External Website and Business Privacy Notice

Effective date: September 8, 2026

Last updated: September 8, 2026

1. Notice Overview

1.1 Purpose of this Notice

Lockbase Cyber LLC ("Lockbase," "we," "us," or "our") is a Microsoft Security consultancy. This Notice explains how we collect, use, disclose, retain, and protect Personal Information when we operate our website, develop and manage business relationships, deliver and administer our services, recruit, and meet our legal obligations.

This Notice is intended to provide clear information about Lockbase's current website and business practices.

1.2 Who this Notice Covers

This Notice applies to Personal Information about:

• visitors to our website;
• representatives of prospective and current customers;
• representatives of prospective and current partners, including Microsoft and channel partners;
• vendors, suppliers, consultants, subcontractors, and referral sources;
• attendees at events, briefings, workshops, and webinars we host or participate in;
• individuals who contact us or with whom we correspond; and
• job applicants and candidates for contractor engagements.

1.3 What this Notice Does Not Cover

This Notice does not apply to:

• Customer Personal Data. Personal Information we process on a customer's behalf and on that customer's documented instructions in the course of delivering services. That processing is governed by the customer's agreement with us, including the applicable Master Services Agreement, Order Documents, and Data Processing Addendum. See Section 9.
• Workforce data. Personal Information about our employees and engaged contractors in that capacity, which is governed by internal notices and policies.
• Third-party websites, products, and services, including Microsoft products and services you use under your own organization's agreements. See Section 16.
• Personal Information covered by a separate, more specific notice we provide at the point of collection.

2. Identity of the Business

2.1 Responsible Entity

Lockbase Cyber LLC
60 S State Route 157, Suite 11
Edwardsville, IL 62025-3846
United States
Privacy requests: privacy@lockbasecyber.com

2.2 Terminology

• "Lockbase," "we," "us," and "our" mean Lockbase Cyber LLC.
• "Personal Information" (also "Personal Data") means information that identifies, relates to, describes, or could reasonably be linked to an identified or identifiable individual. It does not include deidentified or aggregated information, or publicly available information as defined by applicable law.
• "Website" means lockbasecyber.com, including purviewassistant.lockbasecyber.com, sentinelcalculator.lockbasecyber.com, platform.lockbasecyber.com, and agents.lockbasecyber.com, and the pages, forms, and tools we operate under those hosts.
• "Business Contact" means an individual acting in a professional capacity on behalf of an organization, including customer, prospect, partner, vendor, and referral-source representatives.
• "Services" means the consulting, engineering, security optimization, advisory, product-related, and other services Lockbase provides under a written agreement.
• "Customer Personal Data" means Personal Information that Lockbase processes on behalf of a customer under a services agreement and Data Processing Addendum.

2.3 Our Role

For the processing described in this Notice, Lockbase generally acts as a controller (or "business" under US state privacy laws) because we determine the purposes and means of the processing. Where we process Customer Personal Data on a customer's instructions, we act as a processor (or "service provider") and this Notice does not apply. Section 9 explains that distinction.

3. Personal Information We Collect

We collect the following categories of Personal Information. Whether we hold a particular category about you depends on how you interact with us. Most of what we collect is ordinary business-contact information.

3.1 Identifiers and Contact Information

Name, business email address, business telephone number, employer, job title, business mailing address, and professional profile information such as a LinkedIn profile URL.

3.2 Business and Commercial Information

Organization and industry; areas of interest; service inquiries; proposal, quote, and contracting history; customer or partner relationship information; business role and, where relevant to a purchasing decision, decision-making authority; and records of communications and meetings.

3.3 Website and Device Information

IP address; browser type and version; device type and operating system; referring URL; date, time, and duration of visits; pages viewed; analytics identifiers assigned to your browser; and website interaction and diagnostic information generated by our hosting platform and analytics tools. The free tools we make available on the Website do not require an account and are not designed to collect Personal Information beyond the website and device information described in this section. See Section 7 for the technologies involved.

3.4 Communications

Emails, submitted forms, meeting and consultation requests, support or general inquiries, survey responses, event and webinar registrations, feedback, and our records of that correspondence.

3.5 Marketing and Professional-Relationship Information

Marketing preferences, subscription status, outreach and response history, opt-out status, and professional interests. We do not currently track whether you open our emails or click links in them.

3.6 Contracting, Billing, and Account Information

Authorized signatory and contracting contacts, signature records, billing and accounts-payable contacts, invoice and payment-administration information, and account permissions and administrative records for any environment or portal that Lockbase operates or administers for the applicable business purpose. We do not collect payment card numbers through the Website.

