Who we are
Cybercontrols.io Ltd (registered in England and Wales, company number 14513536; VAT number 459 2997 28), trading as Cybercontrols.io, with its registered office at 3 Nursery Gardens, Morpeth, Northumberland, NE61 6FP, is committed to protecting and respecting your privacy rights. We are registered with the Information Commissioner's Office in the United Kingdom under registration number ZB522313.
This Privacy Notice (the "Notice"), together with any disclaimers, sets out the basis on which any personal data we collect from you, that you provide to us, or that is provided to us relating to you ("Personal Data"), by any means, will be processed by us. Please read the following carefully to understand our practices regarding your personal data and how we will treat it. This Notice relates only to living individuals, in respect of personal data relating directly to themselves and not to persons in any other capacity, and is provided to you in line with the UK GDPR and the EU GDPR.
For the purposes of the Data Protection Laws, Cybercontrols.io acts as a Data Controller when acting as an employer and when dealing with suppliers, and as a Data Processor when providing services to its clients. Your relationship with us will determine whether we are acting as a Data Controller or a Data Processor.
If you have any questions in relation to this Privacy Notice, or wish to exercise your rights under it, please contact our Privacy Compliance Co-ordinator at hello@cybercontrols.io.
Our EU Representative under Article 27 of the GDPR is Arian Sheremeti, with a registered address at Karel Martelstraat 8, 1000 Brussels, Belgium. He serves as our contact point within the EU/EEA regarding any data protection matters. For enquiries relating to our data processing activities within the EU/EEA, please contact him at arian@cybercontrols.io.
Personal Data we collect from you
We collect Personal Data which you volunteer when you provide it to us or through the services with which you interact. We may also be given personal data relating to you by other persons, or obtain it in the course of our legitimate business activities.
In the course of providing services we may collect and process personal data, which could include special category data, such as: your full name; your address; your email addresses; your phone numbers, including mobile numbers; your occupational information; other information you provide to us, for example through our "Talk to Us" feature; and any other personal data which you ask us to process on your behalf or which is necessary for us to process in order to provide our services to you. We may also process other data which is not personal data.
When you access our website, your device's browser provides us with information such as your IP address, browser type, access time and referring URL, which is collected and used to compile statistical data. This information may be used to help us improve our website and the services we offer. See also our Cookie Policy.
Personal Data we obtain from others
When you use our services we may obtain personal data from others, including your authorised representatives. If you are an employee of one of our clients, we may obtain your personal data from your employer and process it on your employer's behalf in the context of supplying our services.
If you provide us with personal data about someone else, for example one of your employees, you are responsible for ensuring that you comply with all obligations, particularly any consent obligations, under the Data Protection Laws in relation to that disclosure. In so far as required by the Data Protection Laws, you must ensure you have a lawful basis to provide us with the information, and that you explain to them how we collect, use, disclose and retain their personal data, or direct them to this Privacy Notice.
Security and where we store your data
We are committed to protecting the security of your personal data and use a variety of security technologies and procedures to help protect it from unauthorised access and use. As effective as modern security practices are, no physical or electronic system is entirely secure. We cannot guarantee the complete security of our databases, nor that information you supply will not be intercepted while being transmitted to us over the internet. We continue to revise our policies and implement additional security features as new technologies become available.
The transmission of information via the internet may involve the transfer of Personal Data to countries outside the UK and the European Economic Area (EEA), typically through the use of cloud solutions for web hosting, email hosting or software delivered through the cloud. We do not authorise any third party to use your Personal Data for their own purposes. Non-EEA countries may not provide an adequate level of protection in relation to the processing of your personal data; where such transfers occur, we rely on the safeguards described under international transfers below. Any transmission of Personal Data is at your own risk; once we receive it, we apply appropriate security measures to seek to prevent unauthorised access.
Uses made of your Personal Data
We, or service providers acting on our behalf, may use the information collected from and about you to:
- provide our products and services, including completing a transaction you requested, and set you up as a customer on our systems;
- create a candidate profile if you are a prospective employee, and process employment applications, including assessing qualifications, verifying information and conducting reference or other employment-related checks;
- conduct due diligence in accordance with legal or regulatory obligations;
- send promotional materials, alerts regarding available offers and other communications, and communicate about and administer participation in special events, promotions, programmes, offers, surveys and market research;
- respond to enquiries from you and other third parties, including enquiries from law enforcement agencies;
- ensure payment of our invoices;
- administer and improve our website and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes, and as part of our efforts to keep our website safe and secure;
- operate, evaluate and improve our business, including developing and enhancing our services, managing our communications, performing data and statistical analytics, and performing accounting, auditing and other internal functions;
- protect against, identify and prevent fraud and other unlawful activity, claims and other liabilities;
- hold your personal data on our client management systems and provide you with marketing information about similar services to those you have engaged us to provide, which we feel you might find useful, with the opportunity to opt out at any time;
- comply with and enforce applicable legal requirements, relevant industry standards, contractual obligations, our terms of service and other policies; and
- use it in other ways for which we provide specific notice at the time of collection.
