Privacy Policy

CYAN Solutions Ltd (CYAN) respects your privacy and is committed to protecting your personal information. 

This Privacy Policy explains how we collect, use, store and share personal information about external individuals with whom we interact, the legal bases on which we process that information, and the rights available to you under UK data protection law. 

This is a company-wide Privacy Policy. It is not limited to information collected through our website.

In brief

This summary gives the key points. The full notice below has the detail. 

Who we are: CYAN Solutions Ltd, an IT and cyber security services company in Waterlooville, Hampshire. Our Data Protection Lead is the Head of Security (GRC). 

Who this covers: people outside CYAN whose details we hold, including website visitors, leads and prospects, customer and supplier contacts, people who call or email us, job applicants and similar business contacts. If CYAN handles your data solely on behalf of one of our customers, for example in relation to your employer’s IT systems, that customer is generally responsible for that processing and you should normally contact them first. 

What we collect: mainly business contact details and records of our dealings with you, including enquiries, sales conversations, support tickets, correspondence, marketing preferences and website activity. Calls to and from CYAN are generally recorded, and some calls or meetings may involve approved AI-assisted tools for purposes such as transcription, service administration and creating support tickets. We provide appropriate information when these technologies are used. 

Where it comes from: from you, from your organisation, from public sources and from business data providers such as Cognism. 

Why we use it: to respond to you, manage our relationships with customers and suppliers, deliver and support our services, keep our business records, send relevant business-to-business marketing where permitted, run and secure our websites, recruit staff and meet our legal obligations. 

Who we share it with: service providers that support our systems and operations, including CRM, email, accounting, security, backup and similar providers, together with professional advisers, auditors, suppliers and public authorities where appropriate. We do not sell personal information. Further information about relevant service providers may be available through our Trust Centre or on request. 

Where it is stored: some providers may process data outside the UK. Where they do, we use safeguards required by UK data protection law. 

How long we keep it: only for as long as we reasonably need it. For example, prospect and marketing records are generally retained for up to two years after our last meaningful interaction, and certain customer, supplier and service records may be retained for up to six years after the relevant relationship ends. 

Your rights: you may have rights to access your data, have it corrected or deleted, restrict or object to its use, object to direct marketing, and withdraw consent where we rely on consent. We normally respond to rights requests within one month. 

Complaints: if you are unhappy with how we have handled your data, email [email protected] or use the Trust Centre contact form. We acknowledge complaints within 30 days and communicate the outcome without undue delay. If you are not satisfied with our response, you can also complain to the Information Commission (ICO). 

1. Who we are

CYAN Solutions Ltd is a company registered in England and Wales under company number 05181855. 

Our registered office and operating address is: 

CYAN Solutions Ltd 
Unit 14 The Briars 
Waterberry Drive 
Waterlooville 
Hampshire 
PO7 7YH 
United Kingdom 

For the purposes of UK data protection law, CYAN is generally the controller of the personal information described in this Privacy Policy. 

You can contact us about privacy or data protection matters at: 

Email: [email protected] 

Post: 
CYAN Solutions Ltd 
Unit 14 The Briars 
Waterberry Drive 
Waterlooville 
Hampshire 
PO7 7YH 
United Kingdom 

Website: https://cyansolutions.co.uk 

Data protection at CYAN is overseen by our Data Protection Lead, the Head of Security (GRC), who can be contacted using the details above. 

2. Scope of this Privacy Policy

This Privacy Policy applies to personal information that CYAN processes in its own capacity as a controller about external individuals with whom we interact, including:

• website visitors; 
• leads and prospective customers; 
• individuals who contact us by telephone, email, web form or other means; 
• business contacts; 
• customer representatives and users; 
• suppliers and supplier contacts; 
• professional advisers and business partners; 
• individuals who receive marketing communications from us; 
• people we meet through events, networking, referrals or other business activities; 
• visitors to our websites and subdomains, including people who request documents, subscribe to updates or raise data protection complaints or requests through them; 
• job applicants and candidates; and 
• other external contacts whose personal information we hold in connection with operating our business. 

