Privacy policy
How we collect, use and protect personal information when you visit our website, contact us, buy our services or take part in an assessment with us.
Who we are
Get Cyber Certified is the trading name of Data Security and Compliance Services Ltd, a company registered in England and Wales (number 09707953). Our registered address is c/o Suite 2, Rotherside Court, Rotherside Road, Eckington, South Yorkshire, S21 4HL. We are registered with the Information Commissioner's Office (ICO): you can check our registration on the ICO register of fee payers.
We are the controller of the personal information described in this policy. That means we decide how and why it is used, and we are responsible for looking after it under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
We are an IASME-licensed Certification Body for Cyber Essentials and IASME Cyber Assurance. IASME is the NCSC's Cyber Essentials Partner, and it decides how its own scheme and assessment platform use your information. Its own privacy statement explains that.
Our data protection lead is Mark Kindred, Managing Director. Contact us about anything in this policy at team@getcybercertified.co.uk or 0333 339 0383, using the subject "Data Protection Enquiry".
Who this policy covers
- People who visit getcybercertified.uk
- People who contact us, book a call or fill in one of our forms
- Our customers and their staff, and IT providers or advisers who complete an assessment on a customer's behalf
- People who apply for our Charity Special Offer or our IT partner programme
Our services are for organisations, not children, and we don't knowingly collect information about anyone under 18.
What we collect, why, and our lawful basis
We collect most information directly from you. Where an IT provider or colleague fills in a form for your organisation, we receive your details from them.
| When | What we collect | Why we use it | Lawful basis |
|---|---|---|---|
| You contact us or book a call | Name, organisation, role, email, phone, staff and device numbers, deadline, your message, how you heard about us | To reply, give advice and prepare a quote | Legitimate interests (responding to enquiries), or steps before a contract at your request |
| You apply for the Charity Special Offer | As above, plus charity name, number, regulator and turnover band | To check eligibility and reply | Legitimate interests; steps before a contract |
| You buy a service on our website | Name, email, phone, billing address, organisation size, the service bought, order and payment status | To take payment, deliver the service, send your welcome pack and invoice | Contract; legal obligation (accounting and tax records) |
| You receive a quote or invoice | Name, organisation, contact details, services, amounts, payment status | To quote, invoice and keep financial records | Contract; legal obligation |
| You complete our portal setup form | Applicant's organisation name (as it appears on the certificate), name, job title, mobile, email, business address, order or invoice number, organisation size; and the agent's name, company and email if an IT provider completes it | To set up your assessment portal and run your assessment | Contract |
| You take part in an assessment | Your answers to the question set, the scope of your systems (for example device types, operating systems, cloud services and network details), evidence you choose to send us, and notes from your kick-off and support calls | To assess your organisation against the scheme, give feedback and issue a certificate | Contract; legitimate interests (keeping a record of how we reached our decision, which the scheme can audit) |
| Cyber Essentials Plus | Contact details, scope and the results of the technical audit | To arrange and carry out the CE+ audit | Contract |
| You ask for updates | Your email and your opt-in | To send occasional cyber security and technology updates and relevant offers | Consent (you can withdraw it at any time) |
| Your certificate is due for renewal | Contact details and certificate date | To remind you before it expires | Legitimate interests (helping you keep your certification) |
| You use our website | Information your browser stores to make the shop and forms work, and, only if you accept, Google Analytics data about how you use the site | To run the website securely and improve it | Legitimate interests (strictly necessary storage); consent (analytics) |
We need the details marked as required on our forms to provide the service. Without them we can't set up your assessment or issue a certificate.
We don't use your information for automated decision-making or profiling. Our free online readiness check runs in your browser and doesn't send or store your answers.
Marketing. We send renewal reminders as part of our service. We send occasional cyber security and technology updates and relevant offers only if you've opted in. Every email has an unsubscribe link, and you can also email us to stop them.
Who we share it with
We never sell your information. We share it only where it's needed to deliver your service, run our business or meet the law.
IASME and the certification scheme. To register your assessment we enter your organisation's and applicant's details into IASME's assessment platform. IASME uses them to run the scheme, issue certificates and send its own renewal and scheme messages, under its own privacy statement. When you're certified, your organisation's name and certificate details appear in the public search of certified organisations. If you opt in to the cyber liability insurance included with Cyber Essentials, IASME passes your details to its insurance broker to set up the policy.
