Cookie Policy

BACKGROUND:

SCH CREATE LTD, a company incorporated in England with registered number 16446599 and whose registered office is at 50 Geary Road, London, England, NW10 1HH, trading as UK Cyber Plan (“we/us/our”) understands that your privacy is important to you and that you care about how your personal data is used. We respect and value the privacy of everyone who visits this website, https://www.ukcyberplan.co.uk (“Our Site”) and uses our Services (hereinafter defined) and will only collect and use personal data in ways that are described here, and in a way that is consistent with our obligations and your rights under the law.

Please read this Privacy Policy carefully and ensure that you understand it.

1. Information About Us

Our Site is owned and operated by us.

Our Data Protection Officer is: Sapna Chadha

Email address: info@UKCyberPlan.co.uk.

2. What Does This Policy Cover?

This Privacy Policy applies to your use of Our Site. Our Site may contain links to other websites. Please note that we have no control over how your data is collected, stored, or used by other websites and we shall not be liable in any way for any such third-party data collection, storage, or use. We advise you to check the privacy policies of any such websites before providing any data to them.

3. What Is Personal Data?

Personal data is defined by the UK GDPR and the Data Protection Act 2018 and EU Regulation 2016/679 General Data Protection Regulation (where applicable to the storage, retention and processing of EU member’s personal data) (collectively, “the Data Protection Legislation”) as ‘any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier’.

Personal data is, in simpler terms, any information about you that enables you to be identified. Personal data covers obvious information such as your name and contact details, but it also covers less obvious information such as identification numbers, electronic location data, and other online identifiers.

4. What Are Your Rights?

Under the Data Protection Legislation, you have the following rights, which we will always work to uphold:

a) The right to be informed about our collection and use of your personal data. This Privacy Policy should tell you everything you need to know, but you can always contact us to find out more or to ask any questions using the details in Part 11.

b) The right to access the personal data we hold about you. Part 9 will tell you how to do this.

c) The right to have your personal data rectified if any of your personal data held by us is inaccurate or incomplete. Please contact us using the details in Part 11 to find out more.

d) The right to be forgotten, i.e. the right to ask us to delete or otherwise dispose of any of your personal data that we hold. Please contact us using the details in Part 11 to find out more.

e) The right to restrict (i.e. prevent) the processing of your personal data.

f) The right to object to us using your personal data for a particular purpose or purposes.

g) The right to withdraw consent. This means that, if we are relying on your consent as the legal basis for using your personal data, you are free to withdraw that consent at any time.

h) The right to data portability. This means that, if you have provided personal data to us directly, we are using it with your consent or for the performance of a contract, and that data is processed using automated means, you can ask us for a copy of that personal data to re-use with another service or business in many cases.

i) Rights relating to automated decision-making and profiling. The Cyber Readiness Check (as defined below) uses automated scoring as explained below, but We do not use automated decision making that produces legal or similarly significant effects upon you.

For more information about our use of your personal data or exercising your rights as outlined above, please contact us using the details provided in Part 11.

It is important that your personal data is kept accurate and up to date. If any of the personal data we hold about you changes, please keep us informed as long as we have that data.

Further information about your rights can also be obtained from the Information Commissioner’s Office or your local Citizens Advice Bureau.

If you have any cause for complaint about our use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office. We would welcome the opportunity to resolve your concerns ourselves, however, so please contact us first, using the details in Part 11.

5. What Personal Data Do We Collect and How?

We collect personal data only where necessary for the operation of Our Site, including where you contact Us, use the Cyber Readiness Check, request information from Us or choose to receive marketing communications. Our Site also uses cookies and similar technologies as explained in Our Cookie Policy.

Our Site collects certain information automatically, including your IP address, the type of browser you are using, timestamps, referrers and certain other non-personal data about your computer or device such as your operating system type or version, and display resolution.

If you contact us by letter, telephone, email or using any other communication method made available via Our Site, we may collect the following:

• your name,
• your email address,
• your company name,
• your telephone number
• your address,
• and any other information which you choose to give us.

For the purposes of the Data Protection Legislation, we are the data controller responsible for such personal data.

Our Site includes a short self-assessment tool known as the “Cyber Readiness Check”.

The Cyber Readiness Check allows you to answer questions about your organisation’s cyber security arrangements and receive an immediate general result.

You can complete the questions and view the immediate general result without providing your name or email address. If you choose to provide your email address to receive a fuller Cyber Readiness Summary, your email address will be associated with your answers and result.

