Privacy Policy

1. Introduction

Welcome to the privacy policy of Cyber Data Services ("we", "our", or "us"). We respect your privacy and are committed to protecting your personal data. This policy explains how we handle your personal data when you visit our website or interact with our services.

This privacy policy is designed to comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), the Privacy and Electronic Communications Regulations (PECR), and guidelines set forth by the Information Commissioner's Office (ICO).

2. What is Personal Data?

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

Examples of personal data include your name, email address, phone number, IP address, or any other identifier that allows us to recognize you as a specific individual.

3. Types of Personal Data Collected

We may collect, use, store, and transfer different kinds of personal data about you, which we have grouped together as follows:

• Identity & Contact Data: First name, last name, email address, telephone number, billing address, job title, company name, and industry.
• Enquiry Data: Details provided when you request a quote, fill out a contact form, or ask about our cybersecurity services.
• Technical Data: Internet protocol (IP) address, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website.
• Usage Data: Information about how you use our website, pages visited, time spent on pages, referring websites, and interaction data.
• Marketing & Communications Data: Your preferences in receiving marketing from us and your communication preferences.

4. How We Collect Your Data

We use different methods to collect data from and about you, including through:

• Direct Interactions: You may give us your Identity, Contact, and Enquiry Data by filling in forms (e.g., contact forms, quote requests) or by corresponding with us by post, phone, email, or otherwise.
• Automated Technologies: As you interact with our website, we will automatically collect Technical and Usage Data about your equipment, browsing actions, and patterns. We collect this using cookies, server logs, and similar technologies.
• Third Parties or Publicly Available Sources: We may receive personal data about you from various third parties, such as analytics providers (e.g., Google Analytics) or advertising networks.

5. How We Use Your Data

We will only use your personal data when the law allows us to. Most commonly, we use your personal data for the following purposes:

• To respond to your enquiries and provide requested quotes or information.
• To provide and manage our cybersecurity and consulting services.
• For lead generation and business development.
• To deliver relevant website content and marketing communications (with your consent where required).
• To use data analytics to improve our website, products/services, marketing, customer relationships, and user experiences (UX).
• To prevent fraud, ensure network security, and maintain the integrity of our systems.
• To comply with legal or regulatory obligations.

6. Legal Basis for Processing

Under UK GDPR, we must have a valid lawful basis to process your personal data. We rely on the following bases:

• Consent: Where you have given clear consent for us to process your personal data for a specific purpose (e.g., subscribing to a newsletter, accepting non-essential cookies). You have the right to withdraw consent at any time.
• Legitimate Interests: Where it is necessary for our legitimate business interests (e.g., website analytics, fraud prevention, B2B communications), provided your fundamental rights do not override those interests. We conduct balancing tests to ensure your rights are protected.
• Contractual Necessity: Where processing is necessary for the performance of a contract to which you are a party, or to take steps at your request before entering into such a contract (e.g., providing a service quote).
• Legal Obligation: Where processing is necessary for compliance with a legal or regulatory obligation (e.g., tax records, regulatory reporting).

7. Special Category Data

We do NOT intentionally collect any Special Categories of Personal Data about you.

This includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data. Nor do we collect any information about criminal convictions and offences. If such data is accidentally provided to us (e.g., in a free-text form field), we will delete it immediately upon discovery.

8. Data Sharing & Third Parties

We may share your personal data with trusted third parties for the purposes set out in this policy. We require all third parties to respect the security of your personal data and to treat it in accordance with the law.

• Analytics Providers: Such as Google Analytics, to help us understand website traffic and usage.
• Advertising Platforms: Such as Google Ads and Meta, to deliver targeted advertising and measure campaign performance.
• Service Providers: Including CRM systems, email marketing platforms, payment processors, cloud storage, and hosting providers necessary to run our business.

We ensure that Data Protection Agreements (DPAs) are in place with our processors. If data is transferred outside the UK/EEA, we ensure a similar degree of protection is afforded to it by ensuring appropriate safeguards are implemented (such as UK International Data Transfer Agreements or Standard Contractual Clauses).

9. Cookies & Tracking

Our website uses cookies and similar tracking technologies to distinguish you from other users, provide a better experience, and improve our site.

• Essential/Necessary Cookies: Required for the website to function properly. Cannot be switched off.
• Analytics Cookies: Help us understand how visitors interact with the website.
• Marketing/Advertising Cookies: Used to track visitors across websites to display relevant advertisements.
• Preference Cookies: Allow the website to remember choices you make.

We require your explicit consent before placing non-essential cookies on your device. You can manage your preferences at any time. For detailed information, please read our Cookie Policy.

10. Data Retention

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting, or reporting requirements.

• Lead Enquiries: Retained for 12-24 months if no business relationship is formed.
• Customer Data: Retained for the duration of the service contract plus 6 years to comply with tax and legal obligations.
• Analytics Data: Retained for up to 26 months.
• Marketing Data: Retained until you withdraw your consent or opt-out.
• Financial Records: Retained for 6 years as required by UK law.

Upon expiration of these timeframes, your data will be securely deleted or anonymized.

11. Data Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorized way, altered, or disclosed. These measures include:

• Encryption of data in transit (HTTPS/TLS) and at rest.
• Strict access controls limiting data access to employees and contractors on a "need-to-know" basis.
• Regular security updates and vulnerability assessments.
• Ongoing staff training on data protection and cybersecurity best practices.
• A formal incident response plan to deal with any suspected personal data breach.

While we strive to protect your personal data, please note that no system or transmission over the internet is 100% secure.

12. Your Rights

Under UK data protection laws, you have specific rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you (we aim to respond within 30 days).
• Right to Rectification: Request correction of any incomplete or inaccurate data we hold about you.
• Right to Erasure (Right to be Forgotten): Request deletion or removal of personal data where there is no good reason for us continuing to process it (subject to legal exceptions).
• Right to Restrict Processing: Ask us to suspend the processing of your personal data in certain scenarios.
• Right to Data Portability: Request the transfer of your personal data to you or to a third party in a structured, commonly used, machine-readable format.
• Right to Object: Object to processing of your personal data where we are relying on a legitimate interest, or object to direct marketing.
• Right related to Automated Decision-Making: Not to be subject to a decision based solely on automated processing that produces legal or significant effects (we ensure human review).
• Right to Withdraw Consent: Withdraw consent at any time where we are relying on consent to process your personal data. This will not affect the lawfulness of any processing carried out before you withdraw your consent.

13. How to Contact Us

If you have any questions about this privacy policy, our privacy practices, or wish to exercise your legal rights, please contact us:

14. How to Complain

We would appreciate the chance to deal with your concerns before you approach the regulator, so please contact us in the first instance.

However, you have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues.

15. Policy Updates

We keep our privacy policy under regular review. This version was last updated on the date stated at the top of this page.

We may update this policy from time to time to reflect changes in our practices or legal requirements. If we make significant changes, we will notify you via our website or by email. We encourage you to periodically review this page for the latest information on our privacy practices.