We don't post about our clients on social media. At the end of a successful assessment IASME may ask whether you'd like it to post congratulations naming your organisation; it does so only if you agree.
Our assessors and partners. Assessments are marked only by IASME-licensed assessors working with us. For Cyber Essentials Plus, we share your contact details and scope with one of our partner CE+ consultants, who carries out the technical audit.
Suppliers who work for us (processors). They may only use your information on our instructions:
| Supplier | What they do for us |
|---|---|
| Wix.com | Hosts our website, forms, shop, customer records, quotes and invoices |
| Stripe | Processes card payments. We never see or store your full card details |
| Microsoft 365 | UK tenancy: email, file storage, backups, and Bookings and Teams for kick-off and support meetings |
| Zoho (Bigin) | Customer records: tracking enquiries, orders, assessments and renewal dates |
| Google Analytics | Website statistics, only if you accept analytics cookies |
We may also share information with our accountants and professional advisers, and where the law requires it (for example HMRC, the police or a court order). If the business were sold, information would pass to the new owner under the same protections.
International transfers
We store your information in the UK where we can. Some of our suppliers process data outside the UK, for example in the European Economic Area or the United States. When that happens, we make sure it is protected by UK adequacy regulations (for example, US suppliers certified under the UK Extension to the EU–US Data Privacy Framework) or by the ICO's International Data Transfer Agreement or Addendum.
How long we keep it
| Information | How long | Why |
|---|---|---|
| Enquiries that don't lead to an order | 36 months from our last contact | So we can pick up the conversation if you come back |
| Orders, quotes, invoices and payment records | 6 years after the end of the financial year they relate to | UK tax and company law |
| Portal setup details, assessment records and certificates | 36 months after our last service to you | To answer queries, support renewals and show how we reached our decisions if the scheme audits us |
| Marketing preferences | Until you unsubscribe, then a suppression record so we don't contact you again | To respect your choice |
After these periods we securely delete the information or anonymise it.
How we keep it safe
We hold Cyber Essentials and IASME Cyber Assurance certifications ourselves, and as a Certification Body we're audited by IASME. Our measures include encrypted devices, multi-factor authentication on all business systems, a password manager, prompt security updates, encrypted backups and access limited to the people who need it. All our assessors are trained and licensed by IASME.
Please send us only the information we ask for. Don't send passwords, full IP address lists or other sensitive security details unless your assessor asks for them, and then only by the method they give you.
Cookies and similar technology
Our website doesn't use advertising cookies. It uses:
- Strictly necessary storage: a session token in your browser, so our checkout and forms can talk to our shop securely and show you the order you've just placed. Wix's secure checkout may set its own strictly necessary cookies. A note that you've placed an order stops our reviews badge appearing, and a note of your cookie choice. These don't need your consent.
- Analytics (only if you accept): Google Analytics cookies (names beginning
_ga) that tell us which pages are used, so we can improve the site. They're set only if you click Accept on our cookie banner, and Google's advertising features are switched off. Google processes this data for us and may handle it outside the UK.
You can change your choice at any time with the Cookie settings link at the bottom of every page, or clear cookies in your browser.
Your rights
You have the right to:
- ask for a copy of the information we hold about you
- ask us to correct information that's wrong or incomplete
- ask us to delete your information
- ask us to restrict how we use it
- object to our use of it where we rely on legitimate interests, and always to direct marketing
- ask us to send information you gave us to you or another organisation in a common format
- withdraw your consent at any time, where we rely on consent (this doesn't affect anything we did before)
Some rights depend on our reason for using the information. For example, we can't delete records we must keep for tax purposes. To use any of your rights, email team@getcybercertified.co.uk with the subject "Data Protection Enquiry". We'll reply within one month and won't charge you.
Complaints
If you're unhappy with how we've handled your information, please tell us first, by email, phone or post using the details below. We'll acknowledge your complaint within 30 days, look into it promptly, keep you updated and tell you the outcome.
You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, or call 0303 123 1113.
Contact us
Mark Kindred, data protection lead
Data Security and Compliance Services Ltd, trading as Get Cyber Certified
c/o Suite 2, Rotherside Court, Rotherside Road, Eckington, South Yorkshire, S21 4HL
Email: team@getcybercertified.co.uk
Phone: 0333 339 0383
Changes to this policy
We review this policy at least once a year and when our services or suppliers change. The date at the top shows when it was last updated.