3.7 Applicant Information

For individuals who apply for employment or a contractor engagement: resume and employment history, education and qualifications, professional references, contact details, interview and recruiting communications, work-authorization information, and, where we elect to conduct a background check and applicable law permits, background-check information obtained through a consumer reporting agency with the separate disclosures and authorizations that law requires.

3.8 Security and Fraud-Prevention Information

Authentication and access records, security and audit logs, indicators of suspicious activity, and information needed to investigate misuse, fraud, or security incidents affecting our Website, systems, or business.

3.9 Sensitive Personal Information

We do not seek to collect sensitive Personal Information through the Website or in the ordinary course of business development. We do not collect biometric identifiers, precise geolocation, or government identification numbers through the Website. We may receive government identification or similar sensitive information outside the Website where reasonably necessary for recruiting, employment eligibility verification, background screening, or another legally authorized purpose. Where a specific activity requires sensitive information, we collect only what that activity requires and use it only for that purpose.

4. Sources of Personal Information

4.1 Directly from You

Through Website forms, email and telephone communications, meetings and consultations, events, contracting and onboarding activities, and job or contractor applications.

4.2 From Your Organization

From coworkers, authorized customer or partner representatives, procurement, legal, security, and finance contacts, and referral partners who introduce us.

4.3 From Public and Professional Sources

From company websites, public professional profiles, public directories and registries, business publications, and conference and event materials.

4.4 From Service Providers and Business Partners

From CRM and marketing service providers, referral and channel partners including Microsoft, event organizers, recruiting and staffing providers, and business-information and data-enrichment providers. We use purchased or enriched business-contact databases to identify organizations and roles relevant to our services. When we do, we require that the information be lawfully sourced, we honor opt-outs, and we maintain records of the basis on which we contact you where the law requires it.

4.5 Automatically Through the Website

Through server logs, strictly necessary cookies and security technologies operated by our hosting and content-delivery providers, and analytics cookies operated by Google Analytics on our behalf. See Section 7.

5. How We Use Personal Information

We use Personal Information for the following purposes.

5.1 To Operate and Secure the Website

Deliver pages and Website functions, diagnose performance and errors, understand how the Website and our free tools are used, measure the effectiveness of our marketing, prevent misuse, and protect our systems and information.

5.2 To Respond to Requests

Answer inquiries, schedule consultations, provide requested information, and prepare proposals and quotes.

5.3 To Develop and Manage Business Relationships

Identify prospective customers and partners, maintain customer, partner, vendor, and referral relationships, manage professional communications, and conduct account planning.

5.4 To Provide and Administer Services

Contract administration, account and access setup, billing and collections, relationship management, and service-related communications such as scheduling, status, and security notices.

5.5 Marketing and Business Development

Send business communications relevant to your role, conduct lawful business-to-business outreach, measure engagement with our communications, manage preferences and suppression lists, and invite contacts to events, briefings, and workshops.

5.6 Recruiting

Evaluate candidates, communicate about applications, verify qualifications and work authorization, conduct legally permitted screening, and maintain recruiting records.

5.7 Security, Fraud Prevention, and Incident Response

Monitor our systems, detect suspicious activity, investigate and respond to incidents, preserve evidence, and protect Lockbase, our customers, and others.

5.8 Legal and Compliance Purposes

Satisfy legal obligations, enforce our agreements, respond to lawful requests from public authorities, maintain business records, and establish, exercise, or defend legal claims.

5.9 Corporate Transactions

Evaluate and complete financing, acquisition, merger, reorganization, or sale-of-assets transactions, including due diligence.

6. Legal Bases

Where the law of your jurisdiction requires a legal basis for processing, we rely on one or more of the following: performance of, or steps toward, a contract; our legitimate interests in operating and securing our business, managing professional relationships, and conducting proportionate business-to-business marketing; your consent where we request it or the law requires it; compliance with legal obligations; and protection of legal rights and important interests. If additional jurisdiction-specific disclosures become applicable, we will provide them in a supplement to this Notice.

7. Cookies and Similar Technologies

7.1 Strictly Necessary Technologies

The Website uses server logs and cookies required for security, bot protection, load balancing, and basic Website function. These are set by our hosting platform and by Cloudflare, the content-delivery and security service in front of the Website. They do not identify you by name and are used only to deliver and protect the Website.

When you dismiss the cookie notice shown on the Website, a first-party cookie (cookie_notice_accepted) records that choice so the notice is not shown again; it persists for up to one year and is set by a WordPress plugin running on our own site.

The Website also loads fonts and script libraries from third-party content delivery services, including Google Fonts. To serve those files, the provider receives your IP address and basic browser information. These services do not set cookies on the Website.

