Privacy notice
Last updated 2 November 2026.
Who is responsible
My PCI Report is published by 247 CyberLabs Limited, 20 Harcourt Street, Dublin D02 H364, Ireland (company no. 548840), the controller of the personal data described here. Write to us about it at info@247cyberlabs.com or by post at that address.
What we collect, and when
Your answers to the questions stay in your browser: we receive nothing while you answer them, and nothing if you only read your result on screen. We never ask for a card number, and the site refuses one if it is typed.
If you ask for the written report, we receive your name, work email address and company, your answers, the report they produce, and whether you asked one of our QSAs to go through it with you. If you ask for that call from the link in the report, we also receive the phone number you choose to leave, and use it only for that call.
Like any website, our host also processes technical data (such as your IP address and browser details) to deliver the pages and protect the site from abuse. Audience measurement is cookieless and identifies nobody (see the cookie notice).
Why, and on what basis
- To send you the report you ask for and, if you tick the box or ask from the report, to call you about it: steps you ask us to take (Article 6(1)(b) GDPR).
- To run and secure the site, on the basis of our legitimate interest in keeping it available and safe (Article 6(1)(f)).
If you do not tick the box, we send you the report and nothing else.
Who processes it for us
- Cloudflare hosts the site, runs the request for the report, checks with Turnstile that it is sent by a person rather than a program (from technical signals such as your IP address and browser), and counts page views in aggregate.
- Fly.io hosts, in Paris, the software we built and run ourselves to keep track of enquiries. Your request and your answers are recorded there.
- Amazon Web Services delivers the report to you by email, from its European Union region.
- Resend delivers your request to our business mailbox when that software cannot be reached.
All of them act on our instructions. The site itself keeps nothing on a server. These providers may process data outside the European Economic Area; where they do, the transfer relies on safeguards recognised under the GDPR, such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework. We do not sell your data or share it with anyone else.
How long we keep it
We keep your request and your answers for 12 months after our last exchange about them, then delete them. If they lead to an engagement, they become part of that engagement's records and are kept as our contract and legal obligations require.
Your rights
You can ask us for access to your data, to correct or delete it, to restrict or object to its use, or to receive it in a portable format. Write to info@247cyberlabs.com.
You can also complain to the Irish Data Protection Commission, our lead supervisory authority, or to the authority where you live; in France, the CNIL.
Cookies
The site sets no cookies of its own. See the cookie notice.