This Privacy Policy therefore applies across CYAN’s business activities and is not limited to information collected through our website. 

2.1 Our websites and online platforms 

This Privacy Policy applies to personal information that CYAN processes through its websites, subdomains, online platforms, portals and other digital services. 

This includes our main corporate website and other CYAN-operated services, such as CYAN Ready, CYAN Portal and CYAN Trust Centre. 

The information we process depends on the website or service you use and how you interact with it. Not all types of information or processing described in this Privacy Policy apply to every website or service. 

Where a particular service has different or additional privacy arrangements, we will provide relevant information through that service or an appropriate supplementary privacy notice. 

This Privacy Policy does not apply to CYAN employees, workers or individual contractors in relation to their employment or engagement with us. Separate internal privacy information is provided to those individuals. 

2.2 Customer data processed on behalf of our customers 

In some circumstances, CYAN processes personal information solely on behalf of a customer as part of the services we provide to that customer. 

In those circumstances, the customer will generally act as the controller and CYAN will act as a processor. That processing is governed by the relevant customer agreement, including any applicable data processing terms, rather than by this Privacy Policy. 

If you are an individual whose information CYAN processes solely on behalf of one of our customers, requests about that information should normally be directed to the relevant customer in the first instance. 

However, this Privacy Policy will still apply to information about customer employees, representatives, users and other business contacts where CYAN processes that information for its own purposes, for example for: 

• account and relationship management; 
• billing and administration; 
• service administration; 
• business communications; 
• security; 
• legal and regulatory compliance; 
• contract management; or 
• establishing, exercising or defending legal rights. 

3. Personal information we collect

The personal information we collect depends on the nature of our relationship and interactions with you.

We may collect and process the following categories of information.

3.1 Identity and professional information

This may include:

• your name;
• job title;
• employer or organisation;
• department or business function;
• professional role; and
• information about your responsibilities within your organisation.

3.2 Contact Information

This may include:

• business email address;
• business telephone number;
• business mobile number;
• business address; and
• other contact details you choose to provide to us.

3.3 Enquiry, sales and relationship information

This may include:

• information contained in enquiries; 
• records of telephone calls, meetings and discussions; 
• correspondence and communications with us; 
• notes relating to sales conversations; 
• information about products or services in which you or your organisation have expressed an interest; 
• quotations and proposals; 
• sales opportunities; 
• customer or prospective customer relationship information; 
• records of interactions with CYAN; and 
• information relevant to managing our relationship with you or your organisation. 

3.4 Supplier and professional contact information

Where you work for or represent a supplier, adviser, partner or other organisation with which CYAN has a business relationship, we may hold: 

• business contact details;
• your role and responsibilities;
• correspondence with you;
• contract and relationship-management information;
• purchasing or supplier information; and
• records of meetings and communications.

3.5 Marketing Information

This may include:

• your marketing preferences;
• whether you have subscribed to or unsubscribed from communications;
• your interaction with marketing emails;
• information about content or campaigns with which you have interacted;
• areas of business or professional interest; and
• records necessary to ensure marketing preferences and objections are respected.

3.6 Website and technical information

When you use our website, we may collect information including:

• IP address; 
• browser type and version; 
• device type; 
• operating system; 
• approximate geographic information derived from an IP address; 
• referring website; 
• pages visited; 
• dates and times of visits; 
• interactions with pages, forms and website content; 
• the number, timing and duration of visits and browsing sessions; 
• the organisation you may be visiting from, where this can reasonably be inferred from your IP address; 
• links clicked; 
• cookie identifiers and similar online identifiers; and 
• information collected through analytics and similar technologies. 

Our websites may use tracking technologies that, where permitted and subject to your choices, can associate website activity with an existing business contact record. This may help us understand interests and manage our relationship with you. 

