This Privacy Policy explains how Network Admin Journey collects, uses, shares and protects personal data when you visit roadtoneteng.com, read our guides, use our interactive network tools, contact us, subscribe to updates, or buy our consulting and mentoring services. We have tried to write it in plain English and to be specific about what actually happens on this website.
Last updated: October 14, 2026
Summary in brief: we collect only what we need to answer your messages, deliver services you order, keep the website secure and, if you agree, understand how the site is used. We do not sell personal data, we do not use it for automated decisions that affect you, and you can ask us at any time to access, correct or delete it.
1. Who we are (the data controller)
The website roadtoneteng.com is operated by Network Admin Journey (“we”, “us”, “our”). For the purposes of the EU General Data Protection Regulation (GDPR), the UK GDPR and the UK Data Protection Act 2018, we are the controller of the personal data described in this policy, meaning we decide why and how it is processed. For the purposes of the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, “CCPA/CPRA”), we are the business that collects your personal information.
You can reach us about any privacy matter by email at contact@roadtoneteng.com or by post at Remote-first practice — postal address available on request. Because we are a small practice, we have not appointed a formal Data Protection Officer; privacy requests are handled directly by the person responsible for the business, who reads and answers them personally.
2. Scope of this policy
This policy covers personal data processed through:
- the public website, including our free guides, the learning roadmap, the blog and the network tools;
- our contact and enquiry forms;
- the online shop, cart, checkout and customer account area;
- email and other correspondence with us, including during the delivery of consulting, assessment and mentoring services.
When we deliver a consulting engagement, we may be given access to a client’s network devices, configurations or documentation that contain personal data about the client’s own staff or users (for example usernames in a configuration file or IP addresses in logs). In that situation the client remains the controller of that data and we act as a processor on its instructions. Those activities are governed by our Terms & Conditions and, where required, a separate data processing agreement, rather than by this policy.
Cookies and similar technologies are described in more detail in our Cookie Policy, which forms part of this policy.
3. Personal data we collect
We collect personal data in three ways: information you give us directly, information generated automatically when you use the website, and limited information we receive from service providers such as payment processors.
3.1 Contact and enquiry forms
Our forms are built with Contact Form 7. When you send a message we collect your name, email address, subject, message and any details you include about your network, project or learning goals, plus the submission date and time. Please do not include passwords or configurations containing secrets; if we need such material for a project, we will agree a secure way to exchange it.
3.2 Newsletter and update opt-in
Some forms include an optional, unticked checkbox that lets you ask to receive occasional emails about new guides, tools and services. If you tick it, we record your email address, the fact that you consented, the date and time, and the form you used, so we can demonstrate your consent. If you do not tick it, we will only use your email address to reply to your message. You can withdraw consent at any time using the unsubscribe link in any email or by writing to contact@roadtoneteng.com.
3.3 Orders, customer accounts and billing (WooCommerce)
Our shop runs on WooCommerce. Our services are delivered remotely and nothing is physically shipped, so we do not ask for a delivery address. When you place an order or create an account we collect:
- Identity and contact data: name, email address, and optionally company name and phone number if you provide them;
- Billing data: billing address and country, which we need for invoicing and to calculate applicable taxes, and a tax or VAT number if you supply one;
- Order data: the services purchased, prices, discounts, taxes, order notes you write, order status and order history;
- Account data: username, a securely hashed password, and saved account details if you choose to create an account.
Card and payment account details are entered directly with our payment processors (for example Stripe or PayPal) through their secure fields or pages. We do not see or store your full card number or security code. We receive only limited information back, such as a transaction identifier, the payment status, the payment method type and, in some cases, the last four digits and expiry date of a card.
3.4 Service delivery and mentoring
When you buy a service, such as the CCNA Mentorship Program, we also hold the correspondence, meeting notes, scheduling details, project files and progress notes needed to deliver it, including any study goals you share.
3.5 Blog comments
If comments are open on an article and you leave one, we collect the name, email address and optional website you enter, the comment text, your IP address and your browser user agent string. The IP address and user agent help detect spam. Your name, website and comment are published publicly; your email address is never published. If you tick the option to save your details, your name, email and website are stored in cookies on your device for convenience.
