Privacy Notice

1. Who we are

Sanderson has not appointed a statutory Data Protection Officer. Data-protection enquiries should be sent to the contact above.

2. Who this notice applies to

This notice covers prospective clients, client contacts and employees, training attendees, suppliers, contractors, advisers, business partners, website visitors and other business contacts connected with our services.

During an authorised security assessment we may encounter personal information held by a client. Where we process that information only on the client's instructions, the client will normally be the controller and Sanderson will act as its processor.

3. Information we may collect

We do not normally seek special-category or criminal-offence information for our own business purposes. It may occasionally be encountered incidentally during authorised client work.

4. Where information comes from

• directly from you when you email, call, meet us, complete a questionnaire or attend training;
• from the organisation you work for or another authorised client contact;
• from public business sources where relevant, such as company websites, professional profiles or Companies House;
• from approved suppliers and service providers involved in our operations;
• from systems, records and evidence made available during an authorised client engagement.

5. Why we use personal information

We only use personal information where we have a lawful basis. The bases most likely to apply are legitimate interests, contract, legal obligation and, where required, consent.

We do not sell personal information to advertisers or other organisations for their own marketing.

6. Client security data

Security work can expose us to personal information such as usernames, logs, account records, incident information or screenshots. We minimise what we copy, prefer references or redacted evidence where practical, and avoid placing passwords, recovery keys, authentication secrets or unnecessary personal data in reports.

7. Suppliers and sharing

Where necessary, information may be handled by approved services used to operate Sanderson, including Microsoft 365, HubSpot, Tide, Vercel, Cloudflare and professional advisers. Approved specialist subcontractors may also be used where an engagement requires additional expertise and the relevant client/security requirements permit it.

Information may also be disclosed where required or permitted by law, including to regulators, courts or law-enforcement bodies. Where suppliers process information for us, we expect appropriate contractual and security protections.

8. International transfers

Some technology suppliers may process information outside the UK. Where a restricted international transfer takes place, we use a transfer route permitted by UK data-protection law, such as applicable adequacy regulations or approved contractual safeguards.

9. Retention

When information is no longer needed, we delete it, anonymise it or securely dispose of it as appropriate.

10. How we protect information

Our controls include MFA and security-key authentication for important services, unique credentials and password management, controlled access to business files, restricted cloud sharing, data minimisation, backup controls, incident response and access-revocation procedures.

No security measure removes all risk. If we become aware of a personal-data breach, we assess it and take the notification or remediation steps required by applicable law.

11. Your data-protection rights

Depending on the circumstances and lawful basis, you may have rights to access, correct, erase or restrict personal information; object to processing based on legitimate interests; receive certain information in a portable format; and withdraw consent where consent is the basis used.

These rights are not absolute in every situation. To exercise a right, email contact@sandersoncyber.co.uk. We may need to verify your identity before disclosing or changing information.

12. Website, cookies and analytics

The current site does not intentionally use advertising trackers or non-essential analytics cookies. Hosting and security providers may process technical request information such as IP addresses and server logs to deliver and protect the website.

The enquiry form currently prepares an email in your own email application. Form contents are not submitted to or stored by the website itself. If we later introduce server-side forms, analytics or non-essential cookies, this notice and any required consent controls will be updated first.

13. Automated decisions and children

Sanderson does not currently make solely automated decisions about individuals that produce legal or similarly significant effects. Our services are aimed at businesses and organisations, not children, and we do not intentionally collect information directly from children through normal website or sales activity.