Where we use information about your website activity or interactions with us to analyse or infer your professional interests or likely areas of interest, this may constitute profiling under UK data protection law. We may use this profiling to help us understand our business contacts and, where permitted, make our sales and marketing communications more relevant. You have the right to object at any time to profiling carried out for direct marketing purposes. 

Non-essential tracking technologies are used only where permitted by law and, where required, with your consent. See section 11.

3.7 Service and support information

Where relevant to our relationship with you, we may process:

• support requests;
• service tickets;
• technical information provided in connection with an issue;
• communications with customer representatives or users;
• communications with third-party vendors or suppliers of a customer’s systems where we work with them to resolve an issue;
• records relating to service administration and delivery; and
• information necessary to manage our relationship with a customer.

Where this information is processed solely on behalf of a customer, the customer may be the controller and CYAN may be acting as processor as described in section 2.

3.7.1 CYAN Portal access 

Where customers use the CYAN Portal, authorised users may access and manage support tickets and related service information. 

At a customer’s request and with appropriate authorisation, selected senior management staff or authorised decision-makers may be granted access to support tickets across their organisation, including tickets raised by other employees. 

Access is provided for legitimate service management, operational, governance and security purposes, subject to applicable confidentiality and data protection requirements.

3.8 Service and support information

You may choose to provide additional information when communicating with us. 

We ask that you do not provide personal information that is unnecessary for the purpose of your communication. 

We do not intentionally collect special category personal information through our general website, sales or marketing activities. 

Where we need particular information from you to enter into or perform a contract, or to meet a legal obligation, we will tell you at the time. If you do not provide it, we may be unable to proceed with the contract or request. 

3.9 Call recordings, meeting recordings and AI-assisted interactions

Telephone calls to and from CYAN may be recorded for the purposes set out below.

We use call recordings for purposes including:

• service quality;
• training;
• security;
• record keeping;
• service administration; and
• resolving queries or disputes.

When you call us, or when we call you back in response to a request, an announcement at the start of the call tells you that it is being recorded. For other calls we make to you, the member of our team will tell you at the start of the conversation if the call is being recorded. 

When you call us during office hours, our telephone menu lets you choose to speak to a member of the CYAN team or to log a request with our AI-assisted agent. Using the AI-assisted agent is always your choice, and you can speak to a person instead at any time. Outside office hours the AI-assisted agent takes your request in place of voicemail, and a member of the team follows it up when we reopen. 

Where you use the AI-assisted agent, we will make clear that you are speaking to one. The agent collects information about you, your organisation and the reason for your call, and uses it to record your request and pass it to the right team to act on. For example, it may create, classify or update a support ticket, or record the details of an enquiry about our services. 

Information collected during an AI-assisted call may include the content of the conversation, contact information, information about the relevant service or technical issue, and a transcript or summary of the call. 

AI-assisted agents are used to support service administration and routing. They do not make decisions about individuals that produce legal or similarly significant effects. Any decision of that kind is made by a person. 

Where appropriate, a member of the CYAN team may review information collected or generated by the AI-assisted agent and may contact you or take further action in relation to your request. 

Meetings, including video calls, may also be recorded or transcribed with the assistance of approved AI-enabled tools, and summaries or transcripts may be generated. 

Participants are informed where meeting recording or transcription takes place. 

We may use recordings, transcripts and summaries to: 

• maintain accurate records;
• capture agreed actions;
• support service delivery;
• improve internal efficiency;
• support quality and training; and
• resolve queries or disputes.

We use only AI tools that have been risk-assessed and approved, and those tools must not use CYAN or customer information to train their models. We confirm this through the provider’s terms and account settings before a tool is approved. Our staff are not permitted to use unapproved AI tools, or personal or free AI accounts, for CYAN or customer work, and this is enforced through our policies and training. 

AI-generated output is subject to appropriate human oversight where it is used in a way that could materially affect a person or a business decision.

3.10 Recruitment information

If you apply for a role with CYAN, we may process information including:

• your application;
• CV;
• employment history;
• qualifications;
• interview notes;
• references;
• right-to-work information; and
• relevant background-check information where appropriate and lawful.

