1.1 Computer Network Defence are a cyber security consultancy and recruitment agency. This privacy notice tells you what to expect when Computer Network Defence collects personal information to allow us to undertake our business. It applies to personal information we collect about:

1.1.1 Prospective and live client contacts

2.1 This is information about you that you give us by filling in our application or enquiry forms on our website www.cndltd.com or by corresponding with us by the following mediums:

2.1.1 Website - Our website and all corresponding software are hosted by us on a dedicated server based in the United Kingdom and we actively service and maintain its security. To be able to do this, we process the IP addresses of visitors to the website. When someone visits our website, we collect information to monitor and report on the effectiveness of the site and help us improve it.

• • We use Google Analytics, a web analytics service provided by Google, to perform this task, collecting information including Internet Protocol (IP) address and visited page, as well as any other actions taken while interacting with the website, for example links clicked on. Google Analytics uses cookies to help us analyse how users are interacting with the Website as described later in our Cookie Policy.
  • We support both https and http (encrypted and unencrypted traffic) on our website to enable all visitors to access our content.  If encryption of your web browsing activity is desirable, please use ‘https:’ in the URLs and verify the connection is secure through whatever method your browser uses to indicate an encrypted connection.

2.1.2 Social Media and Job Sites - We operate Facebook, Twitter, and LinkedIn accounts and are represented on various job sites. If you send us a private or direct message via social media or job sites, the message will be stored relevant to their data retention policies. It will not be shared with any other organisations.

2.1.3 Telephone - When you call CND’s office, we collect Calling Line Identification (CLI) information. We use this information to help improve its efficiency and effectiveness. Our phones are answered by a third-party company. The company that provides this service will email us the caller’s details should we be unavailable and do not retain any further information from the calls or record them.

2.1.4 Email - Any email sent to us, including any attachments, may be monitored, and used by us for reasons of security and for monitoring compliance with office policy. Email monitoring or blocking software may also be used. Please be aware that you have a responsibility to ensure that any email you send to us is within the bounds of the law.

2.1.5 Visitors - If you visit our offices or attend an event organised by us, you will be required to register as a visitor or guest. Our offices operate security cameras to monitor office security and the health and safety of staff and visitors.

2.2 The information you give us, or we collect about you may include your name, address, private and corporate e-mail address and phone number, financial information, compliance documentation and references verifying your qualifications and experience and your right to work in the United Kingdom, curriculum vitae and photograph, links to your professional profiles available in the public domain e.g., LinkedIn, Twitter, business Facebook or corporate website.

3.1 We use information held about you for the following purposes:

3.1.1 To carry out our obligations arising from any contracts we intend to enter into or have entered into between you and us and to provide you with the information, products and services that you request from us, or we think will be of interest to you because it is relevant to your career or to your organisation.

3.1.2 To provide you with information about other goods and services we offer that are similar to those that you have already purchased, been provided with or enquired about.

3.1.3 To introduce candidates to our clients for the purpose of temporary or permanent engagement. This is the core service we offer; however, our service expands to supporting individuals throughout their career and to supporting businesses’ resourcing needs and strategies.

3.1.4 To analyse website usage and visitor behaviour patterns.

3.2 Our main legal basis for the processing of personal data is legitimate business interests, described in more detail in the next section, although we will also rely on contract, legal obligation and consent for specific uses of data.

3.2.1 Where we have entered into a contract - We will rely on contract if we are negotiating or have entered into a placement agreement with you or your organisation or any other contract to provide services to you or receive services from you or your organisation.

3.2.2 Where we have a legal obligation - We will rely on legal obligation if we are legally required to hold information on you to fulfil this. An example of this is when we are required to cooperate with the appropriate regulatory and government authorities.

3.2.3 Where we have obtained your consent - We will in some circumstances rely on consent for particular uses of your data. If legally required, you will be asked for your express consent, either orally, by email or by an online process, for the specific activity we require consent for.  Examples of when consent may be the lawful basis for processing include permission to introduce you to a client (if you are a candidate or a partner). You have the right to withdraw your consent to this particular processing at any time by emailing cnd.dpo@CNDLtd.com.

4.1 Where we have not entered into a contract with you, or obtained your consent, or have stated that another legal basis shall apply, then legitimate interest is the legal basis for the following processing activities:

4.1.1 As a recruitment and consultancy business and recruitment agency, we introduce candidates or partners to clients for permanent employment, temporary worker placements or independent professional contracts. The exchange of personal data of our candidates, partners and our client contacts is a fundamental, essential part of this process.

4.1.2 To support our candidates’ career aspirations and our clients’ resourcing and requirement needs, we require a database of candidate and client personal data containing historical information as well as current resourcing requirements.

