Who we are and our roles
Assure Start Ltd is a Scottish company, number SC821120, registered with the Information Commissioner’s Office (ICO) under reference ZB664803. We have appointed a data protection officer (DPO), who you can contact at dpo@assurestart.co. Our address and other contact details appear below.
Running our business
We act as a controller when deciding how and why to use personal data for our own enquiries, business relationships, supplier management, invoicing, website services and necessary engagement records. This notice explains that processing.
Consultancy, external DPO and audit engagements
Our work can involve access to information about clients’ staff, customers and other individuals, including when acting as an external data protection officer (DPO) or auditing for a certification body (CAB). Evidence generally remains in client or CAB systems.
Our role depends on the particular activity and who determines its purposes and means. Where we process information on a client’s or CAB’s instructions, we follow the applicable processing arrangements. The relevant controller’s privacy information explains its purposes, lawful bases and responsibilities.
Separately, we are a controller for necessary records we keep for our own business purposes, including dealing with complaints, insurance requirements and legal claims. These records exclude sensitive details from client or CAB evidence.
Information we handle
This notice covers people who contact us, use our website or tools, represent clients and prospective clients, or work with us as suppliers, partners or certification-body contacts. It also explains our handling of information about individuals appearing in engagement evidence.
- Business and engagement information
- Names, roles, organisations, contact and billing details, correspondence, meeting notes, contracts, professional advice and reports. Information may come from you, your organisation, a client, a CAB, professional contacts, referrals or publicly available business and professional sources.
- Client and audit evidence
- Depending on the engagement, we may access staff and customer records, audit samples, access and training records, incident reports and information relating to rights requests, complaints or investigations.
- Sensitive information
- Some evidence we access in client or CAB systems may contain special-category data, such as health information, or criminal-offence information. We handle it under the relevant engagement arrangements and do not retain those sensitive details in our own engagement records.
- Website and tool information
- Our services handle connection and browser information, requested pages, referrers and interactions, submitted analyser URLs, CVE-feed search terms and usage statistics. The cookies, analytics and website tools section below explains these activities and your analytics choice.
Purposes and lawful bases
The following bases apply where we act as controller. They do not replace the client’s or CAB’s lawful basis for processing carried out on its instructions.
| Purpose | Information | Lawful basis |
|---|---|---|
| Enquiries and business relationships | Names, business contact details, roles, correspondence and meeting notes for client, prospective-client, supplier and professional contacts. | Legitimate interests: responding to enquiries, communicating with organisations, arranging and providing professional services, and managing our business relationships. |
| Services contracted by an individual | Contact, engagement and payment information necessary to provide services directly to an individual or sole trader. | Contract: where necessary for a contract with that individual, or steps they ask us to take before entering into it. A contract with a company does not itself provide this basis for its employees’ details. |
| Tax and accounting | Invoices, billing and payment records, and information needed for tax and financial reporting. | Legal obligation: keeping the accounting and tax records required of us. |
| Data protection complaints | Contact details, the concerns raised, relevant correspondence and the steps taken to investigate and respond. | Legal obligation: acknowledging and investigating data protection complaints, keeping complainants informed and communicating the outcome as required by data protection law. |
| Our own engagement records and complaints | Necessary contracts, correspondence, advice, final reports and working records, excluding sensitive details from client or CAB evidence. | Legitimate interests: demonstrating the work we have done, answering questions, handling other engagement complaints, meeting insurance requirements and establishing, exercising or defending legal claims. |
| Operating and protecting website services | Connection and browser information, operational logs, analyser requests and CVE-feed search terms and request counts. | Legitimate interests: delivering reliable services, preventing misuse, investigating faults and protecting our systems and their users. |
| Understanding and improving our services | Website visits and interactions, page URLs and referrers, and pseudonymous CVE-feed usage statistics. | Legitimate interests: understanding which services are useful and improving their operation and usability. You can object to website analytics using the control below. |
Sharing and international transfers
We use service providers for communications, documents, meetings, backups, hosting, scheduling, accounting and payments. Some process information on our instructions; others act as independent controllers for particular activities, such as payment processing, fraud prevention or their own legal obligations. Their roles depend on the service and activity.
| Service provider | Purpose and information |
|---|---|
| Google Workspace, including Google Meet | Business email, calendars, documents and video meetings: contact details, correspondence, meeting information and shared content. Provider privacy information · Cloud data processing addendum |
| Microsoft business services: OneDrive and Teams | Document storage and sharing, collaboration and meetings: contact details, communications and shared files. Provider privacy information |
| Backblaze B2 | Backups of business information, using EU storage. The contents depend on the systems and records being backed up. Provider privacy information |
| Cal.com | Optional call scheduling: names, email addresses and booking details. Loading the calendar also sends connection and browser information to the service. Provider privacy information |
| Stripe and GoCardless | Payments and, where applicable, direct debit mandates: contact, billing, payment and tax information. These providers also have their own payment, fraud-prevention and regulatory responsibilities. Provider privacy information · GoCardless privacy information |
| FreeAgent | Accounting and invoicing: client contact details, invoices, billing, payment and tax records. Provider privacy information |
| WhatsApp Business | Optional communications: names, phone numbers, message content and related communications information. You can contact us by email or phone instead. Provider privacy information · Business data processing terms |
| Vercel | Hosting this website: connection information, requests and operational logs. We do not use Vercel to host our consultancy document systems. Provider privacy information |
| Hetzner | EU hosting for our self-hosted infrastructure, including Plausible analytics: service data and operational information handled by that infrastructure. Provider privacy information |
| Cloudflare | Website delivery and security, including filtering malicious requests: IP addresses, request details and related security information. Provider privacy information |
Self-hosted services and other recipients
We use self-hosted Docuseal for e-signatures and agreement workflows, handling signatory contact details, signed documents and signature records. We also self-host Plausible for website statistics.
