Privacy Overview

Data Security and Compliance Services Ltd T/A ‘Get Cyber Certified’ has made information security and data privacy principles the foundation of everything we do, and we recognise the importance of passing regulations to advance information security and data privacy for citizens of the EU. We take special pride in our role in helping Clients get ready for GDPR and demonstrating how our products help to provide a more secure environment for our customers.

How we handle our customers privacy

This document is an overview of how we handle privacy and includes:

The types of information we collect
How we collect and use it
Who we might share it with
The steps we’ll take to make sure it stays private and secure
Your rights to your information

Who we are

When we say ‘we’, ‘us’ or ‘our’, we mean Data Security and Compliance Services Ltd or Get Cyber Certified who is the ‘data processor’ for the information in this overview. When we say ‘you’ or ‘customer’ we mean the company or client we are providing services to, which may include employees of the company we are providing services and information provided by the customer who, being a company would have a person responsible as the ‘Data Processor’ who is responsible for deciding how we can use the information we hold. When we say ‘customer data’ this means files and documents owned by the customer.

The information we collect

We collect information from different places including:

Directly from our customers and our customers employees
From our customers IT and business systems and computers (from our Customers IT

Infrastructure and business Systems)

From publicly available sources
When we generate it ourselves
From other organisations

We’ll only collect information in line with relevant regulations and law and this may relate to any of our products or services our customers enquire about, are able to receive, currently hold or have held in the past.

Our customers data processor is responsible for making sure our customers give us accurate and up to date information.

The types of data we process

Depending on the Offering chosen by the customer, we will process on behalf of the customer the following personal data:

First Name
Last Name
Mailing Address
Email Address
Business Phone
Mobile Phone
Home or personal phone
Computer Name
Computer IP address
Computer MAC address
Computer access password

In addition, we may process, under the terms as detailed in our general terms and conditions, personal data which the customer elects to host with or upload to us in connection with the our provision of services to our customers. Our systems hold logs of customer data and use, we keep these logs for a reasonable amount of time to help troubleshooting issues. These logs are not passed on or sold.

How we’ll use the information

We’ll use it to provide any products and services our customer has requested and other purposes including:

To confirm your identity and address
To understand how our customers, use our services
To carry out our customers instructions and deliver services
To improve our products and services
To offer other services which we believe may benefit our customers unless you ask us not to.

We’ll only use our customers information where we’re allowed to by law e.g. carrying out an agreement and providing services for our customers, fulfilling a legal obligation, because we have a legitimate business interest or where our customers agree to it.

What we do to ensure our customers information is safe

Any suppliers who we share personally identifiable information with have given their assurance of their commitment to the GDPR and the requirements contained therein.

When choosing new suppliers, we look for suppliers who have achieved ISO27001, Cyber Essentials, Cyber Assurance, Privacy Shield or another related certification or that can demonstrate competence and adherence to good privacy and security standards.

As a Government accredited certification body for IASME/Cyber Essentials, we undergo stringent annual inspections. This is not only part of our commitment to attaining the highest levels of Cyber Security for our clients and the information we hold, it is also needed to allow us to assess other businesses regarding their levels of cyber security, GDPR readiness and to issue IASME certificates to show our clients have attained the Government approved level of security.

We have achieved Cyber Essentials, Cyber Assurance Levels 1 and Cyber Assurance Level 2 status showing that procedures, processes and systems we have in place not only meet the UK Government endorsed IASME/Cyber Essential Standards but surpass it to level 2 standard.

A few of the physical measures we take are:

All devices we use to store information are encrypted,
Our business systems are both encrypted and protected by two (and three) factor authentication meaning that we need to pass at least 2x security challenges to gain access to business systems.
Our assessors use password management systems which means that longer, unguessable passwords can be used.
All firewalls are regularly patched and checked to ensure that life cycle policies are adhered to.
Our staff have certified training in relation to Cyber Security.
That’s not to mention our perimeter security and building two factor authentication, razor wire and guard dogs, okay we don’t have guard dogs.

The above lists 6 of the 165 methods incorporated to fulfil our IASME/Cyber Essentials standards. We’re not giving anything away as these are publicly available. There are many other ways that we protect ourselves and our client’s information which are best kept to ourselves to keep our security, well, secure.

Who we share your information with

We may share our customers information with other companies we work in partnership with. These include carefully selected suppliers who provide our warranty support, updating, business systems and storage systems. Our customers can request a list of the suppliers we use to process personal data.

We also use 3rd party suppliers to provide platforms to store and manage our customers data. For example, we use Microsoft’s Azure cloud systems and the Microsoft 365 platform to store our customer information and data, as a supplier we have ensured that the customer data stored with Microsoft is encrypted, stored in the EU and not stored for longer that is needed. Our customer data belongs to our customers and as such we don’t store it for anything other than providing specific storage services (such as backup).

We don’t share our customers information with any parties other than for the provision of services to the customer or to improve our products or services. We apply the same methodology for all our suppliers.

How long we’ll keep information

We’ll keep our customers information and customers data for as long as our customer has a relationship with us. After it ends we’ll keep it for a pre-defined period thereafter and where we may need it for our legitimate purposes e.g. to help us respond to queries or complaints, or for other reasons e.g. fighting fraud, crime, and responding to requests from regulators.

The types of data we keep and how long we keep it:

Data Type:

Customer Information

Summary of what this may contain

Customers business address, service users details, usernames, email addresses, passwords, IP addresses, system details, contact details including (where needed for service) home address and personal contact details.

Retention period

5 years

Reason for retention

Sometimes customers ask for information after moving to another provider. Many customers come back to Get Cyber Certified when the contract with a replacement provider ends, keeping the information on file helps the migration process. We’ll also use the information to inform around new products and services which may help the customer.

Transferring your information overseas

Your information may be transferred and stored in countries outside the European Economic Area, including some that may not have laws that provide the same level of protection for personal
information. When we do this, we seek confirmation from the supplier that they have the appropriate levels of protection. This can include membership of EU-US Privacy Shield and other international data privacy arrangements.

Your rights

Our customers have rights relating to their information e.g. to see what we hold, to ask us to share it with another party, ask us to update incorrect or incomplete details, to object to or restrict processing of it please email team@getcybercertified.co.uk or contact the person responsible for data as detailed at the bottom of this page.

You have the right to lodge a complaint with the Information Commissioners Office (ICO) if you believe your data has been processed in a way that does not comply with the GDPR. You can do so by calling the ICO helpline on 0303 123 1113 or via their website.

Our contact information

The person responsible for data protection is:

Mark Kindred
Data Security & Compliance Services Ltd
SilverStamp House
Club Mill Road
Sheffield
S6 2FH

Email: team@getcybercertified.co.uk

Tel: 0333 339 0383