3.6 Server logs
Like almost every website, our hosting servers automatically record technical information each time a page or file is requested: IP address, date and time, requested URL, HTTP status code, referring page, browser user agent and the amount of data transferred. These logs are used to run, troubleshoot and protect the service.
3.7 Security and firewall logs (Wordfence)
We use the Wordfence security plugin, which includes a web application firewall, login protection and malware scanning, together with WP Hide & Security Enhancer, which reduces the information the site exposes to automated attackers. To block attacks, Wordfence processes and may log IP addresses, the requested URL, user agent, request details that match attack signatures, login attempts (including the username tried) and the time of each event. It may compare IP addresses against threat-intelligence data provided by its vendor. Logged-in administrators may receive a security cookie, described in the Cookie Policy.
3.8 Cookies, local storage and analytics
We use strictly necessary cookies for the shop, login and consent banner. Analytics or marketing cookies are only set if you agree through our CookieYes banner, and you can change your choice at any time via “Cookie settings”. Our interactive tools and learning roadmap save your progress in your browser’s local storage; that information stays on your device and is not sent to us. Full details are in our Cookie Policy.
3.9 Sensitive personal data
We do not ask for, and do not want to receive, special categories of personal data (such as health, religious beliefs, ethnic origin, sexual orientation or biometric data) or government identification numbers. Account passwords are stored only in hashed form and we do not use account log-in credentials or any other “sensitive personal information” (as defined in the CCPA/CPRA) to infer characteristics about you. If you volunteer sensitive information in a message, we will use it only to respond to you and will delete it when it is no longer needed.
4. Why we use your data and our legal bases
Under the GDPR and UK GDPR we must have a lawful basis under Article 6 for each use of personal data. The table below sets out each purpose and the basis we rely on.
| Purpose | Data used | Legal basis (GDPR Art. 6) |
|---|---|---|
| Replying to enquiries and quote requests | Contact form data, correspondence | Legitimate interests (responding to people who contact us); steps prior to a contract where you ask about a service (Art. 6(1)(b)) |
| Processing orders, taking payment and delivering services | Order, account, billing and service delivery data | Performance of a contract (Art. 6(1)(b)) |
| Creating and maintaining your customer account | Account data | Performance of a contract (Art. 6(1)(b)) |
| Issuing invoices, keeping accounting records and meeting tax obligations | Billing and order data | Legal obligation (Art. 6(1)(c)) |
| Sending newsletters and updates about new guides, tools and services | Email address, consent record | Consent (Art. 6(1)(a)), which you can withdraw at any time |
| Publishing and moderating comments, preventing spam | Comment data, IP address, user agent | Legitimate interests (running a public discussion area safely) |
| Website security, firewall protection and fraud prevention | Server logs, Wordfence logs, login attempts | Legitimate interests (protecting the website, our customers and our systems) |
| Strictly necessary cookies (cart, login, consent record) | Cookie identifiers | Legitimate interests and performance of a contract; exempt from consent under ePrivacy rules |
| Analytics and marketing cookies | Cookie identifiers, usage data | Consent (Art. 6(1)(a)) given through the cookie banner |
| Establishing, exercising or defending legal claims | Any relevant data | Legitimate interests (protecting our legal rights) |
Where we rely on legitimate interests, we have balanced them against your rights and concluded the processing is limited, expected and proportionate. You can ask for details of this assessment and have the right to object (see Your rights).
If you do not provide the information marked as required at checkout, we cannot process your order. Providing information through the contact form or the newsletter opt-in is entirely voluntary.
