Skip to content
Ready to Start

Privacy Policy

Last updated: 15/09/2026

KIT365 Limited (“KIT365”, “we”, “us”, “our”) is committed to protecting the privacy and security of your personal data, in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This Privacy Policy explains how and why we collect and use personal data, who we share it with, how long we keep it, and what rights you have.

KIT365 Limited is a company registered in England and Wales with company number 10477067, registered office at Business Box, 3 Oswin Road, Leicester, LE3 1HR. We are registered with the Information Commissioner’s Office (ICO), registration number ZA792109.

This policy covers both visitors to our website (kit365.co.uk) and the clients and business contacts we work with in delivering our Cyber Essentials / Cyber Essentials Plus assessment, penetration testing, and GRC consulting services (together, the “Services”). For details on cookies specifically, see our separate Cookie Policy.

Who we are and how to contact us

Data Controller: KIT365 Limited

Address: Business Box, 3 Oswin Road, Leicester, LE3 1HR

Phone: +44 (0)333 242 0365

Email: [email protected]

For most of the personal data described in this policy, KIT365 is the Data Controller — we decide how and why it is processed. Where we process personal data on behalf of a client, in delivering the Services, we act as a Data Processor on that client’s instructions; this is covered further below and in our separate Data Processing Agreement (DPA) with that client, where one is in place.

What personal data we collect

We only collect the personal data we need. Depending on your relationship with us, this may include:

  • Name, job title, business email address and business phone number
  • Company name and business address
  • Correspondence and meeting records
  • Website usage data collected via cookies and similar technologies (see our Cookie Policy)
  • Where relevant to an assessment or engagement, information you or your organisation submit to us or to the IASME Portal (see below)

We do not collect special category data (such as health, racial or ethnic origin, or religious belief) or location-based data, and we do not knowingly collect personal data relating to children. We ask that clients do not submit special category data to us or to the IASME Portal unless strictly necessary and unavoidable.

How we use your personal data, and our legal basis

We use personal data for the following purposes:

  • To respond to enquiries and provide information about our Services (legitimate interests / steps taken at your request prior to entering a contract)
  • To deliver contracted Services, including Cyber Essentials / Cyber Essentials Plus assessments, penetration testing and GRC consulting (performance of a contract)
  • To administer client accounts, invoicing and general business administration (performance of a contract / legitimate interests)
  • To comply with our legal and regulatory obligations, including as an IASME-approved Certification Body assessor (legal obligation)
  • To send you information about our Services where you have agreed to receive it (consent), and you may withdraw this at any time
  • To maintain the security of our website and systems (legitimate interests)
Cyber Essentials / Cyber Essentials Plus assessments

Where you apply for a Cyber Essentials or Cyber Essentials Plus assessment, we use your name and business email address to set up your access to the IASME online assessment portal (the “IASME Portal”). You then enter your own assessment responses directly into the IASME Portal, which is operated by IASME as a separate controller/processor. Your data may be seen by the assessor during the assessment process, and will be used to generate your assessment account and invoice, to communicate with you about the assessment, and — once the assessment is complete — to remind you of your renewal date and any follow-up.

After your assessment is complete, we may ask your permission to use your data for publicity purposes (for example, a congratulations post on LinkedIn, or to give the UK government or IASME your details so they can contact you about publicity or research). We will only use your data for these purposes if you specifically agree, and you can withdraw this consent at any time.

Penetration testing

Penetration testing is scoped and carried out against your organisation’s systems, networks and applications, and is not intended to target or extract personal data. Personal data may, however, be incidentally encountered within testing evidence (for example, within log files, database records, file shares or screenshots) where it exists on, or is accessible from, the systems in scope. Any such data is handled in accordance with this policy and our information security controls, and is not reviewed or used beyond what is necessary to identify and report the relevant technical finding.

Who we share your data with — our sub-processors

We do not sell personal data, and we only share it with a small number of trusted service providers who process it on our behalf in order for us to deliver our Services (our “sub-processors”), or with third parties where you have specifically agreed to this, or where the law requires or allows it.

Our current sub-processors are:

  • Microsoft (Microsoft 365 — Exchange Online, OneDrive for Business, SharePoint Online) — for hosting and storing email, files and collaboration data
  • Xero — for accounting and invoicing
  • Halo (PSA) — for service and ticket management of client engagements
  • IASME — for operating the IASME Portal used for Cyber Essentials / Cyber Essentials Plus self-assessment (your assessment responses are entered by you directly into the IASME Portal and are also subject to IASME’s own privacy notice)

This list reflects our current sub-processors and is kept up to date on this page. Where we have a signed Data Processing Agreement in place with a client, we will also notify that client directly by email of any material change to this list, in accordance with the terms of that agreement.

