Last updated: 1 September 2026
1. Who we are
This policy covers 5chumat.co.uk, operated by Chukwuma Lucas Omolu trading as 5chumat Super Solutions ("5chumat", "we", "us") — currently a sole proprietorship, not a registered company. We provide cybersecurity assessments and web/application development, and this policy explains how we handle personal data collected through the site, through bookings, and through the client portal.
We are the data controller for the information described below. Questions or requests about your data go to info@5chumat.co.uk.
2. What we collect
We collect information you give us directly, and a small amount collected automatically to keep the site secure. We don't buy data about you from anyone else.
Information you provide
- Contact details — name and email address, given when you book a consultation, submit a quote request, or create a client portal account.
- Booking & project information — what you tell us about your project, budget range, and timeline when requesting a quote or booking a consultation.
- Account data — your email and (optionally) a display name, if you create a client portal account. We never ask for or store a password — sign-in works by emailing you a one-time link, with an optional authenticator app as a second step you can turn on yourself.
- Signed agreements — a record of what was signed, by whom, and when, for any client agreement or authorisation you sign with us.
- Payment information — handled entirely by our payment processor, Stripe. We never see or store your card details; we only receive confirmation that a payment succeeded, its amount, and a reference we use to match it to your booking.
Information collected automatically
- Security & access logs — IP address, timestamps, and event type (e.g. a login attempt) for the admin panel and account sign-in, kept to detect abuse and keep accounts secure. See Cookies below for the one cookie this involves.
We do not run any analytics or advertising trackers on this site — no Google Analytics, no ad pixels, no third-party tracking scripts of any kind.
3. Why we collect it
- To deliver a service you've booked or paid for — a consultation, a security assessment, a web build.
- To process payments and keep accurate financial records.
- To run your client portal account, including signing you in and showing your own booking/document history.
- To respond to a quote request you've submitted.
- To keep the site and your account secure — rate-limiting abuse, detecting unusual login activity, maintaining an audit trail of admin actions on client data.
- To meet our own legal and accounting obligations (e.g. retaining financial records for the period UK law requires).
Where we're delivering something you've booked or paid for, our legal basis is performance of a contract. Where we're keeping the site secure, our basis is legitimate interest. We don't use your data for marketing, and we don't do anything with it that would require separate consent.
4. Who we share it with
We don't sell personal data, and we don't share it for marketing purposes. The only third party involved is:
- Stripe — our payment processor, which receives what's needed to process a payment (name, email, amount). Stripe is a data processor acting on our instructions; see Stripe's own privacy policy for how they handle it.
We may also disclose data where required by law — for example, in response to a valid legal request.
5. How long we keep it
- Booking, payment, and subscription records, and any signed agreement tied to a paid engagement, are kept for around 6 years, as UK law requires us to retain financial records regardless of what either of us would otherwise prefer.
- An unconverted quote request — one that never led to a booking — is kept for 12 months, then we email you asking whether to keep it or delete it. If we don't hear back within 30 days, it's deleted automatically.
- A client portal account with no booking or payment history is kept while you're using it; after 24 months of no activity, we email you the same "keep or delete?" question, with the same 30-day default-to-delete if you don't reply. Logging back in before then cancels the notice.
- Security and access logs are kept for 180 days for abuse detection, then deleted automatically.
You can ask us to delete your account and associated data at any time — see your rights below — though where a record falls under the 6-year financial retention above, we're legally required to keep that part regardless of the request.
6. Your rights
Under UK GDPR, you have the right to:
- Ask what personal data we hold about you, and get a copy of it.
- Have inaccurate data corrected.
- Ask us to delete your data, where we're not required to keep it for legal or accounting reasons.
- Object to or restrict how we use your data.
- Receive your data in a portable format.
- Complain to the Information Commissioner's Office (ICO) if you think we've handled your data wrongly.
To exercise any of these, email info@5chumat.co.uk. We'll respond within one month.
7. Cookies
This site uses one cookie: a session cookie that keeps you signed in and protects forms from cross-site attacks. It's strictly necessary for the site to function — without it, staying logged in wouldn't work — and it's deleted when you close your browser or sign out.
We don't set analytics, advertising, or tracking cookies of any kind. If that ever changes, this section will be updated first, and we'll ask for your consent before setting anything beyond what's strictly necessary.
Your browser also stores your light/dark theme choice locally (via localStorage, not a cookie) so the site remembers it on your next visit. This never leaves your device.
8. Changes to this policy
If we change how we handle personal data, we'll update this page and the "last updated" date above. For significant changes, we'll make that clear rather than relying on you to re-read the whole page.