Privacy Notice

Cyber Essential Check (the "Service") is operated by Cyber Essential Check Ltd ("we", "us", "our"), a company registered in England and Wales.

• Registered office: [TBD - update in this notice]
• Company number: [TBD]
• ICO registration: application in progress; number published here once issued.
• Data protection contact: privacy@cyberessentialcheck.co.uk
• EU/EEA representative (Article 27 GDPR): [TBD if serving EU users]

• Account data: name, work email, job title, phone number, employer, hashed password (via Supabase Auth), IP address, session tokens.
• Assessment data: domains you enter, questionnaire answers, scan results and derived findings, scope information (staff/device counts, cloud services used).
• Connector data (optional): OAuth tokens (encrypted at rest with AES-256-GCM) and read-only metadata from services you connect (e.g. Microsoft 365, Google Workspace).
• Billing data: processed by our payment processor; we hold plan tier, invoice history and last-four of card only.
• Product telemetry (with consent): aggregated page views and feature usage.
• Wi-Fi data: network names (SSIDs), the security type and cipher in use, signal and radio type, plus any access points you add (make, model, mode). We never ask for or store your Wi-Fi password.
• Device check data: the security status of computers you check - firewall, security updates, antivirus, disk encryption, screen lock timeout and how many accounts have administrator rights - along with the device label and operating system you supply. The tool only reads settings; it never changes them and never collects file contents.
• Staff training data: the names and work email addresses you upload for security awareness training and simulated phishing, and their completion records.
• Enquiry data: questions and meeting requests you send us, including the mobile number and preferred times you provide so we can arrange a call.

All of this data is held against your account only. Other customers cannot see it: the database enforces per-account isolation on every table, and our staff access it only where necessary to support you.

• Provide the Service - performance of contract (Art. 6(1)(b)).
• Security, fraud prevention, audit logs - legitimate interests (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c)).
• Service transactional emails - performance of contract.
• Analytics and product improvement - consent (Art. 6(1)(a)); withdrawable at any time.
• Marketing communications - consent, or soft opt-in for existing customers under PECR reg. 22(3); unsubscribe in every message.

We share personal data with vetted sub-processors acting on our documented instructions. A current list is available in our Data Processing Addendum and includes:

• Supabase (database, auth, storage) - EU region.
• Cloudflare (edge compute, DDoS/WAF).
• Payment processor (Stripe or Paddle - see checkout).
• Transactional email provider.

We do not sell personal data. We do not share it for cross-context behavioural advertising.

Where personal data leaves the UK/EEA, transfers are protected by the UK International Data Transfer Addendum, EU Standard Contractual Clauses (2021/914), and supplementary measures (encryption in transit and at rest). A copy of the safeguards is available on request.

• Account and assessment data: for the life of your account, then 30 days.
• Scan history and evidence packs: 24 months (or until you delete them).
• Billing records: 6 years (UK statutory).
• Security logs: 12 months.
• Website visitor statistics (consent-based, no IP address stored): automatically deleted after 14 months by a scheduled clean-up job.
• Wi-Fi scan results: automatically deleted after 24 months, and device check results after 12 months, by a scheduled clean-up job.
• Scan tokens used by the Wi-Fi and device check tools: valid for 24 hours, then deleted automatically.
• Staff training records and enquiry records: for the life of your account, then removed with it.

You can download everything we hold about your account, or delete your account and its data, from Account settings at any time.

Under UK GDPR / EU GDPR you have the right to:

• Access, rectify, erase or restrict processing of your personal data.
• Portability (structured, machine-readable export).
• Object to processing based on legitimate interests or direct marketing.
• Withdraw consent at any time (without affecting prior lawful processing).
• Complain to the ICO (ico.org.uk) or your local EU supervisory authority.

California residents (CCPA/CPRA) additionally have the right to know, delete, correct, and limit use of sensitive personal information, and to opt out of the "sale" or "sharing" of personal data - we do not sell or share, but you can confirm your preferences via the cookie banner or by emailing privacy@cyberessentialcheck.co.uk. We do not discriminate against users who exercise their rights.

We respond to verified rights requests within 30 days (extendable by 60 days for complex requests).

TLS 1.2+ in transit; AES-256 at rest; row-level security in the database; least- privilege access controls; encrypted OAuth tokens; audit logs; independent security reviews. Report vulnerabilities to security@cyberessentialcheck.co.uk.

Scan results are generated by automated checks against public DNS/HTTP and your questionnaire answers. They are advisory only and do not produce legal or similarly significant effects on you. A human at your organisation reviews and acts on results.

The Service is for business use and is not directed to under-16s.

Material changes will be notified by email or in-product notice at least 14 days before they take effect.