Privacy and confidentiality

Last updated: 18 August 2026

Privacy information

CyberCustodian treats client information as confidential and limits collection to what is needed to understand, scope and deliver an engagement.

Who is responsible for your information

The controller is Paul Smith trading as CyberCustodian, based in Wirral and providing services throughout the UK. Privacy questions and requests can be sent to info@cybercustodian.uk. Security concerns about this website can be sent to security@cybercustodian.uk.

Information we may collect

• Contact details and information you choose to provide in an enquiry.
• Consultation, quotation, contract, authority and service-delivery records.
• Invoices, payment status and records needed for tax and accounting.
• Authorised technical information needed to assess security, resilience or recovery, such as account settings, device details, logs or incident evidence.
• Limited website statistics described below. CyberCustodian does not use advertising identifiers or create personal visitor profiles.

Please do not send passwords, one-time codes, recovery keys, payment-card details or unnecessary sensitive information. CyberCustodian does not intentionally collect special-category information through this website. If such information is genuinely necessary for an engagement, the purpose, additional legal condition and safeguards will be explained before collection.

Why we use information and our lawful bases

• To respond to enquiries and prepare a requested service: steps taken at your request before entering a contract.
• To deliver and administer agreed services: performance of a contract.
• To keep financial, tax and other required records: compliance with legal obligations.
• To protect clients, systems and the business, prevent misuse, maintain service quality and understand aggregate website use: CyberCustodian's legitimate interests, balanced against individual rights.
• To establish, exercise or defend legal claims where this becomes necessary.

Website statistics and your choice

This site records aggregate visits, page views, referral source, broad device type and country code so CyberCustodian can understand and improve the website. CyberCustodian's analytics database does not retain IP addresses, precise locations, advertising identifiers or individual browsing profiles. A session-only browser marker prevents a visit being counted repeatedly in the same tab and is removed when that tab closes.

This limited storage is used solely to create aggregate statistics for improving the website. You can object at any time using the control below. Your choice is saved only on this device. Disabling analytics does not affect the website or any CyberCustodian service.

Essential security cookies

Cloudflare protects and delivers this website. It may set the essential __cf_bm cookie to distinguish likely automated traffic and reduce malicious requests. Cloudflare says this encrypted cookie expires after 30 minutes of continuous inactivity and is generated separately for each site. If a security challenge is required, Cloudflare may also set a temporary clearance cookie. These cookies are used for website security, not advertising.

Who may receive information

Information is shared only where necessary with service providers supporting secure website hosting, email, document storage, accounting or professional advice; with authorised people involved in an engagement; or with regulators, courts and law-enforcement bodies where disclosure is required or lawful. OpenAI Sites and Cloudflare support this website's hosting and delivery. Suppliers are expected to use information only for the agreed purpose and protect it appropriately.

International processing

Some technology suppliers may process information outside the UK. Where UK personal data is transferred internationally, CyberCustodian requires an applicable adequacy regulation or other recognised safeguard, such as the UK International Data Transfer Agreement or UK Addendum, as appropriate.

How long information is kept

• Enquiries that do not become engagements are kept only long enough to respond, complete reasonable follow-up and manage any resulting dispute.
• Client and incident records are assigned a justified retention period based on the service, sensitivity, contractual requirements and legal risk, and are reviewed when the engagement closes.
• Financial and tax records are normally retained for at least five years after the relevant 31 January Self Assessment submission deadline, or longer where law or an active enquiry requires it.
• Aggregate, non-identifying website statistics may be retained to compare long-term trends. Provider security logs follow the provider's retention arrangements.

Security and confidentiality

CyberCustodian uses proportionate access controls, protected administrative accounts, governed document storage, secure transfer methods where needed, versioning, backups and retention reviews. Access is limited to authorised people with a business need. No internet service can be guaranteed completely secure, so sensitive transfer arrangements are agreed before material is provided.

Your data-protection rights

Depending on the circumstances and lawful basis, you may have rights to access, correct, erase or restrict personal information; object to processing; and receive information in a portable format. You may also withdraw consent where consent is being relied upon. CyberCustodian does not make solely automated decisions that have legal or similarly significant effects.

Your right to object: you can object to processing based on legitimate interests, including anonymous website analytics, at any time.

To exercise a right, email info@cybercustodian.uk. Identity may need to be confirmed proportionately before information is disclosed or changed.

Questions and complaints

Please contact CyberCustodian first so the concern can be investigated. You also have the right to complain to the Information Commissioner's Office.

The initial-call form prepares an email in your own email application. It does not submit or store the information on this website. Review the message before sending and remove anything that is not necessary.