7.2 Analytics

We use Google Analytics to understand how visitors use the Website, which pages and tools are useful, and how our marketing campaigns perform. Google Analytics sets cookies (named _ga and _ga_ followed by our property identifier) that assign a random identifier to your browser and record pages viewed, approximate city-level location derived from IP address, device and browser type, and referring source. If you arrive from one of our Google Ads, the link includes a click identifier that Google Analytics uses to attribute your visit to that campaign. These cookies persist for up to 13 months. Google processes this information on our behalf as our service provider. We have configured Google Analytics so that Google does not associate your visit with a Google account or use the information to build advertising profiles or personalize advertising. Aggregated campaign measurements from Google Analytics are made available in our Google Ads account so we can see how our advertising performs.

7.3 Advertising

We advertise our services using Google Ads. We do not place Google Ads conversion or remarketing tags on the Website, we do not publish analytics audiences to Google Ads, and we do not use remarketing or customer-list audiences. Google Ads automatically creates a segment of people who have engaged with our ads; we do not use it to target advertising.

7.4 Contact Forms and Scheduling

Our contact forms collect the information you enter and do not set cookies beyond those described above. Consultation scheduling is handled through Microsoft Bookings, a Microsoft-hosted service reached by a link we provide; that page is operated by Microsoft under Microsoft's privacy statement (see Section 16).

7.5 Your Choices

You can control cookies through your browser settings, including blocking or deleting them. Disabling strictly necessary cookies may prevent parts of the Website from working. To opt out of Google Analytics across all websites, you can install Google's browser opt-out add-on, available from Google. Information about how Google uses data from sites that use its services is available at policies.google.com/technologies/partner-sites.

7.6 Do Not Track and Opt-Out Preference Signals

We do not respond to browser Do Not Track signals because there is no common standard for interpreting them. Because we do not sell Personal Information or disclose it for targeted advertising, a Global Privacy Control signal does not change how we process your information; you can limit analytics using the choices in Section 7.5.

7.7 Changes to Our Technologies

If we add analytics, advertising, or other technologies, or change how existing ones are configured, we will update this Notice and, where required, provide a preference or consent mechanism before the change takes effect.

8. How We Disclose Personal Information

We disclose Personal Information to the following categories of recipients, in each case only as needed for the purposes in Section 5. We require service providers that process Personal Information on our behalf to protect it, to use it only to provide services to us, and to comply with applicable law.

8.1 Hosting, IT, Security, and Communications Providers

Our website hosting provider, Cloudflare (content delivery and security), content delivery services that serve fonts and script libraries for the Website, our Microsoft 365 productivity and email platform (including Microsoft Bookings for scheduling), and providers of security, identity, and collaboration services.

8.2 CRM, Marketing, and Sales Support Providers

Our customer relationship management platform, including Microsoft Dynamics 365; Google, as the provider of Google Analytics and Google Ads; and firms that support our outbound business development under contract with us and on our instructions.

8.3 Professional Advisers

Attorneys, accountants, auditors, and insurers, under professional or contractual confidentiality obligations.

8.4 Business Partners and Referral Sources

Microsoft and other channel or referral partners, where appropriate to a joint pursuit, referral, or co-delivery relationship in which you are involved, and subject to the restrictions in those arrangements. A partner may also process information for its own purposes under its own privacy notice where the partner independently determines how the information will be used.

8.5 Governmental and Legal Recipients

Courts, regulators, law enforcement, and other public authorities where required by law, legal process, or to protect rights, safety, or property.

8.6 Corporate-Transaction Recipients

Counterparties and their advisers in connection with a transaction described in Section 5.9, under confidentiality obligations.

8.7 At Your Direction or with Your Consent

Where you ask us to share information or otherwise consent.

8.8 No Sale or Targeted-Advertising Disclosure

We do not sell Personal Information for monetary or other valuable consideration. We do not disclose Personal Information for cross-context behavioral advertising or process Personal Information for targeted advertising. If these practices change, we will update this Notice and provide any choice or opt-out mechanism required by applicable law.

9. Customer Personal Data and Lockbase's Service-Provider Role

9.1 Separate Treatment

When we deliver Services, we may access or process Personal Information in a customer's environment, for example in Microsoft Sentinel, Microsoft Defender, Microsoft Purview, Microsoft Entra, or Security Copilot. That is Customer Personal Data. We process Customer Personal Data on the customer's documented instructions, as reflected in the applicable written agreements, and only as otherwise permitted or required by those agreements and applicable law, including as necessary to deliver the contracted Services, protect the relevant systems and information, and comply with legal obligations.