4.1.3 To maintain, expand and develop our business, we need to record the personal data of prospective candidates, partners, and client contacts as follows:

• • Following an enquiry, we will keep client and candidate information for 3 years, unless contacted by them and directed otherwise.
  • Following an engagement, we will keep client or candidate information for 6 years, unless contacted by them and directed otherwise.

4.1.4 To register office visitors and monitor office security, health and safety.

4.1.5 To assess and improve your experience on our website (such as analysing trends in order to improve your overall experience, or to track your usage of and interactions with the website).

5.1 We may be required to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our terms of use or Master Framework Agreement or Supply of Services Agreement and other agreements; or to protect the rights, property, or safety of Computer Network Defence, our customers, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

5.2 We will share your personal information with selected third parties including:

5.2.1 Clients for the purpose of introducing candidates to them.

5.2.2 Candidates for the purpose of arranging interviews and engagements.

5.2.3 Clients, business partners, suppliers and sub-contractors for the performance and compliance obligations of any contract we enter into with them or you. For example:

• • We may send a client’s details to one of our penetration testing partners should a client send us an enquiry and choose a partner’s particular skillset.
  • We may send a candidate the Hiring Manager’s name and experience so they can effectively prepare for an interview.

5.2.4 Subcontractors including our accountants and other financial service providers.

5.2.5 Analytics and search engine providers that assist us in the improvement and optimisation of our site.

5.2.6 Credit reference agencies, our insurance broker, compliance partners and other subcontractors, such as job sites, for the purpose of assessing your suitability for a role where this is a condition of us entering into a contract with you.

5.3 We do not control your data once it is disclosed to a third party and therefore you should satisfy yourself of their Privacy Policy and how they may collect and distribute information. The lawful basis for the third-party processing may include:

5.3.1 Their own legitimate business interests in processing your personal data, in most cases to fulfil their internal resourcing needs.

5.3.2 Satisfaction of their contractual obligations to us as our data processor

5.3.3 For the purpose of a contract in place or in contemplation

5.3.4 To fulfil their legal obligations

5.4 CND will never sell your Personal Data.

6.1 The data that we collect from you will be transferred to and stored in the European Economic Area. It may also be transferred to third parties outside of the EEA for the purposes of Google Analytics and our financial and recruitment services. By submitting your personal data, you agree to this transfer, storing or processing.

6.2 Computer Network Defence will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Notice. We (and our third-party service providers) use a variety of industry standard security measures to prevent unauthorised access, use, or disclosure of your Personal Data. These security measures consist of, but are not limited to, data encryption and physical security controls.

6.3 All information you provide to us is stored on our secure servers. Any payment transactions will be encrypted using SSL technology.

6.4 Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

7.1 We will retain your Personal Data for the period necessary to fulfil the purposes outlined in this Privacy Notice or until you request its deletion, unless a longer retention period is required by applicable legal obligations.

7.2 Accordingly, we have a data retention notice and run data routines to remove data that we no longer have a legitimate business interest in maintaining.

7.3 We do the following to try to ensure our data is accurate:

7.3.1 Prior to making an introduction, we check that we have accurate information about you.

7.3.2 We keep in touch with you so you can let us know of changes to your personal data.

7.4 We segregate our data so that we keep different types of data for different time periods.  The criteria we use to determine whether we should retain your personal data includes:

7.4.1 The nature of the personal data

7.4.2 Its perceived accuracy

7.4.3 Our legal obligations

7.4.4 Whether an interview or placement has been arranged

7.4.5 Whether a requirement has been scoped, quoted or service delivered.

7.5 We may archive part or all of your personal data or retain it on our financial systems only, deleting all or part of it from our main Customer Relationship Manager (CRM) system. We may pseudonymise parts of your data, particularly following a request for suppression or deletion of your data, to ensure that we do not re-enter your personal data on to our database, unless requested to do so.

7.6 Our current retention notice is available upon request.

8.1 You have certain rights relating to your Personal Data, subject to local data protection laws. Depending on the applicable laws and if you are located in the EEA or other applicable location, these rights may include:

8.1.1 Right to be Informed – request what is being or will be done with the personal information that we hold about you.

8.1.2 Right to Access – request to see all the data we hold about you.

8.1.3 Right to Rectification - request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.

8.1.4 Right to Erasure - request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us to continue to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).

8.1.5 Right to Restrict Processing – request to limit the use or disclosure of your personal data. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.

8.1.6 Right to Data Portability - request the transfer of your personal information to another party in certain formats, if practicable.

8.1.7 Right to Object - to stop any processing of your Personal Data carried out on the basis of our legitimate interests. Where we process your Personal Data for direct marketing purposes or share it with third parties for their own direct marketing purposes, you can exercise your right to object at any time to such processing without having to provide any specific reason for such objection. If the collection of your Personal Data is based on consent, you can withdraw your consent at any time.

