Completed assessment responses that identify the respondent: 12 months
• Personalized assessment reports: 90 days
• Follow-Up submissions: 12 months
• Mickom Connect submissions: 12 months
• Aggregated and de-identified statistics: may be retained longer when they no longer identify a person or organization

Follow-Up and Connect submissions are deleted at the end of that period rather than de-identified. Unlike an assessment response, there is nothing useful left once the person is removed.

Where an interaction becomes an ongoing business relationship, the resulting correspondence is kept as an ordinary business record rather than remaining in a web submission.

An administrator may delete a submission sooner on request.

Business correspondence is retained only as needed to respond to the inquiry and maintain appropriate business records.

Scheduling is handled through Calendly and is subject to Calendly's own privacy terms. Application performance and error monitoring uses Microsoft Application Insights within Mickom's Azure environment.

The site does not use third-party advertising scripts or cross-site tracking cookies.

You may ask what assessment or contact information Mickom holds about you, request a correction, or request deletion where appropriate. Deleting assessment data may remove the ability to reproduce a personalized report.

Use the Contact page and identify the message as a privacy request so it can be handled appropriately.