How To Build Personalisation without Sacrificing Security