8.1.8 Rights Relating to Automated Decision Making and Profiling - to not be subject to a decision based solely on automated processing, which produces legal effects, including profiling. Computer Network Defence does not undertake any Automated Decision-Making.

8.2 You can exercise these rights at any time by contacting us at cnd.dpo@cndltd.com or the address provided as the end of this notice.

9.1 What Are Cookies - As is common practice with almost all professional websites, this site uses cookies, which are tiny files that are downloaded to your computer, to improve your experience. This page describes what information they gather, how we use it and why we sometimes need to store these cookies. We will also share how you can prevent these cookies from being stored, however, this may downgrade or ‘break’ certain elements of the site’s functionality.

9.2 How We Use Cookies - We use cookies for a variety of reasons detailed below. Unfortunately, in most cases, there are no industry standard options for disabling cookies without completely disabling the functionality and features they add to this site. It is recommended that you leave on all cookies if you are not sure whether you need them or not, in case they are used to provide a service that you use.

9.3 Different Types of Cookies:

9.3.1 Essential Cookies - Essential cookies, also known as “strictly necessary” cookies, are cookies that are required for the website to function properly. These are usually set in response to an action made by the user, such as setting your privacy preferences, logging in, or filling in forms. These cookies do not store any personally identifiable information. For example, session cookies are often essential cookies. They are used to maintain a logged-in status for a user between pages.

9.3.2 Non-Essential Cookies - Non-essential cookies are any cookies that are not absolutely necessary for the website to function. This includes cookies used to track users for advertising purposes, such as Google Analytics and Google AdSense cookies, and cookies used for functionality, performance, and targeting purposes. Non-essential cookies are used to enhance the user experience. For example, they can remember information about your preferences and settings, they can show you relevant ads, and they can provide insights to website owners about how their site is being used.

9.4 The Cookies We Set

9.4.1 Session Cookies - We use session cookies to operate our site. Session cookies are temporary cookies that are only stored on your device while you are visiting our site.

9.4.2 Google Analytics - This site uses Google Analytics which is one of the most widespread and trusted analytics solutions on the web for helping us to understand how you use the site and ways that we can improve your experience. These cookies may track things such as how long you spend on the site and the pages that you visit so we can continue to produce engaging content.

9.4.3 Google Adsense - The Google AdSense service we use to serve advertisements uses a DoubleClick cookie to serve more relevant ads across the web and limit the number of times that a given ad is shown to you. For more information on Google AdSense see the official Google AdSense privacy FAQ: How AdSense uses cookies - Google AdSense Help and Cookie information for Google's ad products (safety.google).

9.5 Disabling Cookies - You can prevent the setting of cookies by adjusting the settings on your browser (see your browser Help for how to do this). Be aware that disabling cookies will affect the functionality of this and many other websites that you visit.

9.5.1 Disabling cookies will usually result in also disabling certain functionality and features of this site. Therefore, it is recommended that you do not disable cookies.

9.5.2 Most browsers allow you to refuse to accept cookies and to delete cookies. The methods for doing so vary from browser to browser, and from version to version. You can, however, obtain up-to-date information about blocking and deleting cookies via these links:

• • Chrome - https://support.google.com/chrome/answer/95647
  • Firefox - https://support.mozilla.org/en-US/kb/enhanced-tracking-protection-firefox-desktop
  • Opera - https://help.opera.com/en/latest/security-and-privacy/
  • Internet Explorer - https://support.microsoft.com/en-gb/help/17442/windows-internet-explorer-delete-manage-cookies
  • Safari - https://support.apple.com/en-gb/guide/safari/manage-cookies-and-website-data-sfri11471/mac
  • Edge - https://support.microsoft.com/en-gb/help/4468242/microsoft-edge-browsing-data-and-privacy

10.1 Computer Network Defence tries to meet the highest standards when collecting and using personal information. For this reason, we take any complaints we receive about this very seriously. We encourage you to bring it to our attention if you think that our collection or use of information is unfair, misleading, or inappropriate. We would also welcome any suggestions for improving our procedures.

10.2 This privacy notice was drafted with brevity and clarity in mind. It does not provide exhaustive details of all aspects of our collection and use of personal information. However, we are happy to provide any additional information or explanation needed. Any requests for this should be sent to the relevant address provided below.

10.3 You can make a complaint to a supervisory body which in the United Kingdom is the Information Commissioner’s Office. The ICO can be contacted through this link.

12.1 This privacy notice does not cover the links within this site linking to other websites. We encourage you to read the privacy statements on the other websites you visit.

13.1 We keep our privacy notice under regular review. This privacy notice was last reviewed on 24th July 2024.

14.1 If you want to request more information on our privacy policy or personal details of yours we may hold, you can contact us via:

cnd.dpo@cndltd.com
FAO: Data Protection Officer
Computer Network Defence Ltd
The Stables
Digital Mansion
Pickwick Road
Corsham
SN13 9BL