We may share relevant information with the client or CAB as part of an engagement, and with professional advisers, insurers, courts or public authorities where necessary for advice, insurance, a claim or a legal obligation. We limit the information to what is needed for the purpose.
International processing
Our Hetzner infrastructure and Backblaze B2 backup storage use EU locations. Other suppliers may process information internationally, including through support access and subprocessors.
For transfers outside the UK, the applicable arrangements depend on the supplier and transfer. They include UK adequacy regulations, including the UK Extension to the EU–US Data Privacy Framework where applicable, or appropriate contractual safeguards such as the UK Addendum to the European Commission’s standard contractual clauses.
To ask about recipients, overseas processing or obtain information about the safeguards applying to your information, email dpo@assurestart.co.
How long we keep information
Retention depends on the record and its purpose. We retain relevant information where necessary for an outstanding complaint, claim or legal obligation, rather than automatically keeping every document from an engagement for the same period.
| Record | Period or criteria |
|---|---|
| Enquiries that do not become engagements | Three years after the last substantive contact about the enquiry. |
| Contracts | Seven years after the contract ends, subject to any requirement to preserve relevant records for an ongoing claim or legal obligation. |
| Other necessary engagement records | Determined by the purpose of the record, relevant contractual and insurance requirements, and any outstanding complaint or claim. We keep only the information needed for those purposes; the contract period is not a blanket period for all evidence. |
| Temporary client copies and CAB records | Client and CAB retention arrangements apply to information held in their systems. Any temporary copies are returned or deleted in accordance with the engagement instructions when no longer needed for the task. |
| Tax and accounting records | Generally six years from the end of the last company financial year they relate to, or longer where tax or other legal requirements require it. |
| CVE-feed usage statistics | Up to 180 days. |
| Website logs and other analytics | Determined by the operational purpose: investigating faults or security incidents, preventing abuse and assessing service performance and improvements. Relevant records may be preserved while an incident or investigation is unresolved. |
| Backups | Determined by recovery needs and applicable retention obligations or client instructions. Information deleted from live systems may remain in backup copies until those copies are replaced or deleted. |
Your rights
You can contact us using the details below to exercise your data protection rights. Which rights apply depends on the processing and its lawful basis. We respond without undue delay and within one month of receiving your request. If we need to confirm your identity or clarify the request, that month starts once we have what we need. For complex or multiple requests we may extend this by up to two further months; if so, we will tell you why within the first month.
- Access and correction
- Ask for access to your personal data and information about its use, and ask us to correct inaccurate or incomplete information.
- Erasure and restriction
- Ask us to delete information or restrict its use in the circumstances provided by law. These rights are not absolute: for example, we may need records to meet a legal obligation or deal with a legal claim.
- Your right to object
- You can object, on grounds relating to your particular situation, to processing based on legitimate interests. We must stop unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims. You can stop website analytics using the control below without giving a reason.
- Data portability
- Where we process, by automated means, information you have provided, on the basis of your consent or a contract with you, you can ask for that information in a structured, commonly used, machine-readable format and, where technically feasible, its transfer to another controller.
If your request concerns information controlled by a client or CAB, contact the relevant controller. If you contact us, we will help identify the appropriate route and assist under the applicable engagement arrangements.
Hosting and security
Vercel hosts this website. Our self-hosted services, including Plausible, run on Hetzner’s EU infrastructure. Cloudflare supports website delivery and security. These services handle connection and request information to deliver content, manage reliability and protect against misuse.
Website fonts are hosted with the site. The website’s hosting and security services still handle the connection information needed to deliver it.
Contact details
For privacy questions, rights requests or complaints, email our data protection officer at dpo@assurestart.co or write to the Data Protection Officer, Assure Start Ltd, Suite B1 Law’s Close, 341 High Street, Kirkcaldy KY1 1LD.
Other ways to reach us are on the contact page. You do not need to use a particular form or legal wording to raise a concern.
Complaints
If you are unhappy with how we handle personal data, contact us by email or post using the details above. We will acknowledge your complaint within 30 days, investigate it appropriately without undue delay, keep you informed of progress and communicate the outcome.
You also have the right to complain to the ICO, the UK’s data protection regulator. You can find its complaints information and contact details on the ICO website. Contacting us does not remove your right to complain to the ICO.
Changes to this notice
We update this notice when our services, suppliers or legal requirements change. The date at the top shows when it last changed. If a change materially affects how we use information we already hold about you, we will tell you before it takes effect where we have a way to contact you.