9.2 The Customer Is the Controller

Our customers determine the purposes and means of that processing. This Notice does not describe it, and our customers' own privacy notices govern.

9.3 Requests Concerning Customer Personal Data

If you believe Lockbase processes your Personal Information solely on behalf of one of our customers, please direct your request to that customer. We will provide reasonable assistance to the customer as our agreement with them requires.

9.4 Contractual Terms Control

Our processing of Customer Personal Data is governed by the applicable Master Services Agreement, Order Documents, Data Processing Addendum, and Security Addendum, and not by this Notice. Where this Notice and those agreements appear to conflict as to Customer Personal Data, the agreements control.

10. Data Retention

10.1 Retention Standard

We keep Personal Information only as long as reasonably necessary for the purpose for which we collected it, for the duration of the relevant relationship, to meet legal, regulatory, tax, and contractual obligations, for security and fraud prevention, and to resolve disputes and establish or defend legal claims. When Personal Information is no longer needed for these purposes, we delete, deidentify, or securely dispose of it in accordance with our retention practices.

10.2 Retention Criteria

In setting retention periods we consider the nature and sensitivity of the information, our ongoing business need, the length of the relationship, applicable legal requirements, and the risk of harm from unauthorized use or disclosure.

10.3 Suppression Records

When you opt out of marketing, we keep the limited information needed to honor that choice, such as your email address on a suppression list.

10.4 Deidentification and Aggregation

We may retain aggregated or deidentified information for legitimate business purposes. Where required by applicable law, we maintain such information in deidentified form and do not attempt to reidentify it except as permitted by law, including to test whether our deidentification measures remain effective.

11. Security

11.1 Safeguards

We maintain administrative, technical, and physical safeguards designed to protect Personal Information against unauthorized access, use, disclosure, alteration, and destruction, appropriate to the nature of the information and the risk involved.

11.2 Access Controls

We restrict access to Personal Information to personnel and service providers who need it for the purposes in this Notice, and we apply least-privilege principles to our own systems.

11.3 Authentication and Encryption

We use authentication and encryption safeguards appropriate to the systems and information involved. These measures include multifactor authentication for supported systems and access scenarios, particularly privileged or administrative access, and encryption for Personal Information in transit and at rest where supported by the applicable platform and within our reasonable control.

11.4 Monitoring and Incident Response

We monitor our systems for security events and maintain an incident response process. If a security incident involving Personal Information triggers a notification obligation under applicable law, we will provide the required notices to affected individuals and authorities.

11.5 No Guarantee of Absolute Security

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. This Notice does not create contractual security obligations; those, where they exist, are set out in our written agreements.

12. International Data Transfers

Lockbase is based in the United States. Personal Information may be processed in the United States and in other locations where our service providers operate. If you are located outside the United States, the privacy laws where your information is processed may differ from those in your jurisdiction. Where applicable law requires a particular safeguard or transfer mechanism for an international transfer, we take steps intended to implement the required safeguard. You may contact us at privacy@lockbasecyber.com for more information.

13. Your Privacy Rights and Choices

13.1 Rights That May Apply to You

Depending on where you live and the applicable law, you may have the right to:

• know what Personal Information we hold about you and access it;
• correct inaccurate Personal Information;
• delete Personal Information, subject to exceptions;
• obtain a portable copy of Personal Information you provided to us;
• restrict or object to certain processing;
• withdraw consent where processing is based on consent;
• opt out of marketing communications (see Section 14);
• opt out of the sale or sharing of Personal Information or of targeted advertising, where applicable (we do not engage in these activities; see Section 8.8); and
• appeal a decision we make on your request, where applicable law provides for an appeal.

As a matter of practice, we accept and review access, correction, and deletion requests concerning Personal Information we hold as a controller, even when a particular privacy law does not require us to do so. We may limit or decline a request for the reasons described in Section 13.6, including where necessary to protect security, preserve legal rights, comply with law, retain required business records, or protect another person's privacy.

13.2 How to Submit a Request

Email privacy@lockbasecyber.com with the subject line "Privacy Request," or write to us at the address in Section 2.1. Tell us what you are asking for and how to reach you.

13.3 Verification

We will take reasonable steps to verify your identity before acting on a request, typically by matching the information you provide to information we already hold or by confirming through your business email address. We may ask for additional information where necessary. We will not collect more information than we need to verify you.

13.4 Authorized Agents

Where applicable law allows, you may designate an authorized agent to submit a request on your behalf. We may require proof of the agent's authority and may ask you to verify your identity directly with us.

