Privacy Policy

Last updated: 9 June 2026

At Black Swan Cyber Security Solutions, we take your privacy seriously. We do not sell or rent your personal data. We only share it where needed to run our business, provide our services, meet legal duties, protect our systems, or work with trusted service providers.

This Privacy Policy explains:

• what personal data we collect;
• why we collect it;
• how we use it;
• who we may share it with;
• how long we keep it for;
• how we keep it safe; and
• what rights you have under UK data protection law.

Who we are

Bitz 'n' PC'z Ltd T/A Black Swan Cyber Security Solutions is the Data Controller for the personal data described in this policy. This means we are responsible for deciding how and why your personal information is used.

Registered office: Unit 50 Clocktower Business Centre, Works Road, Hollingwood, Chesterfield, S43 2PE
Email: hello@blackswancyber.co.uk
Phone: 01246 927142

What personal data we collect

1. Website cookies, analytics and similar technologies

We use cookies and similar technologies to make our website work, keep it secure, understand how visitors use it and improve our content.

These tools may collect:

• IP address or approximate location information;
• device and browser type;
• pages visited;
• how long visitors stay on pages;
• links clicked;
• scrolling and page interaction data;
• technical information about how the website performs.

We currently use tools including:

• Google Analytics – to understand how visitors use our website;
• Microsoft Clarity – to understand how visitors interact with pages and identify usability issues.

Some cookies are necessary and do not require consent. Some low-risk analytics or functionality cookies may be used where the law allows. We will ask for consent before using cookies or similar technologies for advertising, profiling, remarketing or similar tracking.

You can control cookies through our cookie banner where available, and through your browser settings.

2. Mailing lists and email updates

When you sign up to receive updates, guides, downloads, newsletters or similar content from us, we may collect:

• your name;
• your email address;
• your business name, where provided;
• your communication preferences;
• information about whether you open or click our emails.

We use this information to send you useful cyber security updates, practical guidance, event information, service news and relevant business-to-business communications.

Our emails are sent using GoHighLevel. This may show us whether emails are opened, links are clicked or forms are completed, so we can understand what content is useful and improve our communications.

You can unsubscribe from marketing emails at any time by clicking the unsubscribe link in our emails or by contacting us directly.

3. Enquiries and contact forms

If you contact us through our website, by email, by phone, through social media, at an event, or through a referral partner, we may collect:

• your name;
• your email address;
• your phone number;
• your organisation name;
• your role or job title;
• the content of your enquiry;
• any information you choose to provide about your organisation, systems, cyber security needs or compliance requirements.

We use this information to respond to your enquiry, provide information you have asked for, arrange calls or meetings, and keep appropriate records of our communications.

4. Customer and client information

If you purchase services or products from us, or if we provide advice, support, cyber security services, compliance support or related work to your organisation, we may collect:

• name, email address and phone number;
• business name and address;
• billing and payment information;
• contract and service details;
• support requests and service notes;
• information about your systems, devices, accounts, licences, security tools or compliance position;
• records of meetings, calls, emails and agreed actions.

We use this information to deliver and manage our services, communicate with you, keep business records, meet contractual obligations, provide support, and maintain records for billing, tax and legal purposes.

5. Payment details

We use Stripe to process payments securely. Stripe may process payment information including:

• card number;
• expiry date;
• CVC;
• billing name and address;
• payment status and transaction details.

We do not store your full card details ourselves. We may be able to see limited payment information through Stripe, such as payment status, transaction reference, card type and the last four digits of the card.

Stripe acts as an independent controller for some payment processing activities and processes personal data in line with its own privacy policy. You can read Stripe’s Privacy Policy here: https://stripe.com/gb/privacy

6. Cyber security and technical information

Because we provide cyber security services, we may process technical information when delivering services, responding to enquiries, investigating issues or protecting our own systems.

This may include:

• IP addresses;
• domain names;
• email headers;
• device names;
• system logs;
• security alerts;
• vulnerability or configuration information;
• information provided to us for cyber security reviews, audits, reports or support requests.

We only use this information where needed to provide services, protect systems, investigate security issues, meet legal obligations, support compliance work, or protect our clients, our business or others.

Lawful basis for processing your data

We process personal data under the following lawful bases:

Legitimate interests

Where we rely on legitimate interests, we only do so where we have a business, security or operational reason to use personal data and where we believe this is not overridden by your rights and freedoms.

Our legitimate interests may include:

• responding to enquiries;
• keeping appropriate business records;
• protecting our website, systems and services;
• detecting misuse, spam, fraud or cyber security threats;
• improving our website and services;
• sending relevant business-to-business communications;
• managing client relationships;
• defending or exercising legal rights.

Recognised legitimate interests

In limited cases, we may process personal information under recognised legitimate interests where UK data protection law specifically allows this. This may include preventing or detecting crime, safeguarding, responding to emergencies, protecting public security, or sharing information with relevant organisations where necessary.

We will only rely on recognised legitimate interests where the law allows it and where the processing is necessary.