Legal bases for processing
- Processing necessary for the performance of a contract which you have entered into with us, or to take steps at your request prior to entering into a contract.
- Your consent to processing for one or more specified purposes, for example where you consent to receiving marketing material or to photographs being taken and used.
- Processing necessary for compliance with a legal obligation to which we are subject.
- Processing necessary for the purposes of the legitimate interests we pursue, for example in providing you with quotes and proposals about our services prior to contract, where those interests are not overridden by your interests or fundamental rights and freedoms.
- Where we act as a processor for your employer, who will have a separate legal basis for the processing of your personal data.
Special category data
The processing of your personal data may include data relating to your health and wellbeing, or other data regarded as special category data under the GDPR. The legal bases for processing special category data are that you have explicitly provided consent, or that processing is necessary for compliance with a legal obligation to which we are subject. Where special category data is collected, explicit and informed consent is obtained at the point of collection and can be withdrawn at any time by contacting our Privacy Compliance Co-ordinator at hello@cybercontrols.io.
Our services and how long we keep your data
Our services include the provision of IT and cyber security services and consultancy services. We may use your Personal Data to send you information relating to our services, events and products which may be of interest to you; if you do not want us to use your personal data in this way, please notify us using the contact details at the end of this Notice.
We keep your personal data for as long as is necessary for the performance of the contract between you and us, and to comply with our legal obligations. If you request the erasure of your personal data, please note that we may retain some of it as necessary for our legitimate business interests, such as fraud detection and prevention; we may retain and use some of it to comply with legal obligations, for example tax, legal reporting and auditing obligations; and because we maintain our records to protect against accidental or malicious loss, residual copies may not be removed from our backup systems for a limited period.
Automated decision-making
You will not be subject to decisions that have a significant impact on you based solely on automated decision-making.
Links to other sites and social networks
Our website may contain links to and from other websites. Those websites have their own privacy notices, and we do not accept any responsibility or liability for them; please check those policies before you submit any Personal Data to those websites. We also maintain active social network accounts and may embed widgets from these networks, which can result in cookies being set by those networks while you use our site. You may set your browser to refuse cookies or to alert you when cookies are being sent.
Who we share your data with
We share your personal data where necessary to provide you with our services. In addition, we may disclose your personal data to third parties where we are under a duty to disclose or share it in order to comply with any legal obligation, to enforce or apply our terms of use and other agreements, or to protect our rights, property or safety, or those of others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.
We may share your information with selected third parties, including business partners, suppliers and sub-contractors for the performance of contracts; third parties with whom we need to share your information to facilitate transactions you have requested, or with whom you ask us to share it; statutory and regulatory bodies, including central and local government, and law enforcement authorities, in order to comply with applicable laws, grant applications or court orders; and service providers and sub-processors who provide services to us, including marketing, website and online platforms.
| Category | Provider |
|---|---|
| Cloud providers | |
| Web hosting | NameCheap |
| Invoicing | Xero |
| Marketing and CRM | HubSpot |
| Email services | Google Mail |
The table above lists some of the entities with whom your personal data is shared; a full list is available on request.
International transfers
We make use of services provided by third parties for the delivery of our services, which may necessitate the transfer of personal data outside the UK and EU/EEA, for example through cloud-based tools such as Google. Where personal data is transferred or processed outside the UK and the EU/EEA, we choose providers who process Personal Data on the basis of Standard Contractual Clauses (SCCs), the UK International Data Transfer Agreement (IDTA), or an adequacy decision.
Your rights
Under the Data Protection Laws you have certain rights, which apply in certain circumstances: the right of access to Personal Data relating to you; the right to rectification; the right to object to processing; the right to restriction of processing; the right to erasure; and the right to data portability. You may exercise any of these rights by emailing hello@cybercontrols.io. The exercise of these rights requires us to be satisfied of the identity of the person making the request, so we may ask you to verify your identity before we act on it.
In the UK you also have the right to complain to the Information Commissioner's Office: ico.org.uk/for-the-public, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, telephone 0303 123 1113. In the EU you may lodge a complaint with your local supervisory authority. Where our processing is based on your consent, you have the right to withdraw that consent at any time; processing carried out before you withdrew consent remains lawful.
Marketing communications
If you no longer wish us to contact you in a particular way, just tell us and we will respect your wishes. It may still be necessary for us to contact you from time to time in connection with our services, for example to ensure your Personal Data is correct. To stop receiving marketing communications by electronic means, use the opt-out facility in any of our communications or contact hello@cybercontrols.io to opt out of marketing.
Changes to this Notice
We reserve the right to change this Notice from time to time. If we make any changes, we will post them here so that you can see what information we gather, how we might use it and in what circumstances we may disclose it. By continuing to use our site or our services after we post any changes, you accept and agree to them.
Contact us
Questions, comments, requests and complaints regarding this Notice and the personal data we hold are welcome and should be addressed to the Privacy Compliance Co-ordinator at hello@cybercontrols.io. All requests will be dealt with promptly and efficiently.