13.5 No Retaliation or Unlawful Discrimination

We will not retaliate or unlawfully discriminate against you for exercising a privacy right provided by applicable law.

13.6 Limitations

Rights vary by jurisdiction and are subject to exemptions. We may decline a request where the law permits, for example where fulfilling it would conflict with a legal obligation, compromise another person's privacy or the security of our systems, or where the information is needed for a legal claim. If we decline, we will tell you why, to the extent the law allows.

13.7 Response Timing

Where applicable law establishes a response period, we will respond within that period. For voluntary requests not governed by a statutory response period, we will respond within a reasonable period considering the request's scope, complexity, verification requirements, and the records reasonably available to us.

14. Marketing Communications

14.1 Email Preferences and Unsubscribe

Every marketing email we send includes an unsubscribe link. You can also opt out by emailing privacy@lockbasecyber.com or by replying to any marketing message with "unsubscribe." We process opt-out requests promptly and in any event within the time the law requires.

14.2 Outreach Sourced from Third Parties

If you receive outreach from us and did not provide your information directly, we obtained it from a source described in Section 4. You may ask us where we obtained it, and you may opt out at any time.

14.3 Service and Transactional Communications

Opting out of marketing does not stop communications we need to send to administer a relationship, such as contract, billing, security, account, and service notices.

15. Children's Privacy

The Website and our Services are directed to businesses and business professionals. We do not knowingly collect Personal Information from children, and the Website is not intended for them. If you believe a child has provided Personal Information to us, contact us at the address in Section 18. We will review the matter and take appropriate action, including deletion where required or appropriate.

16. Third-Party Websites and Services

The Website may link to third-party websites, tools, and social-media platforms, and we schedule consultations through Microsoft Bookings, a Microsoft-hosted service. Those third parties have their own privacy practices, which we do not control and which this Notice does not cover. Your use of Microsoft products and services, including Bookings, is governed by Microsoft's terms and privacy statements and by your organization's agreements with Microsoft.

17. Changes to this Notice

17.1 Updates

We may update this Notice to reflect changes in our practices, technologies, or the law. The current version is always available on the Website.

17.2 Effective Date

The effective date and last-updated date appear at the top of this Notice.

17.3 Material Changes

When required by applicable law, or when we otherwise consider it appropriate, we may provide additional notice of a material change, such as through a prominent Website notice or direct communication to affected Business Contacts for whom we have current contact information.

We review this Notice periodically and when material changes in our operations, vendors, technologies, or applicable law warrant an update.

18. Contact Lockbase

Lockbase Cyber LLC
Attn: Privacy
60 S State Route 157, Suite 11
Edwardsville, IL 62025-3846
United States
Email: privacy@lockbasecyber.com

To submit or appeal a privacy request, use the email address above with the subject line "Privacy Request" or "Privacy Appeal."

---

Appendix A: United States State Privacy Disclosures

This Appendix supplements the Notice for residents of US states with comprehensive privacy laws, to the extent those laws apply to Lockbase. Many state privacy laws exempt personal information collected in a business-to-business context or exempt businesses below revenue or data-volume thresholds. Lockbase provides these disclosures for transparency and, as stated in Section 13.1, accepts and reviews access, correction, and deletion requests regardless of whether a specific statute requires it, subject to the limitations in Section 13.6. The availability and scope of particular rights depend on the law applicable to the individual and to Lockbase's processing activities.

A.1 Categories of Personal Information Collected, Sources, Purposes, and Recipients

A.2 Sale and Targeted-Advertising Disclosure

We do not sell Personal Information for monetary or other valuable consideration. We do not disclose Personal Information for cross-context behavioral advertising or process Personal Information for targeted advertising. If these practices change, we will update this Notice and provide any choice or opt-out mechanism required by applicable law.

A.3 Sensitive Personal Information

We collect sensitive Personal Information only as described in Section 3.9 and use it only for the purpose for which it was collected. We do not use or disclose it to infer characteristics about individuals.

A.4 Retention

See Section 10.

A.5 Rights and How to Exercise Them

See Sections 13 and 18. Residents of states that provide an appeal right may appeal a decision by emailing privacy@lockbasecyber.com with the subject line "Privacy Appeal." We will respond to appeals within the time applicable law requires and will explain how to contact the state attorney general if you are dissatisfied with the outcome, where the law requires us to.

A.6 Financial Incentives

We do not offer financial incentives in exchange for Personal Information.

Appendix D: Cookie and Technology Details

Current as of September 11, 2026, based on a scan of all five Website hosts and a review of the Website's plugin configuration. We update this table before adding or changing any technology.

No advertising or retargeting cookies were present. Our contact forms set no additional cookies.