Privacy Policy
Last updated: June 9, 2026
Who we are
Pathbreak Ltd (trading as Pathbreak), a company registered in England and Wales (company number 17265710), registered office 60 High Street, Wimbledon, London, England, SW19 5EE, is the controller of the personal data described in this policy. You can reach us at [email protected].
What we collect
Information you give us
When you use our contact or demo-request form, we collect the name, work email, company, and any message you provide. We use this to respond to you and to manage our relationship.
Information collected automatically
Our web server keeps standard logs (such as IP address, browser user-agent, requested pages, and timestamps) to operate and secure the Site. We use Google Analytics 4 to understand how visitors use the Site. It sets first-party cookies and may share limited usage data with Google, which can process that data outside the UK. We do not use advertising or cross-site tracking cookies.
Service data (for customers)
When a customer connects a cloud environment to the Pathbreak platform, we process configuration, identity, and findings data from that environment to provide the Service. Where that data includes personal data, we process it on the customer's behalf as a processor, under the customer's agreement and instructions. Pathbreak and Pwned Labs are separate companies with separate ownership, and Pathbreak's technology is independently developed. We do not use Pwned Labs' data, content, code or materials to build or train Pathbreak.
How we use personal data, and our legal bases
- To respond to inquiries and demo requests, and to take steps at your request before any contract (legitimate interests; pre-contract steps).
- To provide, maintain, and secure the Site and Service (contract; legitimate interests in security and reliability).
- To comply with legal obligations.
Who we share it with
We share personal data only with service providers who process it on our behalf, including our CRM and email provider (HubSpot) for managing inquiries, and our cloud hosting provider for running the Site and Service. We do not sell your personal data, and we do not share it for advertising.
International transfers
Some providers (such as HubSpot) may process data outside the UK. Where that happens, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses.
How long we keep it
We keep inquiry and contact data for as long as needed to respond and maintain our relationship, and then delete or anonymize it. Customer service data is retained per the customer agreement. Server logs are kept for a limited period for security and operational purposes.
How we protect it
We use technical and organizational measures appropriate to the risk, including encryption in transit (HTTPS), access controls, and a hardened infrastructure. No method of transmission or storage is completely secure, but we work to protect your data and to respond quickly to any incident.
Your rights
Under UK GDPR you may have the right to access, correct, delete, restrict, or object to processing of your personal data, and to data portability. To exercise these rights, contact [email protected]. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.
Cookies
We use Google Analytics 4, which sets first-party cookies to measure how the Site is used. We do not set advertising or cross-site tracking cookies. If we add other cookies in future, we will update this policy and provide any controls required by law.
Children
The Site and Service are intended for businesses and people aged 18 or over. We do not knowingly collect personal data from children.
Changes
We may update this policy from time to time. The "last updated" date above shows the latest revision, and material changes will be highlighted where appropriate.
Contact
Questions about this policy or your data: [email protected].