This privacy policy explains how Incursion Cyber Security Ltd collects, uses and protects personal data when you visit incursion-security.co.uk, contact us, or work with us, and what rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Who we are
Incursion Cyber Security Ltd is the data controller for the personal data described in this policy. We are registered in England and Wales, company number 14303576, with our registered office at 1 Bushy Coombe, Midsomer Norton, BA3 2RW. We are registered with the Information Commissioner’s Office (ICO) under registration number ZB604666. We do not have a statutory data protection officer; questions about this policy go to info@incursion-security.co.uk or +44 7496 256 424.
What we collect and why
When you contact us. If you use the contact form, call or email us, we collect your name, email address, phone number, organisation, job title and whatever you tell us about your enquiry. We use it to answer you, to scope and quote for the work you ask about, and to keep a record of the conversation. Our lawful basis is our legitimate interest in responding to enquiries and, where you go on to become a client, taking steps to enter into a contract with you.
When you become a client. We collect the contact details of the people we deal with at your organisation, and the information needed to deliver the engagement: scope, systems, credentials you provide for testing, findings and reports. We process this to perform our contract with you, to meet our obligations as an IASME-licensed certification body, and to keep the records that our accreditations require. Where we test your systems, the personal data we encounter inside them (for example in your applications or on your network) is your data; we act on your written instructions as a processor for that data, and our engagement terms set out how we handle it and when we delete it.
When you register interest in working with us. If you use the register-your-interest form on our careers page, we collect your name, contact details and what you tell us about your experience. We use it to consider you for future roles and to contact you about them. Our lawful basis is our legitimate interest in recruiting. We keep applicant details for 12 months unless you ask us to delete them sooner.
When you become a partner. If you join our partner programme, we collect the contact details of your staff and the information needed to run the programme, referrals and commercial arrangements. We process this to perform the partner agreement.
When you visit the website. Our hosting provider and content delivery network record technical data such as your IP address, browser, device type, the pages you request and the time of the request, in server logs. We use these for security, to detect abuse and to keep the site running. Our lawful basis is our legitimate interest in operating a secure website. We also use cookies and similar technologies, described below.
Marketing. We do not send marketing emails unless you have agreed to receive them. If you agree, you can withdraw that consent at any time using the link in any email or by contacting us. We do not sell personal data and we do not share it with third parties for their own marketing.
Legal obligations. We may process personal data where we must, for example to keep accounting records, to respond to a lawful request from a regulator or law enforcement, or to meet the requirements of the certification schemes we operate under.
Cookies and similar technologies
When you first visit the site, a banner asks whether you accept non-essential cookies. Strictly necessary cookies are set without consent because the site does not work without them; everything else is only set if you agree, and you can change your choice at any time from the Cookie settings link at the foot of every page, or by clearing cookies in your browser.
- Strictly necessary. Cookies that record your cookie choice, keep the site secure and allow the contact form to work. Set by our website (WordPress), our cache and content delivery network, and HubSpot, whose forms and consent banner we use.
- Analytics. With your consent, Google Analytics 4 records how visitors use the site (pages viewed, how you arrived, approximate location from your IP address, device and browser) so we can see which content is useful. Data is sent to Google, which may process it in the United States. HubSpot analytics cookies record your visits so that, if you later contact us, we can see which pages you looked at.
- Third-party content. Some pages embed content from other services: certificate badges from the Blockmark registry, and a video hosted by YouTube. When that content loads, the service that provides it receives your IP address and may set its own cookies under its own privacy policy.
Who we share data with
We use a small number of suppliers to run the business, each under a contract that restricts what they can do with personal data:
- HubSpot, for our website forms, cookie banner, customer relationship management and email (hosted in HubSpot’s EU data centre).
- WP Engine, which hosts this website, and Cloudflare, which provides its content delivery network and security layer.
- Microsoft, for business email, documents and file storage (Microsoft 365).
- Google, for website analytics (Google Analytics 4).
- IASME Consortium and the Blockmark registry, which record the certificates we issue as a certification body, including the name of the certified organisation and its contact.
- Our accountants, insurers and professional advisers, where necessary.
- Regulators, certification bodies, courts and law enforcement where the law or our accreditations require it.
International transfers
We keep personal data in the UK or the European Economic Area where we can. Where a supplier processes data outside the UK, for example Google in the United States, we rely on the UK’s adequacy regulations for that country or on the UK International Data Transfer Agreement or Addendum, together with the supplier’s own safeguards. You can ask us for details of the safeguards that apply.
How long we keep data
- Enquiries that do not lead to work: 12 months from the last contact.
- Client and partner records, including reports and certification records: six years after the end of the engagement, to meet our legal, accounting and accreditation obligations. Test data and credentials you give us for an engagement are deleted 30 days after the final report is delivered, unless you ask us to keep them for a retest.
- Applicant details: 12 months.
- Website server logs: 30 days. Analytics data: no more than 14 months, the maximum Google Analytics keeps it.
How we protect data
We hold Cyber Essentials Plus and IASME Cyber Assurance Level 2, which include the governance, access control, encryption and incident-handling measures we apply to our own systems. Personal data is stored on encrypted devices and services, access is limited to the people who need it, and multi-factor authentication is required on all business accounts. If a personal data breach is likely to put you at risk, we will tell you and the ICO as the law requires.
Your rights
Under UK GDPR you have the right to ask for a copy of the personal data we hold about you, to have it corrected or deleted, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent where consent is the basis we rely on. To use any of these rights, email info@incursion-security.co.uk. We will respond within one month. We may ask you to confirm your identity first. There is no charge unless a request is clearly unfounded or excessive.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to resolve the matter first.
Children
Our services are for organisations, and the website is not aimed at children. We do not knowingly collect personal data from anyone under 18.
Links to other websites
Our pages link to registers, regulators and other organisations so that you can verify what we say. Those sites have their own privacy policies, which we do not control.
Changes to this policy
We will update this policy when our processing changes and show the date of the latest version below. Significant changes will be highlighted on this page.
Incursion Cyber Security Ltd
1 Bushy Coombe, Midsomer Norton, BA3 2RW
info@incursion-security.co.uk · +44 7496 256 424
Last updated: 28 September 2026