Where we store your data

Your data may be stored in the UK, the European Economic Area, the United States or other locations where our trusted service providers operate.

Where personal data is transferred outside the UK or EEA, we take steps to make sure appropriate safeguards are in place. These may include the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, adequacy regulations, or other lawful transfer mechanisms.

Third-party services we use

We may share personal data with trusted providers who help us run our business, provide our services and keep our systems secure.

These may include:

• Stripe – payment processing;
• GoHighLevel – email communications, forms, bookings and CRM activity;
• Google Analytics – website analytics;
• Microsoft Clarity – website behaviour analytics and usability monitoring;
• hosting, website and email providers – to operate our website and communications;
• professional advisers – such as accountants, legal advisers or insurers where needed;
• cyber security and IT service providers – where needed to protect systems, deliver services or investigate security issues.

Where providers act as processors for us, they must process personal data under our instructions and under a written contract. Where a provider acts as an independent controller, they are responsible for their own use of personal data.

We do not sell your personal data.

How long we keep your data

We keep personal data only for as long as needed for the reason it was collected, including to meet legal, accounting, tax, contractual, security or reporting requirements.

• Newsletter and marketing data: until you unsubscribe or ask us to stop contacting you.
• Enquiry data: normally up to 3 years after the last meaningful contact, unless a longer period is needed.
• Customer and client records: normally up to 7 years to meet legal, accounting and tax requirements.
• Payment records: normally up to 7 years, although full card details are handled by Stripe and are not stored by us.
• Analytics data: normally up to 14 months, depending on the settings used by the analytics provider.
• Security logs and technical data: for as long as needed to protect systems, investigate issues, evidence work carried out or meet legal and contractual duties.

When we no longer need personal data, we delete it, anonymise it or securely archive it where appropriate.

Your rights under UK GDPR

You have rights over your personal data. These include the right to:

• access the personal data we hold about you;
• correct inaccurate or incomplete data;
• delete your data in certain circumstances;
• restrict how your data is used in certain circumstances;
• object to certain uses of your data, including some direct marketing;
• data portability, where this applies;
• withdraw consent where we rely on consent.

To exercise any of your rights, email hello@blackswancyber.co.uk or use the contact form on our website.

We will usually respond within one calendar month. We may ask for information to confirm your identity or to help us find the information you are asking for. If we need clarification, the response period may pause until we receive the information required.

When responding to requests, we will carry out reasonable and proportionate searches.

For more detail, see our Rights for Individuals page.

Marketing communications

We may send you marketing communications if you have asked to receive them, downloaded a resource, attended an event, made an enquiry, purchased from us, or where we believe the communication is relevant to your organisation and lawful under data protection and electronic marketing rules.

You can opt out of marketing emails at any time by clicking the unsubscribe link in our emails or contacting us directly.

We will not sell your personal data to third parties for marketing.

Children’s data

Our website and services are mainly intended for businesses, schools, charities, public sector bodies and other organisations. We do not knowingly collect personal information from children for marketing purposes.

Some of our online safety resources, school-related content or public guidance may be accessed by families, schools, parents, carers or young people. Where our services or resources are likely to be accessed by children, we aim to handle personal information in a way that takes children’s needs, rights and safety into account.

Automated decision-making and AI

We do not use your personal information to make solely automated decisions that have a legal or similarly significant effect on you.

We may use technology, security tools or AI-assisted tools to help us work more efficiently, review information, detect security issues, improve services or prepare draft content. Where we do this, we remain responsible for how personal data is used and we do not use these tools to make significant decisions about individuals without appropriate human involvement.

How we keep your data safe

We take data security seriously. Measures we use may include:

• encryption in transit and at rest where appropriate;
• password protection and access controls;
• multi-factor authentication;
• role-based access for staff and trusted partners;
• secure cloud services;
• regular updates and patching;
• system monitoring;
• backup and recovery processes;
• staff awareness and security procedures.

Only authorised people can access personal data, and only where they need it for their role or for the work being carried out.

Data protection complaints

If you are unhappy with how we have handled your personal data, or how we have responded to a data protection rights request, you can raise a data protection complaint with us.

A data protection complaint may relate to how we collect, use, store, protect, share or delete your personal data. It may also relate to how we have responded to a request you have made under data protection law.

You can make a data protection complaint by:

• completing our Data Protection Complaints form;
• emailing us at hello@blackswancyber.co.uk;
• calling us on 01246 927142;
• writing to us at Black Swan Cyber Security Solutions, Unit 50 Clocktower Business Centre, Works Road, Hollingwood, Chesterfield, S43 2PE.

We will acknowledge your data protection complaint within 30 calendar days of receiving it.

We will then review your complaint, make appropriate enquiries, keep you informed where necessary, and explain the outcome without undue delay.

If you are still unhappy after we have responded, you have the right to complain to the Information Commissioner’s Office (ICO):

Website: https://ico.org.uk
Phone: 0303 123 1113

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in the law, regulatory guidance, our services, our website or how we work.

The latest version will always be available on this page, with the date updated at the top.