When you use the Cyber Readiness Check, We may collect and process:

• your answers to the questions;
• the score, category or result generated from your answers;
• your email address, where you choose to provide it;
• the date and time on which the Cyber Readiness Check was completed;
• your communication and marketing preferences;
• details of any subsequent enquiry, request for further information or discovery call; and
• technical information such as your IP address, browser type, device information and referral source, where collected by Our Site.

We rely on our legitimate interests in operating Our Site, providing the Cyber Readiness Check, supplying information requested by users, responding to enquiries and developing Our services as the lawful basis for these activities. We have considered these interests against your rights and interests and will only use information in ways that you would reasonably expect in connection with your use of the Cyber Readiness Check.

6. How Do We Use Your Personal Data?

Where we collect any personal data, it will be processed and stored securely, for no longer than is necessary in light of the reason(s) for which it was first collected. We will comply with our obligations and safeguard your rights under the Data Protection Legislation at all times. For more details on security see Part 7, below.

If you contact us and we obtain your personal details from your email, we may use them to respond. The other technical data referred to above is necessary for the technical operation of Our Site and will not normally be used in any way to personally identify you.

We may use personal data collected through the Cyber Readiness Check to:

• operate the Cyber Readiness Check and generate your immediate result;
• prepare and send the fuller Cyber Readiness Summary that you have requested;
• respond to questions or requests made by you;
• provide you with a link or facility through which you may book a free 30-minute discovery call;
• arrange and provide a discovery call where you request one;
• maintain the security, availability and proper operation of Our Site;
• keep records of the consent and communication preferences you have provided; and
• improve the Cyber Readiness Check and Our services, using aggregated or anonymised information where reasonably practicable.
• The result provided through the Cyber Readiness Check is generated automatically by applying predetermined scoring rules to the answers you provide. This automated scoring is used only to provide an indicative and general assessment. It does not produce any decision that has legal or similarly significant effects upon you. The result does not constitute a formal cyber security audit, professional advice or confirmation of compliance with Cyber Essentials, ISO/IEC 27001 or any other legal, regulatory, contractual or certification requirement.

Completing the Cyber Readiness Check or providing your email address to receive your Cyber Readiness Summary will not, by itself, result in your email address being added to Our marketing list.

• If you separately choose to receive marketing communications, We may use your email address to:
  • contact you about your Cyber Readiness Check results;
  • invite you to book a free 30-minute discovery call; and
  • provide information about UK Cyber Plan’s cyber security services, guidance, news, events and offers.

Where We rely on consent, your consent is Our lawful basis for using your personal data for these marketing purposes. Providing consent is optional and will not affect your ability to receive your Cyber Readiness Summary.

You may withdraw your consent or object to receiving direct marketing at any time by using the unsubscribe link included in Our marketing emails or by contacting Us at info@UKCyberPlan.co.uk. Withdrawing consent will not affect the lawfulness of any processing carried out before consent was withdrawn.

7. How and Where Do You Store My Data?

We store some of your personal data in the UK and within the European Economic Area (the “EEA”). The EEA consists of all EU member states, plus Norway, Iceland, and Liechtenstein. This means that this personal data will be fully protected under the Data Protection Legislation or the EU GDPR and/or to equivalent standards by law.

Transfers of personal data to the EEA from the UK are permitted without additional safeguards.

Some of your personal data may be transferred to countries outside of the UK and the EEA through our use of cookies and analytics. These are known as “third countries”.

We will take additional steps in order to ensure that your personal data is treated just as safely and securely as it would be within the UK and the EEA and under the Data Protection Legislation as follows:

• your personal data will only be transferred to countries that are deemed to provide an adequate level of protection for personal data. For example we will only send personal data to entities within the United States America who are certified as adhering to the EU-U.S. Data Privacy Framework principles. For further information about adequacy decisions and adequacy regulations, please refer to the Information Commissioner’s Office; or
• we will use specific approved contracts which ensure the same levels of personal data protection that apply under the Data Protection Legislation. For further information, please refer to the Information Commissioner’s Office.

Please contact us using the details below in Part 11 for further information about the particular data protection safeguards used by us when transferring your personal data to a third country.