5. How long we keep your data
We keep personal data only for as long as we need it for the purpose it was collected for, and then delete or anonymise it. Typical periods are:
| Category | Retention period |
|---|---|
| Contact form messages and enquiries that do not lead to an order | Up to 24 months after our last exchange, then deleted |
| Newsletter subscription and consent record | Until you unsubscribe; the consent and unsubscribe record is kept for up to 3 years afterwards to prove compliance |
| Orders, invoices and accounting records | As long as tax and accounting laws require, generally up to 7 years from the end of the financial year |
| Customer account | Until you ask us to close it, or after 3 years of inactivity; order records are then kept as above |
| Project files, meeting notes and mentoring progress notes | Up to 24 months after the engagement ends, unless a longer period is agreed in writing |
| Published comments | As long as the article remains online, or until you ask us to remove the comment |
| Comments held as spam or rejected | Up to 30 days |
| Server access logs | Typically up to 30 days, depending on the hosting provider’s rotation schedule |
| Wordfence security and login logs | Typically up to 90 days, or longer if needed to investigate a specific incident |
| Cookies | As listed in the Cookie Policy |
Where a dispute or legal claim arises, we may keep relevant records until it is fully resolved.
6. Who we share your data with
We do not sell personal data, and we share it only with service providers that help us run the website and the business, or where the law requires. Our service providers act as processors on our behalf under written contracts that require them to protect the data and use it only on our instructions. The main categories are:
- Website hosting and infrastructure: the hosting company that stores the website, its database, backups and server logs.
- Payment processors: the payment gateways connected to WooCommerce (for example Stripe or PayPal), which process your payment and may carry out their own fraud checks. For some purposes, such as regulatory compliance and fraud prevention, payment processors act as independent controllers under their own privacy notices.
- Email delivery and newsletter provider: the service we use to send transactional emails (order confirmations, password resets) and, if you have opted in, newsletters.
- Security services: Wordfence and its vendor, which provide firewall rules, threat-intelligence lookups and malware scanning.
- Consent management: CookieYes, which records your cookie preferences.
- Analytics providers: only if you consent to analytics cookies.
- Professional advisers: accountants, auditors, lawyers and insurers, where necessary and under a duty of confidentiality.
- Authorities: tax authorities, courts, law enforcement or regulators, where we are legally required to disclose information or need to protect our rights, our customers or the public.
- Business transfers: a buyer or successor, if the business or its assets are ever sold or reorganised, subject to this policy continuing to apply.
7. International data transfers
Because we serve clients worldwide and use international service providers, your personal data may be processed outside the European Economic Area (EEA) and the United Kingdom, including in the United States, where data protection laws may differ from yours.
Where we transfer personal data from the EEA or the UK to a country that has not been recognised as providing adequate protection, we rely on appropriate safeguards, mainly the European Commission’s Standard Contractual Clauses (SCCs) and, for UK data, the UK International Data Transfer Addendum or Agreement. Where a recipient in the United States is certified under the EU-U.S. Data Privacy Framework (and its UK Extension), we may rely on that certification instead. We also assess, together with our providers, whether additional technical measures such as encryption are needed. You can request a copy of the relevant safeguards by writing to contact@roadtoneteng.com.
8. Your privacy rights
Your rights depend on where you live. We will honour the rights below for everyone where we reasonably can, regardless of location, and we will not charge you for making a request unless it is manifestly unfounded or excessive.
8.1 Rights under the GDPR and UK GDPR (EEA and UK residents)
- Access: to receive confirmation of whether we process your data and a copy of it.
- Rectification: to have inaccurate or incomplete data corrected.
- Erasure: to have your data deleted where there is no longer a valid reason to keep it.
- Restriction: to ask us to limit how we use your data while a concern is investigated.
- Portability: to receive data you gave us, in a structured, machine-readable format, where processing is based on consent or contract and carried out by automated means.
- Objection: to object to processing based on legitimate interests, and an absolute right to object to direct marketing.
- Withdrawal of consent: to withdraw consent at any time, without affecting processing carried out before withdrawal.
- Complaint: to complain to a supervisory authority, for example the authority in the EU country where you live or work, or the Information Commissioner’s Office (ICO) in the UK. We would appreciate the chance to resolve your concern first.
We will respond within one month of receiving your request. That period may be extended by up to two further months for complex or numerous requests, in which case we will tell you why.
8.2 Rights under the CCPA/CPRA (California residents)
If you are a California resident, you have the following rights, subject to certain exceptions:
- Right to know: to request the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purposes for collecting it, and the categories of third parties with whom we disclose it.
- Right to delete: to request deletion of personal information we collected from you.
- Right to correct: to request correction of inaccurate personal information.
