Privacy Policy

1. Who we are

Brightlock Cyber helps UK businesses and charities get ready for Cyber Essentials and meet basic UK GDPR duties. In this policy, "we", "us" and "our" mean Brightlock Cyber.

For the personal data described here, we are the controller. That means we decide how and why it's used, and we're responsible for looking after it.

• Legal name: [legal name of the business], trading as Brightlock Cyber
• Privacy contact: info@brightlockcyber.com

We have not appointed a Data Protection Officer, as the law doesn't require one for a business of our size and type. Please send any privacy question or request to the contact above.

2. What we collect

We only collect personal data that you choose to give us through the forms on this website. Each form says what it's for.

Apart from your account password, which goes straight to Wix and which we never see, we don't ask for, and you shouldn't send us, passwords, bank details or special category data such as health information. Our hosting provider also keeps standard technical logs, such as IP addresses and browser type, to keep the site secure and working.

3. Why we use it, and our lawful basis

UK GDPR requires a lawful basis for each way we use personal data. Ours are:

Automated scoring

Your health check score is worked out automatically from your answers. It's guidance only and doesn't lead to any decision with legal or similarly significant effects on you, so it isn't automated decision-making under UK GDPR.

4. Who we share it with

We never sell your data or share it for other organisations' marketing. We only share it with service providers that help us run the website, and only as much as they need:

• Wix.com hosts our website and stores form submissions and contact details for us, as our processor under a data processing agreement.
• Google Public DNS and Cloudflare: when you use the email spoofing check or the automatic domain checks in the readiness report, your browser looks up the public records of the domain you enter through these services. They receive the domain name and, like any website you visit, your IP address. We don't receive or store what you type.
• rdap.org and domain registries: the readiness report's domain checks look up your domain's public renewal date. The report also loads your own website's home page once to check it uses a secure connection.

We may also share information if the law requires it, or to protect our rights or the safety of others.

5. International transfers

Some of our providers store or process data outside the UK. When that happens, the transfer is protected by UK adequacy regulations, which recognise the destination's protections as adequate, or by approved contract terms such as the UK International Data Transfer Agreement or Addendum. You can ask us for more detail.

6. How long we keep it

• Health check results, renewal reminders and partner enquiries: up to 12 months after our last contact with you.
• Scam alert and marketing emails: until you unsubscribe. After that we keep only your email address on a "do not contact" list, so we don't email you again by mistake.
• Your account: until you ask us to close it. Records of what you bought are kept for 6 years after the purchase, because tax law requires it.
• Technical logs: for as long as our hosting provider needs them for security, usually a few weeks.

You can ask us to delete your data sooner at any time.

7. How we protect it

We practise what we preach. Our website is served over an encrypted connection, our accounts are protected by multi-factor authentication, and only people who need access to your data have it. No system is completely secure, but if a breach ever affected your data and put you at high risk, we would tell you without undue delay.

8. Cookies and browser storage

We don't use advertising, analytics or tracking cookies. The site uses your browser's own storage for a few things that are needed for it to work:

• Your health check and readiness report answers, so you don't lose your place
• Your compliance pack details, action plan progress, score history and certificates
• Staff training progress and the names of people who passed, for your sign-off sheet
• Your ticks on the printable checklist, and your notes on the "Think you've been hacked?" page
• Separate reports for each business, if you turn on multi-business mode
• Your business name and logo, if you add branding for printed reports
• The names and dates of staff who've signed your security rules
• Your latest Microsoft 365 or Google Workspace check results, including the names of any accounts that need attention, until you delete them
• Your latest domain check results, for up to a week
• Sign-in and purchase details, so the products you've bought stay unlocked
• A technical token that lets our forms send your details securely
• Remembering that you closed the announcement bar

If you're not signed in, this information stays on your device, and you can move it yourself using "Save or move" in your report.

If you sign in to a Brightlock account, your saved work (everything in the list above except your sign-in details, the form token and the announcement bar) is also copied to your private account, stored by Wix, our website provider, so it's the same on every browser and device you sign in on. Only you can read it through the site. As the site owner we could technically access it, but we only look if you ask us for help. Your free health check answers and any PHP code you check are never copied. Signing out stops syncing on that device. To delete your saved account data, email us at info@brightlockcyber.com and we'll delete it within 30 days.

Our hosting provider may also set strictly necessary cookies to keep the site secure. Because all of these are essential to provide what you ask for, they don't need your consent. You can clear them in your browser settings at any time.

9. Your rights

Under UK data protection law you have the right to:

• Access the personal data we hold about you and get a copy
• Correct anything that's wrong or incomplete
• Delete your data in some circumstances
• Restrict how we use it in some circumstances
• Object to our use of it, including any marketing
• Move data you gave us to another organisation
• Withdraw consent at any time, without affecting anything we did before

To use any of these rights, contact us at info@brightlockcyber.com. It's free, and we'll reply within one month. We may need to confirm your identity first. To stop marketing emails straight away, use the unsubscribe link in any email.

10. Complaints

If you're unhappy with how we've handled your data, please tell us first at info@brightlockcyber.com. We'll acknowledge your complaint within 30 days and let you know the outcome without undue delay.

You also have the right to complain to the ICO (the Information Commission), the UK's data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113.

11. Other information

Children

Our services are for businesses and charities, not children, and we don't knowingly collect children's data.

Links to other websites

We link to other sites, such as the NCSC, the ICO and Report Fraud. Their own privacy policies apply when you visit them.

Tools that connect to other services

The leaked password check sends only the first 5 characters of a scrambled (hashed) version of the password to Have I Been Pwned. The password itself never leaves your device, and we don't receive it.

The Microsoft 365 and Google Workspace check asks you to sign in with Microsoft or Google, who give your browser a short-lived, read-only key. Your browser uses it to read your settings directly from Microsoft or Google. Nothing is sent to us, and the key isn't stored.

The PHP code check runs entirely in your browser. Code you paste or add is never sent to us or anyone else. If you go to checkout or sign in partway through, it's kept in that browser tab so you don't lose it, and cleared when you close the tab.

Staff sign-off links contain your staff security rules, your business name and the name of the person signing. They're shared only by the people you send them to, and we don't receive them.

Changes to this policy

We'll update this policy when our services change, for example when paid reports launch. The date at the top shows when it last changed, and we'll tell you about any significant change that affects you.