We may also process special category personal information where necessary, for example health information provided so that we can make reasonable adjustments. 

Where we process special category or criminal-offence data in connection with recruitment, we do so only where permitted by UK data protection law and where an appropriate additional legal condition applies. 

We may provide additional recruitment privacy information where appropriate. 

4. How we collect personal information

We may collect personal information directly from you when you:

• contact us by telephone; 
• email us; 
• submit a form through our website; 
• request information about our services; 
• speak with our sales, customer success, business support or service teams; 
• become a customer, supplier or other business contact; 
• subscribe to communications; 
• attend a meeting, event or networking activity; 
• communicate with us through professional networking platforms; 
• apply for a role with CYAN; or 
• otherwise interact with CYAN. 

We may also receive personal information from other sources.

These may include:

• your employer or organisation; 
• colleagues within your organisation; 
• customers; 
• suppliers; 
• referrals and introductions; 
• existing business contacts; 
• publicly available company websites; 
• professional networking services; 
• publicly available business directories; 
• events, exhibitions and networking activities; 
• business partners; 
• business contact data providers, including Cognism; and 
• other reputable third-party business information sources where their use is permitted by law. 

Where we obtain your personal information from a third-party business data provider such as Cognism, this may include:

• your name; 
• employer; 
• job title; 
• business email address; 
• business telephone and mobile numbers; 
• professional profile information; 
• approximate work location, such as country, region or city; 
• professional networking profile information, including employment history, job titles and skills you have chosen to publish; and 
• other information relating to your professional role. 

We may use this information for B2B sales, business development, relationship management and direct marketing where we have an appropriate lawful basis and where permitted by applicable electronic marketing laws. 

We may also create information as part of our relationship with you, such as records of communications, sales activity, service interactions and marketing preferences. 

5. How and why we use personal information

We only use personal information where we have a lawful basis for doing so.

Depending on the circumstances, we may use personal information for the following purposes.

5.1 Responding to enquiries

We use contact details and information provided to us to respond to enquiries, requests for information and other communications. 

We generally rely on our legitimate interests in responding to business enquiries and developing our business. 

Where the enquiry relates to entering into a contract directly with an individual, processing may also be necessary to take steps at that individual’s request before entering into the contract. 

5.2 Managing leads, prospects and sales opportunities

We process business contact information and records of interactions to identify and manage potential business opportunities and relationships. 

We generally rely on our legitimate interests in developing and operating our business. 

5.3 Managing customer relationships

We process information about customer representatives and contacts for purposes including:

• relationship management;
• account management;
• service administration;
• contract administration;
• business communications;
• billing;
• customer service; and
• managing our commercial relationship.

We generally rely on our legitimate interests in managing customer relationships and delivering our services.

Where an individual is personally party to a contract, we may also rely on processing being necessary for the performance of that contract.

5.4 Managing suppliers and other business relationships

We use business contact information to manage our relationships with suppliers, advisers, partners and other organisations. 

We generally rely on our legitimate interests in operating and administering our business.

5.5 Providing and supporting our services

We may process contact, communication and service-related information to administer and support the services that we provide.

Depending on the circumstances, we may rely on:

• performance of a contract; or
• our legitimate interests in providing and managing our services.

5.6 Maintaining business records and our CRM

We maintain records of our business contacts, interactions and relationships.

We generally rely on our legitimate interests in operating an organised and effective business, maintaining accurate records and managing our relationships.

5.7 Direct marketing

We may use business contact information to tell relevant contacts about CYAN’s services, events, content and other business matters. 

Where permitted by applicable electronic marketing law, we may rely on our legitimate interests in promoting and developing our business. 

Where consent is required, we will rely on consent. 

More information is set out in section 8.