Personal data security is essential to us and to protect personal data, we take the following measures:

• limiting access to your personal data to those employees, agents, contractors, and other third parties with a legitimate need to know and ensuring that they are subject to duties of confidentiality;
• procedures for dealing with data breaches (the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, your personal data) including notifying you and/or the Information Commissioner’s Office where we are legally required to do so;
• We also use appropriate technical and organisational security measures, including strong authentication and multi factor authentication where available, password protected business accounts, access controls restricting personal data to those who require it, Microsoft 365 security controls including Microsoft Defender, appropriate endpoint protection, regular software and security updates, and secure cloud-based systems for the storage and handling of personal data.

We will retain personal data collected through Our Site and the Cyber Readiness Check only for as long as reasonably necessary for the purposes for which it was collected.

Unless We are required to retain the information for longer:

• answers, results and email addresses associated with a Cyber Readiness Summary will be retained for 24 months from completion of the Cyber Readiness Check or Our last substantive interaction with you, whichever is later;
• information relating to an enquiry or discovery call will be retained for 24 months after Our last substantive contact with you;
• marketing information will be retained until you withdraw your consent, object to receiving marketing or until 24 months have passed without any substantive interaction; and
• a limited record of an unsubscribe request may be retained for as long as reasonably necessary to ensure that your marketing preference continues to be respected.

Where information is no longer required, it will be securely deleted or anonymised.

8. Do You Share My Personal Data?

We will not share any of your personal data with any third parties for any purposes, subject to the following exceptions.

We may provide personal data collected through the Cyber Readiness Check to carefully selected service providers that support the operation of Our Site and services. These may include providers of:

• website and form hosting, including Webflow;
• email creation and delivery, including Microsoft 365;
• customer relationship management systems, including Zoho CRM;
• cloud storage, including Microsoft 365 SharePoint;
• analytics services, including Google Analytics; and
• other technology and service providers that may be required to support Our Site and services from time to time.

These organisations act as service providers or data processors on Our behalf. They may only use your personal data in accordance with Our instructions, for the agreed purposes and subject to appropriate contractual and security requirements.

If we sell, transfer, or merge parts of our business or assets, your personal data may be transferred to a third party. Any new owner of our business may continue to use your personal data in the same way that we have used it, as specified in this Privacy Policy.

In some limited circumstances, we may be legally required to share certain personal data, which might include yours, if we are involved in legal proceedings or complying with legal obligations, a court order, or the instructions of a government authority.

If any of your personal data is transferred to a third party, as described above, we will take steps to ensure that your personal data is handled safely, securely, and in accordance with your rights, our obligations, and the third party’s obligations under the law, as described above in Part 7.

If any personal data is transferred outside of the UK or the EEA, we will take suitable steps in order to ensure that your personal data is treated just as safely and securely as it would be within the UK and under the Data Protection Legislation or the EU GDPR, as explained above in Part 7.

9. How Can I Access My Personal Data?

If you want to know what personal data we have about you, you can ask us for details of that personal data and for a copy of it (where any such personal data is held). This is known as a “subject access request”.

All subject access requests should be made in writing and sent to the email or postal addresses shown in Part 11.

There is not normally any charge for a subject access request. If your request is ‘manifestly unfounded or excessive’ (for example, if you make repetitive requests) a fee may be charged to cover our administrative costs in responding.

We will respond to your subject access request within one month of receiving it.

Normally, we aim to provide a complete response, including a copy of your personal data within that time. In some cases, however, particularly if your request is more complex, more time may be required up to a maximum of three months from the date we receive your request. You will be kept fully informed of our progress.

10. How Do We Use Cookies?

Our Site may place and access certain Cookies on your computer or device.

All Cookies used by and on Our Site are used in accordance with current Cookie Law.

For more details, please refer to our Cookie Policy at https://www.ukcyberplan.co.uk/cookie-policy.

11. How Do You Contact Us?

To contact us about anything to do with your personal data and data protection, including to make a subject access request, please use the following details:

Email address: info@UKCyberPlan.co.uk.

Postal Address: 50 Geary Road, London, England, NW10 1HH.

12. Changes to this Privacy Policy

We may change this Privacy Policy from time to time. This may be necessary, for example, if the law changes, or if we change our business in a way that affects personal data protection.

Any changes will be immediately posted on Our Site. If the changes materially affect the way in which we collect, process, retain or store your personal data, you will be required to accept these revised terms. Any minor changes will be deemed to have been accepted on your first use of Our Site following the minor alterations. We recommend that you check this page regularly to keep up-to-date. This Privacy Policy was last updated on 9 September 2026.

‍