Legal
Privacy notice
For the Cyber Essentials assessment at bluewaterassociates.co.uk.
Who is responsible for your data
Bluewater Associates Ltd is the data controller for the information you enter here. If you have a question about how we handle it, call 0800 088 4711 or write to us and ask for the data protection contact.
What we collect
Your name, work email and job title; your organisation’s registered details; and the technical information you enter about sites, devices, servers, cloud services and user accounts. Some of that is personal data — for example the names of staff attached to devices or user accounts.
Why we collect it
To prepare and submit a Cyber Essentials self-assessment on your behalf, and to give you the readiness report. Our lawful basis is legitimate interest in providing the service you asked for, and performance of a contract once you engage us.
Who we share it with
Your submitted assessment is shared with IASME, the Cyber Essentials accreditation body, solely to process your certification. We use Resend to deliver email. We do not sell your data, and we do not use it for advertising or share it with anyone else.
Where it is held
Your data is held in the UK or EU. It is encrypted in transit, and each assessment is isolated so one client can never read another’s. Access links are single-purpose, time-limited and tied to your email address.
How long we keep it
For the life of your certification plus six years, so we can support renewals and meet our own record-keeping obligations. Abandoned assessments with no engagement are deleted after twelve months. Ask us to delete yours sooner and we will, unless we are legally required to keep it.
Your rights
You can ask for a copy of your data, ask us to correct it, ask us to delete it, or object to how we use it. Contact us and we will respond within one month. If you are not satisfied you can complain to the Information Commissioner’s Office at ico.org.uk.
Cookies
We set one cookie: a sign-in cookie that keeps you logged into your own assessment. It is strictly necessary, so it needs no consent banner. There is no analytics or advertising tracking on the assessment itself.