5.8 Call recording, AI-assisted telephone services, meeting recording and AI-assisted working

We may process call recordings, information collected by automated or AI-assisted telephone agents, meeting recordings, transcripts and summaries for purposes including:

• responding to enquiries and service requests;
• creating and managing support or service tickets;
• routing requests to the appropriate team;
• service quality;
• training;
• record keeping;
• security;
• service administration; and
• dispute resolution.

We generally rely on our legitimate interests in operating an effective, secure and accountable service and in maintaining appropriate records of our interactions.

Where another lawful basis or additional legal condition is required for particular information or processing, we will apply that basis or condition as appropriate.

5.9 Recruitment

We process recruitment information to:

• assess applications;
• communicate with candidates;
• conduct interviews;
• make recruitment decisions;
• carry out appropriate checks; and
• comply with legal obligations such as right-to-work requirements.

Depending on the circumstances, we may rely on:

• taking steps at your request before entering into a contract;
• compliance with legal obligations;
• our legitimate interests in recruiting suitable staff; and
• additional legal conditions where special category or criminal-offence information is processed.

5.10 Website operation and security

We process technical information for purposes including:

• operating our website;
• maintaining security;
• detecting misuse;
• diagnosing technical issues;
• protecting CYAN’s systems and users; and
• improving website performance.

We generally rely on our legitimate interests in operating secure and effective systems.

5.11 Website analytics

We may use analytics to understand how people use our website and to improve its content and performance.

Depending on the technology and circumstances, we will rely on consent where required or on an applicable exemption under electronic communications law together with an appropriate data protection lawful basis.

5.12 Legal, regulatory and compliance purposes

We may process personal information where necessary to:

• comply with applicable laws;
• meet regulatory requirements;
• respond to lawful requests from authorities;
• maintain appropriate business records;
• prevent or investigate fraud;
• protect our legal rights;
• resolve disputes;
• establish, exercise or defend legal claims; or
• meet insurance, audit and professional-advice requirements.

We may rely on legal obligations or our legitimate interests, depending on the circumstances.

6. Legitimate interests

Where we rely on legitimate interests, this means we have identified a legitimate business or other interest in carrying out the processing and have considered whether that interest is appropriate in light of your rights and interests. 

Our legitimate interests may include:

• operating and developing our business; 
• responding to business enquiries; 
• managing leads and prospective customers; 
• managing customer, supplier and professional relationships; 
• maintaining appropriate business records; 
• communicating with business contacts; 
• promoting our products and services; 
• protecting our systems and information; 
• ensuring the security of our network and information systems; 
• preventing, detecting and investigating fraud, misuse and crime; 
• ensuring the security and effectiveness of our services; and 
• establishing, exercising and defending legal rights. 

You may have the right to object to processing based on legitimate interests. See section 15.

7. Systems and service providers

We use third-party systems and service providers to operate and support our business.

These may include providers of:

• CRM, sales and marketing platforms; 
• cloud email, communications, collaboration and productivity services; 
• accounting, bookkeeping, billing and financial administration services; 
• backup, archiving, disaster recovery and business continuity services; 
• website hosting and maintenance services; 
• IT and cyber security services; 
• IT service management and documentation services; 
• project management services; 
• analytics and website technology; 
• telephony, call-recording and communications services; 
• approved AI-assisted and automation services; 
• professional services; and 
• other technology and operational support services. 

These providers may process personal information on our behalf where necessary to provide their services to us. 

Where a provider acts as our processor, we take appropriate steps to ensure that it processes personal information in accordance with our instructions, applicable contractual requirements and data protection law. 

Further information about relevant service providers, processors and sub-processors may be made available through our Trust Centre or on request.

8. Direct Marketing

We may use professional or business contact information to provide relevant information about:

• CYAN’s services;
• products and solutions;
• events;
• news;
• content; and
• other matters that we reasonably believe may be relevant to you or your organisation.

Where permitted by law, we may rely on our legitimate interests to send business-to-business marketing communications. 

Electronic marketing rules differ depending on the nature of the recipient. In particular, different requirements may apply to corporate subscribers, sole traders and certain partnerships. 