We require all sub-processors to protect your data under terms no less protective than our own obligations, and we remain responsible for their handling of your data on our behalf.

Website infrastructure

Our website is built on WordPress and hosted with a UK-based hosting provider, which provides hosting infrastructure and security filtering (e.g. protection against malicious traffic) from a UK data centre. In doing so, our hosting provider processes limited technical data about website visitors — principally IP address and other standard web request data — for the purposes of securely and reliably serving the website, rather than for KIT365’s own purposes. This is separate from the sub-processors listed above, which process data in connection with our contracted Services.

If you contact us through our website’s enquiry form, your submission is sent directly to a KIT365 email address (hosted on Microsoft 365, as listed above) and is not otherwise stored by our hosting provider or WordPress. Further detail on cookies and similar technologies used on our website (including those used by WordPress, our hosting provider and other technical providers) is set out in our separate Cookie Policy.

International transfers

Your personal data is hosted, and processed, wholly within the United Kingdom and/or the European Economic Area (EEA). We do not currently transfer personal data outside the UK/EEA. If this were to change, we would first put in place an appropriate legal safeguard recognised under UK data protection law (such as the UK International Data Transfer Agreement/Addendum, the EU Standard Contractual Clauses, or an applicable adequacy decision) before making any such transfer, and we would update this policy accordingly.

How long we keep your data

We only keep personal data for as long as necessary for the purposes it was collected for, or as required by law or our professional obligations. Typical retention periods are:

  • Engagement records, reports and correspondence: up to 7 years from completion, in line with our professional, insurance and (for CE/CE+) certification-body record-keeping obligations
  • Penetration testing evidence (e.g. raw scan output, screenshots): retained for the same period as the related report, so that we can substantiate, defend or reproduce reported findings if later queried or disputed, after which it is securely deleted
  • General enquiry and marketing contact data: retained for as long as you remain engaged with us, or until you ask us to stop
  • Website usage data: as set out in our Cookie Policy

You can ask us to delete specific personal data earlier, and we will do so unless we have a legal or contractual reason to retain it.

Data security

We take the security of personal data seriously. We are certified to ISO/IEC 27001:2022 and Cyber Essentials Plus, and maintain technical and organisational measures appropriate to the risk, including:

  • Role-based, least-privilege access to personal data, secured with multi-factor authentication
  • Encryption of data at rest and in transit
  • Confidentiality agreements and security awareness training for our personnel
  • Endpoint security controls (e.g. antivirus, firewalls, patching)
  • Regular vulnerability scanning, penetration testing and security reviews of our own systems
  • A documented incident and breach management process
  • Backup and business continuity arrangements

If we become aware of a personal data breach affecting your data, we will notify you without undue delay, and will assist you (where you are the Controller) in meeting your own obligations to report breaches to supervisory authorities and affected individuals.

Your rights

Under the UK GDPR and the Data Protection Act 2018, you have the right to:

  • Be informed about how your personal data is used
  • Access the personal data we hold about you
  • Have inaccurate personal data corrected, or incomplete data completed
  • Have your personal data erased in certain circumstances
  • Restrict or object to processing of your personal data in certain circumstances
  • Data portability, in certain circumstances
  • Withdraw consent at any time, where we rely on consent to process your data

To exercise any of these rights, or if you believe the information we hold about you is incorrect, please contact us at [email protected]. If you are not satisfied with our response, you have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113.

Where we process personal data on behalf of a client as their Data Processor (for example, business contact data provided to us in connection with a client’s Services), that client is the Data Controller for that data, and requests to exercise your rights should generally be directed to them in the first instance; we will support our clients in responding to such requests.

Cookies

Our website uses cookies and similar technologies to support site functionality, understand how visitors use the site, and prevent spam. Full details of the cookies we use, their purpose, and how to manage your preferences are set out in our separate Cookie Policy, available at kit365.co.uk/cookie-policy-uk/.

Changes to this policy

We may update this Privacy Policy from time to time — for example, to reflect a change in our sub-processors, our services, or the law. We will update the “Last updated” date at the top of this page when we do, and where a change is material, and we have a signed Data Processing Agreement in place with a client, we will notify that client directly by email in accordance with the terms of that agreement.

Contact us

If you have any questions about this Privacy Policy or how we handle personal data, please contact our Data Protection point of contact at [email protected], or write to us at KIT365 Limited, Business Box, 3 Oswin Road, Leicester, LE3 1HR.

Secret Link