Privacy Policy

1. Who we are

CyberSec Compliance ("we", "us", "our") provides a documentation and compliance-readiness platform covering the NCSC Cyber Assessment Framework (CAF), ISO/IEC 27001, Cyber Essentials / Cyber Essentials Plus, and Cyber Insurance readiness evidence. We are the data controller for the personal data described in this policy.

Registered company name: CyberSec Compliance Ltd
Company number: 17285687
Registered office: Unit A, 82 James Carter Road, Mildenhall, Bury Saint Edmunds, IP28 7DE, UK
ICO registration reference: ZC240652
Contact: info@cyberseccompliance.co.uk

2. What data we collect

We collect:

• Contact and company details you give us at signup and during onboarding, name, work email, company name, trading name, industry, employee count, and similar business profile information.
• Security-posture answers you give us through our onboarding questionnaire and portal, how your organisation manages access control, backups, devices, remote working, incident response and similar operational detail. This is the information your generated policy pack and readiness evidence are built from.
• Account and login information for your portal account, including your email address and an encrypted password.
• Payment information, we do not collect or store your card details ourselves. Payments are processed entirely by Stripe, our payment provider; we only receive confirmation that a payment succeeded and which package was purchased.
• Documents and files you generate, upload, or that our platform generates on your behalf (policies, registers, evidence packs, and similar).
• Support and correspondence, anything you send us by email or through the platform when you contact us.
• Technical and usage data needed to operate the portal securely, such as login timestamps and session identifiers.

Providing this information is necessary for us to create your account and deliver the service, without it, we won't be able to set you up on the platform.

3. How we use your data

• To create and administer your account and deliver the service you've purchased.
• To generate your policy documents, Statement of Applicability, readiness packs, and other deliverables from the answers you provide.
• To keep your documentation current through our automated affected-document flagging and review-reminder features.
• To process payments (via Stripe) and send you payment, onboarding and account-related emails.
• To respond to support requests and administrative queries.
• To meet our own legal and regulatory obligations.

We do not carry out any automated decision-making that produces legal or similarly significant effects on you.

4. Legal basis for processing

We process your data on the basis of: performing our contract with you (delivering the service you've purchased); our legitimate interests in operating and improving the platform, and in keeping the service secure; and, where relevant, your consent (for example, for optional marketing communications, which you can withdraw at any time).

5. Who we share it with

We do not sell your data. We share it only where necessary to run the service, with:

• Stripe, to process payments. Stripe acts as an independent data controller for payment data; see Stripe's own privacy policy for details. Where this involves transferring your data outside the UK, appropriate legal safeguards are in place, see Section 6.
• Microsoft 365, to send transactional and account emails (welcome emails, onboarding confirmations, notifications).
• Any professional advisers, auditors or authorities where we're legally required to disclose information.

We do not send any of your data to an external AI platform for processing. Document generation and questionnaire processing run entirely within our own platform.

6. Where your data is stored

Our platform is self-hosted on infrastructure located in the United Kingdom. Your questionnaire answers, generated documents, and account data are not transferred outside the UK as part of normal service operation.

The one exception is payment processing: when you make a payment, your billing details (name, email, payment information) are handled by Stripe, which may process this data outside the UK as part of its global payment infrastructure. Where this happens, Stripe relies on the UK International Data Transfer Addendum (to the EU Standard Contractual Clauses) and/or the UK Extension to the EU-U.S. Data Privacy Framework as its legal safeguard for the transfer. See Stripe's own privacy policy for detail on how Stripe handles this.

7. How long we keep your data

We keep your account data and generated documents for as long as your account is active. If you cancel, we retain your data for a further 30-day grace period so you can download anything you need, after which your portal access is revoked and your data is deleted or anonymised, save for anything we're legally required to retain (such as payment records for tax purposes).

8. Your rights

Under UK GDPR, you have the right to: access the personal data we hold about you; request correction of inaccurate data; request erasure of your data; request a copy of your data in a portable format; object to or restrict certain processing; and withdraw consent at any time where processing is based on consent. To exercise any of these rights, contact us at info@cyberseccompliance.co.uk.

If you're unhappy with how we've handled your data, you also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

9. Cookies

Our website itself does not currently use analytics, advertising or tracking cookies. When you log in to the customer portal, we use an essential authentication cookie required to keep you securely logged in, this isn't optional and doesn't require consent, as it's necessary for the service to function. If you complete a payment, Stripe's checkout page may set its own cookies as part of its fraud-prevention process; this happens on Stripe's domain, not ours. See our Cookie Policy for the specific cookie we set and how long it lasts.

10. Security

We take the security of your data seriously. Our platform is self-hosted on infrastructure we control, encrypted where appropriate, and access is restricted to what's needed to operate the service. We're working towards our own Cyber Essentials certification as an independently-assessed benchmark of our own security practices, and will update this section once that's achieved. No method of transmission or storage is 100% secure, and we can't guarantee absolute security, but we work to keep your data protected on an ongoing basis.

If a personal data breach occurs that's likely to affect you, we will notify you without undue delay and, in any event, within 72 hours of becoming aware of it - the same statutory deadline that applies to our own notification to the ICO.

11. Changes to this policy

We may update this policy from time to time. We'll update the "Last updated" date above when we do. Significant changes will be communicated to active customers by email.

12. Contact us

Questions about this policy or how we handle your data: info@cyberseccompliance.co.uk.