The
Cyber Advice Bureau

Overview

Cyber Advice Bureau (CAB) ask that you read this privacy notice carefully as it contains important information on who we are, how and why we collect, store, use and share information in relation to business partnerships where personal data is stored within CAB IT data systems. It also contains information about your rights in relation to your personal information and how to contact us and the Information Commissioner’s Office in the event you have a complaint. From 25 May 2018, CAB process’s your personal data in accordance with the General Data Protection Regulations (GDPR) and the Data Protection Act 2018. Our main establishment is based at: Sunderland, UK

 

Types of personal data we process 

We obtain personal data about you from the following sources: 

Direct from you via internet form submissions, sign up forms, business cards, emails, telephone or web enquiries, event attendance, enquiries, working with CAB in a contractual relationship, quotes and tenders etc. or from contract documentation completed and signed by yourselves and direct debit forms. Also, from third party sources, where we will always try to ensure that the third party has lawful authority to provide us with the data, for example referral from an external organisation, one of your colleagues or contacts. 

 

Special category of personal data (formerly known as sensitive personal data)

Limited amounts of special category of personal data may be held by CAB if it is a requirement due to the nature of the business and/or the relationship between the business. Categories of personal data include: 

1. names;

2. addresses;

3. telephone numbers;

4. e‐mail addresses and other contact details;

5. images;

6. audio and video recordings;

7. financial information;

In cases involving processing of special category of personal data CAB will gain explicit consent from the data subject. 

 

Why we hold and process personal data 

The first data protection principle requires that CAB must have a legal basis for processing your personal data. Under GDPR, these “legal basis” for processing conditions must be communicated to you, alongside the type of processing they relate to, as part of this privacy notice. As GDPR is a new law, the conditions identified below may be subject to change as more guidance is given or precedents are set. 

We store data so we can monitor our relationships with external organisations and clients to ensure a useful and accurate response is delivered in a timely manner. Without this data, we’re not able to manage our relationship or correspond with you regarding opportunities that may be of interest to you. 

CAB will process your data under the following legal basis: 

​

Registration and administration of business relationships.

1(a), (1)(b) and/or (1)(f) 

Management of enquiries 

1(a), (1)(b) and/or (1)(f) 

 

Administration of business activities

1(a), (1)(b) and/or (1)(f) 

Pursuit of social activities e.g. inviting partners to corporate events. 

1(a), (1)(b) and/or (1)(f) 

 

Management of projects and contracts including commissioned and collaborative projects, apprenticeship provision, educational courses, rental of learning facilities and consultancy. 

(1)(b) and/or (1)(f) 

 

How personal data is stored by CAB 

Personal data of our contacts within external organisations is stored in CAB secure data systems where appropriate technical and organisational security is in place to protect personal data. Access to personal data is restricted to those members of staff who have a requirement to maintain a relationship with you and is controlled through user security profiles. All CAB employees, contractors and volunteers that are given access to personal data receive mandatory Data Protection training and have a contractual responsibility to maintain confidentiality. 

 

When we will share personal data 

We do not share any personal data with 3rd parties, however on occasion CAB may be obliged to provide information to the police, local authorities or relevant government departments if it is deemed necessary under the appropriate exemption/derogation for the prevention or detection of crime. 

 

Transfer of data out of the European Economic Area (EEA) 

CAB do not transfer your personal data outside of the UK.

 

How long we retain your personal data

A retention schedule of personal data can be viewed at Appendix A 

 

Your rights 

1. Access to information - At any point you can contact CAB to request details concerning the information we hold about you, why we have that information, who has access to the information and where we got the information. In most cases you may be entitled to copies of the information we hold concerning you. Once we have received your request, we will respond within 30 days. 

2. Rectifying data - If the data we hold about you is out of date, incomplete or incorrect, you can inform us, and we will ensure that it is updated. 

3. Erasing data - If you feel that we should no longer be using your data or that we are illegally using your data, you can request that we erase the data we hold. When we receive your request, we will confirm whether the data has been deleted or tell you the reason why it cannot be deleted. 

4. Restricting processing - You have the right to request that CAB stops processing your data. Upon receiving the request, we will contact you to tell you if we are able to comply or if we have legitimate grounds to continue. If data is no longer processed, we may continue to hold your data to comply with your other rights. 

5. Data portability - You have the right to request that we transfer your data to another organisation. Once we have received your request, we will comply where it is feasible to do so. 

6. Object to direct marketing - All communication with you, including in relation to updates to this privacy notice, will be made via the preferred method of communication that you have registered with us and you will be able to select the type of correspondence you receive. If, at any stage, you are concerned about the content (e.g. unwanted marketing), frequency (too many) or method (change preference) of these communications, you can unsubscribe or notify us of your decision at any time. 

7. The right to object to automated decision making / profiling - You have the right not to be subject to automated decision making (making a decision solely based on automated means without any human involvement) and profiling (automated processing of personal data to evaluate certain things about the individual).

8. Withdrawing consent - In those cases, where we need your consent to process your information, we will ask you to make a positive indication (e.g. to tick a box or insert your contact details on the relevant form or web page requiring consent). By actively providing us with your consent, you are stating that you have been informed as to the type of personal information that will be processed, the reasons for such processing, how it will be used, for how long it will be kept, who else will have access to it and what your rights are as a data subject and that you have read and understood this privacy policy. Where processing is based on consent you have the right to withdraw consent at any time. 

 

Lodging a complaint with the Information Commissioners Office

Should you be dissatisfied with CAB's processing of your personal data, you have the right to complain to the Information Commissioner’s Office. For more information, please see the Information Commissioner’s web site: https://ico.org.uk/

 

Data Protection Officer 

If you have any questions which you feel have not been covered by this Privacy Notice, or if you have concerns or a complaint in relation to CAB processing your personal data, please do not hesitate to email us at cyberadvicebureau@outlook.com

This policy was approved on 20th May 2022 by CAB Senior Management Team. It will be reviewed in May 2023.

​

Appendix A – Retention Schedule

In compliance with CAB retention schedule will maintain a record for:

​

Enquiry Data

6 Months

​

Application data

6 Months

​

Financial Data

7 Years

 

Contract Data 

3 years past cessation of service