Where applicable law requires consent before we send electronic marketing, we will obtain that consent unless another lawful exemption applies. 

Our marketing communications will provide an appropriate means of opting out or unsubscribing. 

You have the right to object to direct marketing at any time. This includes any profiling of your personal information that is related to direct marketing. 

You can do so by: 

• using the unsubscribe link contained in a marketing email; or
• contacting us at [email protected].

If you object to direct marketing, we will stop using your personal information for that purpose.

We may retain limited information on a suppression list so that we can continue to respect your preference and avoid contacting you again for marketing purposes.

9. Who we share personal information with

We may disclose personal information where reasonably necessary to organisations including:

• CRM, sales and marketing service providers; 
• cloud email, communications, collaboration and productivity providers; 
• accounting, bookkeeping, billing and financial administration providers; 
• backup, archiving, disaster recovery and business continuity providers; 
• website hosting and maintenance providers; 
• IT service management, documentation, project management and cyber security providers; 
• analytics and website technology providers; 
• business data and enrichment providers, where we check, obtain or update business contact records; 
• providers of approved AI-assisted tools that support activities such as meeting transcription, summarising and drafting; 
• certification bodies and auditors assessing our compliance with recognised standards; 
• banks and payment service providers; 
• communications providers; 
• professional advisers, including lawyers, accountants, auditors and insurers; 
• suppliers and subcontractors supporting our business or services; 
• third-party vendors or suppliers of our customers’ systems, where we need to work with them to resolve a support issue and only to the extent reasonably necessary; 
• business partners where appropriate; 
• regulators and public authorities; 
• law enforcement agencies; 
• courts and tribunals; 
• prospective purchasers, investors or advisers in connection with a sale, acquisition, restructuring or other corporate transaction; and 
• other organisations where you have authorised the disclosure or where we otherwise have a lawful basis to share the information. 

Where another organisation acts as a processor on our behalf, we take appropriate steps to ensure that it processes personal information in accordance with our instructions and applicable data protection law.

We do not sell personal information to third parties.

10. International transfers

Some of our suppliers and service providers operate internationally.

As a result, personal information may be transferred to, stored in or accessed from countries outside the United Kingdom.

Where applicable UK data protection law requires safeguards for such a transfer, we use an appropriate lawful transfer mechanism.

Depending on the circumstances, this may include:

• transferring information to a country covered by UK adequacy regulations;
• relying on an applicable recognised adequacy framework;
• using the UK International Data Transfer Agreement;
• using the UK Addendum to approved standard contractual clauses; or
• relying on another lawful international transfer mechanism.

We also take appropriate steps to ensure that organisations handling personal information on our behalf provide appropriate data protection and security arrangements.

You may contact us if you would like further information about safeguards applying to a particular international transfer.

11. Our website, cookies and similar technologies

This section applies to CYAN’s websites, subdomains, online platforms and portals, including the services described in Section 2. 

Our websites may use cookies and similar storage and access technologies. 

These may include:

• cookies;
• pixels;
• tags;
• scripts;
• local storage; and
• similar technologies.

We may use these technologies for purposes including:

• essential website functionality;
• security;
• remembering preferences;
• measuring website performance;
• understanding how visitors use the website;
• improving our website and services;
• managing online forms and interactions; and
• marketing or advertising, where applicable.

We may use third-party services in connection with these activities.

11.1 Essential technologies

Some technologies are necessary for our website to operate or provide a service that you have requested.

These may be used without consent where permitted by law.

11.2 Analytics and other technologies

Where consent is required before using analytics, advertising or other non-essential technologies, we will ask for that consent before using them. 

UK electronic communications law also permits certain storage and access technologies to be used without consent in specified circumstances. 

Where we rely on such an exemption, we will comply with the applicable requirements, including providing clear information and an appropriate means of objecting where required. 

11.3 Managing your choices

You can manage relevant preferences through the cookie or privacy controls provided on our websites. 

You can also control cookies using your web browser. 

