Privacy Policy
Last updated: 13 October 2026
This notice explains how Baigent’s Information Security Services Ltd (“BISS”, “we”) uses personal information. We keep it short because we hold very little.
Who we are
Baigent’s Information Security Services Ltd is the controller of your personal information.
- Registered in England and Wales, company number 07660651
- Registered office: 38 Bridge Street, Andover, SP10 1BW
- Data protection contact: info at baigents.net
We are a small company and are not required to appoint a Data Protection Officer. Our director, Jon Baigent, is responsible for data protection.
What we collect
- Your name
- Your business email address
- Your phone number, if you give it to us
We do not collect special category data (such as health information), criminal offence data or children’s data.
Where it comes from: from you, or from your employer when they engage us and name you as a contact. When we check a prospective client, we may also look at publicly available business information, such as Companies House records.
This website: we use Cloudflare for hosting. Cloudflare gives us country-level visitor statistics only. We do not use Google Analytics or any other tracking.
Why we use it and our lawful basis
| Why | Lawful basis |
|---|---|
| Replying to your enquiry or quote request | Legitimate interests: responding to people who contact us |
| Delivering a contract with you as a sole trader or partner | Contract |
| Contacting you as the named contact for your employer’s contract or certification assessment | Legitimate interests: we need a named contact to deliver the work, send reports and invoice. We hold only the minimum details and you can ask us to use a different contact at any time |
| Keeping invoices and accounting records | Legal obligation (HMRC record keeping) |
We do not use your details for marketing or mailing lists, and we never sell, rent or lease them. We do not make automated decisions about you.
Certification assessments
When we carry out a Cyber Essentials, Cyber Essentials Plus, IASME Cyber Assurance or Defence Cyber Certification assessment as an IASME Certification Body, your contact details are entered on the IASME assessment platform and shared with IASME Consortium Ltd, which runs these schemes. IASME’s own privacy notice covers its use of your information.
Who we share it with
Only with service providers that process data for us under contract, and only as needed:
- Microsoft 365 (email, contacts, files and backup), UK
- Signable (contract signing), UK
- FreeAgent (invoicing), Ireland
- IASME assessment platform (certification assessments), UK
- Qualys (vulnerability scanning, for clients who buy scanning), UK
- Cloudflare (website hosting)
- Our accountant (invoice records)
We also share information where the law requires it.
Transfers outside the UK
Most of your information stays in the UK. FreeAgent (Ireland) is covered by the UK’s adequacy regulations for the European Economic Area. Cloudflare serves this website from a global network.
How long we keep it
| Information | How long |
|---|---|
| Enquiries that do not lead to work | 90 days |
| Client contact details | For the length of our relationship, plus 6 years |
| Certification assessment records | 18 months from the final report (3 years for IASME Cyber Assurance Level 2 audit reports), as required by IASME |
| Invoices and accounting records | 6 years from the end of the financial year |
After that, we delete it securely. Deleted data drops out of our backups as they rotate.
How we protect it
We hold Cyber Essentials Plus and apply the same controls we assess for others: multi-factor authentication on every service, encrypted devices, UK storage for certification data, tested backups and regular security reviews.
Your rights
You can ask us to:
- Give you a copy of your information
- Correct it
- Delete it
- Restrict or object to how we use it
- Send it to you or another organisation in a portable format
Email info at baigents.net or write to our registered office. Requests are free. We reply within one month and may ask you to confirm your identity first. For very complex requests we may need up to two more months, and we will tell you why.
Complaints
Please contact us first and we will try to put things right. You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint, by phone on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
Cookies
This site does not use tracking or advertising cookies. Cloudflare may set a cookie needed for the site to run (load balancing and security). It lasts only while you browse, holds no personal data and we cannot turn it off.
Changes to this notice
We review this notice at least once a year and when our processing changes. The date at the top shows the latest version.
Links to other websites
Our website may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question.
Website Usage Terms and Conditions
If you continue to browse and use this website, you are agreeing to comply with and be bound by the following terms and conditions of use, which together with our privacy policy govern Baigent’s Information Security Services Ltd’s relationship with you in relation to this website. If you disagree with any part of these terms and conditions, please do not use our website.
The term ‘Baigent’s Information Security Services Ltd’ or ‘us’ or ‘we’ refers to the owner of the website whose registered office is 38 Bridge Street, Andover, SP10 1BW. Our company registration number is 07660651. The term ‘you’ refers to the user or viewer of our website.
The use of this website is subject to the following terms of use:
The content of the pages of this website is for your general information and use only. It is subject to change without notice.
Neither we nor any third parties provide any warranty or guarantee as to the accuracy, timeliness, performance, completeness or suitability of the information and materials found or offered on this website for any particular purpose. You acknowledge that such information and materials may contain inaccuracies or errors and we expressly exclude liability for any such inaccuracies or errors to the fullest extent permitted by law.
Your use of any information or materials on this website is entirely at your own risk, for which we shall not be liable. It shall be your own responsibility to ensure that any products, services or information available through this website meet your specific requirements.
This website contains material which is owned by or licensed to us. This material includes, but is not limited to, the design, layout, look, appearance and graphics. Reproduction is prohibited other than in accordance with the copyright notice, which forms part of these terms and conditions.
All trademarks reproduced in this website, which are not the property of, or licensed to the operator, are acknowledged on the website.
Unauthorised use of this website may give rise to a claim for damages and/or be a criminal offence.
From time to time, this website may also include links to other websites. These links are provided for your convenience to provide further information. They do not signify that we endorse the website(s). We have no responsibility for the content of the linked website(s).
Your use of this website and any dispute arising out of such use of the website is subject to the laws of England and Wales.