Privacy notice
How we collect, use and protect personal data when you use the readiness check or ask us to manage your Cyber Essentials certification.
Who we are
PassCyber is a trading name of Edwards Bros (Spaldwick) Ltd, which is the data controller for the personal data described here. We are registered in England and Wales, company number 00598511. Our registered office is Fenland House, 15b Hostmoor Avenue, March, Cambridgeshire PE15 0AX. We are registered with the Information Commissioner's Office, registration ZA900683.
For any question about your data, contact us at hello@passcyber.co.uk.
What we collect
If you use the free readiness check, we collect the answers you give about how your organisation runs its computers, together with the contact details you provide so that we can send you the result.
If you email us, we hold your contact details and whatever you tell us.
If you engage us to manage a certification, we collect the information the assessment requires: your organisation's details, a description of your devices, networks and cloud services, the names and roles of the people who use them, and the technical configuration information needed to answer the question set accurately.
The site is hosted by Vercel Inc., which keeps standard server logs including IP addresses for security and operational purposes. The site loads fonts from Google Fonts, which means Google receives your IP address when your browser requests those files. We do not run advertising trackers.
A note on security information
Preparing a Cyber Essentials submission means we learn things about how your organisation is defended. We treat that information as confidential. We do not ask for and do not want your passwords, and we will never ask you to give us access to a system in order to complete an assessment. Information gathered for an assessment is used only for that assessment.
Why we are allowed to use it
Where you use the readiness check or make an enquiry, we rely on our legitimate interest in responding and running the business. Where we are managing your certification, we rely on the performance of our contract with you. Where we must keep records for tax and accounting purposes, we rely on our legal obligations.
Who we share it with
To obtain your certificate we submit your answers to a certification body accredited by IASME, which assesses them and issues the certificate. That is the purpose of the engagement and we cannot deliver it otherwise. We will tell you which certification body we are using.
We use a small number of service providers to run the business — email and file storage, accounting software, and website hosting — and those providers process data on our behalf under their own contractual obligations. We do not sell personal data and we do not share it for marketing.
How long we keep it
Readiness check results and enquiries that do not lead to work are deleted within twelve months. Where we manage a certification, we keep the file for six years from the end of the engagement to meet business and tax record requirements, and because it is the basis of your annual renewal.
How we protect it
We work to the Cyber Essentials technical controls ourselves. Multi-factor authentication is enabled on every cloud service we use, devices use separate administrator and standard accounts, and access to client information is limited to the person doing the work.
Your rights
You have the right to ask for a copy of the personal data we hold about you, to have it corrected, to ask us to delete it, to object to or restrict how we use it, and to receive it in a portable format. To exercise any of them, email hello@passcyber.co.uk. We will respond within one month.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you raised it with us first so that we can put it right.
Changes
We update this notice when our practices change. The date above shows when it was last revised.