Disabling certain technologies may affect the functionality or performance of parts of the website. 

Further information about the technologies currently in use may be provided through our website’s cookie controls or settings interface.  

12. Links to other websites

Our website may contain links to websites operated by other organisations. 

We do not control those organisations and are not responsible for their privacy practices. 

This Privacy Policy does not apply to personal information processed independently by third-party website operators. 

We recommend reviewing their privacy information before providing personal information to them. 

13. How long we retain personal information

We do not retain personal information for longer than we reasonably require it.

The period for which we retain information depends on matters including:

• why we collected it; 
• the nature of our relationship with you or your organisation; 
• whether there is an active or reasonably foreseeable business relationship; 
• whether the information is required for service delivery; 
• contractual requirements; 
• applicable limitation periods; 
• legal, accounting and tax requirements; 
• audit and insurance requirements; 
• security and fraud-prevention requirements; and 
• whether information may be required to establish, exercise or defend legal claims. 

We periodically review personal information held in our systems and may delete, anonymise or archive information where it is no longer reasonably required.

As a general approach:

• information relating to enquiries, leads and prospective customers is retained for up to two years from our last meaningful interaction, where there remains a legitimate reason to retain it; 
• where you object to direct marketing, we will cease using your information for that purpose and may retain limited information to record and respect your objection; 
• customer contact and relationship information is retained for the duration of the customer relationship and for up to six years after the contract ends, where required for legal, contractual, financial or business record-keeping purposes; 
• contact records for individuals who have left a customer organisation are generally retained for no longer than two years from last relevant activity unless there is another reason to retain them; 
• supplier and professional relationship information is retained for the duration of the relationship and for up to six years after last relevant use where appropriate; 
• service and support information, including support tickets, may be retained for the duration of the customer contract and for up to six years after it ends, depending on contractual, operational and legal requirements; 
• marketing information is retained until you opt out or, where there is no ongoing relationship or engagement, for up to two years from your last meaningful engagement with us; 
• suppression records may be retained for as long as necessary to ensure that marketing objections continue to be respected; 
• financial, tax, invoicing and accounting records are retained for the periods required by applicable tax, accounting and company law; 
• technical, website and security information is retained for periods appropriate to its operational and security purpose; 
• call recordings, meeting recordings and standalone AI-generated transcripts or summaries are generally retained for no longer than two years unless a shorter or longer period is justified by the purpose for which they are held; 
• information transferred into a customer service or support record, including a ticket created from an AI-assisted telephone call, is retained in accordance with the retention period applicable to that service or support record; and 
• recruitment information for unsuccessful candidates is generally retained for no longer than six months after the recruitment decision unless you agree to us keeping it for future opportunities or a longer period is required for legal reasons. 

13.1 Backups and archived copies

Personal information may remain in secure backup, archive or disaster-recovery systems for a limited period after it has been deleted from our live systems. 

Backup and archived copies are retained in accordance with our backup, retention and business continuity arrangements. 

They are not ordinarily accessed except where necessary for: 

• system recovery;
• disaster recovery;
• security;
• legal or regulatory requirements; or
• business continuity purposes.

Such copies are deleted, overwritten or otherwise removed in accordance with the relevant backup or archive cycle.

14. Security

We take the security of personal information seriously.

We maintain appropriate technical and organisational measures designed to protect personal information against:

• accidental or unlawful destruction;
• loss;
• alteration;
• unauthorised disclosure; and
• unauthorised access.

Depending on the nature of the information and processing, our measures may include:

• access controls;
• identity and authentication controls;
• security monitoring;
• technical security measures;
• backup and recovery arrangements;
• policies and procedures;
• staff awareness measures;
• contractual controls with suppliers; and
• periodic reviews of security arrangements.

No electronic storage or communications system can be guaranteed to be completely secure.

We nevertheless take reasonable and proportionate measures to protect the information entrusted to us.

15. Your data protection rights

Depending on the circumstances and the lawful basis on which we process your personal information, you may have the following rights.