- Right to opt out of sale or sharing: to direct us not to sell your personal information or share it for cross-context behavioral advertising.
- Right to limit use of sensitive personal information: to limit use of sensitive personal information to permitted purposes.
- Right to non-discrimination: not to receive discriminatory treatment for exercising any of these rights.
Categories collected in the past 12 months: identifiers (name, email, IP address, account username); customer records (billing address, phone number if provided); commercial information (services purchased, order history); internet or network activity (server and security logs, and cookie data where you consent); and professional information you choose to share in enquiries or mentoring. The sources, purposes and recipients are described in sections 3, 4 and 6. We disclose these categories to service providers for business purposes only.
8.3 “Do not sell or share my personal information”
We do not sell personal information for money, and we have not done so in the past 12 months. We do not knowingly sell or share the personal information of anyone under 16. Analytics or marketing cookies, which could in some circumstances be treated as “sharing” for cross-context behavioral advertising under the CCPA/CPRA, are only set if you opt in through the cookie banner. You can opt out at any time by opening Cookie settings and rejecting non-essential cookies. We also treat a Global Privacy Control (GPC) signal sent by your browser as a valid request to opt out of sale or sharing for that browser.
8.4 Sensitive personal information
The only sensitive personal information we process is account log-in credentials (your username together with a hashed password), which we use solely to let you sign in securely. We do not use or disclose sensitive personal information for purposes other than those permitted by the CCPA/CPRA regulations, so we do not offer a separate “limit the use” link. If that changes, we will update this policy and provide one.
8.5 Authorized agents and verification
You may use an authorized agent to submit a request on your behalf. We may ask the agent for signed written permission from you and may ask you to verify your identity directly with us, unless the agent holds a valid power of attorney. To protect your data, we verify every request by matching information you provide with information we already hold, typically by asking you to confirm the request from the email address associated with your account or orders. We will only use the information you provide for verification for that purpose.
8.6 Non-discrimination
We will not deny you services, charge you a different price, provide a different quality of service or otherwise penalise you for exercising any privacy right described in this policy.
8.7 How to exercise your rights
Email contact@roadtoneteng.com with the subject “Privacy request” and tell us which right you wish to exercise, or write to us at Remote-first practice — postal address available on request. Logged-in customers can also review and update account and billing details directly in My account. California residents will receive confirmation of receipt within 10 business days and a response within 45 calendar days, which may be extended once by a further 45 days where reasonably necessary.
9. Children’s privacy
Our website and services are not directed at children under 16, and we do not knowingly collect their personal data. Accounts and purchases are limited to adults, as set out in our Terms & Conditions. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
10. How we protect your data
Measures we use include:
- HTTPS/TLS encryption across the entire website;
- a web application firewall, login protection and malware scanning (Wordfence), plus hardening with WP Hide & Security Enhancer;
- multi-factor authentication and least-privilege access for administrative accounts;
- hashed customer passwords and no storage of full card numbers;
- regular software updates and routine backups;
- agreed secure channels for exchanging sensitive project material, deleted once no longer needed.
No system is perfectly secure. If we become aware of a personal data breach that is likely to put your rights and freedoms at risk, we will notify you and the relevant supervisory authority where the law requires us to, without undue delay.
11. Automated decision-making and AI
We do not make any decisions about you based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. Our interactive network tools perform calculations in your browser for educational purposes only and do not profile you. Security tools such as the Wordfence firewall may automatically block a request or an IP address that matches an attack pattern; this is a technical security measure, and if you believe you have been blocked in error you can contact us and a person will review it. We do not use the personal data you send us to train artificial intelligence models.
12. Changes to this policy
We may update this Privacy Policy to reflect changes in the law, our services or the tools we use. The “Last updated” date shows when it was last revised. If we make significant changes, we will highlight them on the website and, where appropriate, notify customers and subscribers by email before they take effect.
13. Contact us
If you have any questions about this policy, want to exercise your rights, or have a concern about how we handle personal data, please contact:
Network Admin Journey
Email: contact@roadtoneteng.com
Postal address: Remote-first practice — postal address available on request
Website: roadtoneteng.com
You can also use our contact page. Related documents: Cookie Policy, Terms & Conditions and Refund Policy.