15.1 Right of access

You may ask us whether we process your personal information and request a copy of information we hold about you. 

We will normally respond within one month of receiving your request. 

Where permitted by law, that period may be paused while we confirm your identity or ask you to clarify the information you are requesting. 

The response period may also be extended by up to two further months where a request is complex or where we have received a number of requests from you. If we extend the period, we will tell you within the initial one-month period.

15.2 Right to rectification

You may ask us to correct inaccurate personal information or complete information that is incomplete.

15.3 Right to erasure

In certain circumstances, you may ask us to delete personal information.

The right to erasure is not absolute, and there may be circumstances in which we are legally entitled or required to retain information.

15.4 Right to restriction

In certain circumstances, you may ask us to restrict the way in which we use your personal information.

15.5 Right to object

Where we rely on legitimate interests, you may have the right to object to our processing of your personal information.

If you object, we will consider the circumstances and your rights in accordance with applicable data protection law.

15.6 Right to object to direct marketing

You have the right to object at any time to the use of your personal information for direct marketing.

If you object, we will stop using your personal information for direct marketing purposes.

15.7 Right to data portability

In certain circumstances, you may be entitled to receive personal information that you provided to us in a structured, commonly used and machine-readable format or ask us to transfer it to another organisation.

15.8 Rights relating to consent

Where we rely on consent, you may withdraw that consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before the consent was withdrawn.

15.9 Rights relating to automated decision-making

You may have rights where a significant decision about you is made solely through automated processing. 

CYAN does not make decisions about individuals based solely on automated processing, including AI, that produce legal or similarly significant effects. 

Where AI tools assist our work, a person reviews the output before it is relied on for any decision that affects you. 

You will not normally have to pay a fee to exercise your data protection rights. 

We may need to request information from you to confirm your identity before responding to a request. 

To exercise your rights, please contact: 

Email: [email protected]

or write to:

for the attention of the Head of Security (GRC)
CYAN Solutions Ltd
Unit 14 The Briars
Waterberry Drive
Waterlooville
Hampshire
PO7 7YH
United Kingdom

16. Data protection complaints

If you are concerned about how CYAN has collected, used or otherwise handled your personal information, you can make a data protection complaint to us.

Please contact:

Trust Centre contact form: https://trust.cyansolutions.co.uk/contact/

Email: [email protected]

or write to:

for the attention of the Head of Security (GRC)
CYAN Solutions Ltd
Unit 14 The Briars
Waterberry Drive
Waterlooville
Hampshire
PO7 7YH
United Kingdom

We will acknowledge a data protection complaint within 30 days, investigate it appropriately under the oversight of our Data Protection Lead and communicate the outcome without undue delay in accordance with applicable law.

You also have the right to raise a concern or make a complaint to the Information Commission (ICO), the UK’s data protection regulator.

Further information is available at: https://ico.org.uk

We would appreciate the opportunity to address any concerns directly with you first. The ICO will usually expect you to have raised the matter with us before it considers a complaint.

17. Children’s information

CYAN provides business-to-business technology and related services.

Our website and general business activities are not directed at children, and we do not knowingly collect personal information from children.

If you believe that a child has provided personal information to us inappropriately, please contact us at: [email protected]

18. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, including to reflect changes to:

• our business;
• our services;
• the way we use personal information;
• our technology;
• our suppliers;
• applicable law; or
• regulatory guidance.

When we update this Privacy Policy, we will publish the revised version and update the Last updated date.

Where a change materially affects how we use personal information, we will take appropriate steps to bring the change to the attention of affected individuals before beginning materially different processing where required.

We recommend reviewing this Privacy Policy periodically.

19. Contact us

If you have any questions about this Privacy Policy, how CYAN uses personal information, or your data protection rights, please contact:

CYAN Solutions Ltd
Unit 14 The Briars
Waterberry Drive
Waterlooville
Hampshire
PO7 7YH
United Kingdom

Email: [email protected]

Website: https://cyansolutions.co.uk