Check if you’d auto-fail

Privacy notice

Last updated: 2 November 2026

1. Who we are (Data Controller)

Five Controls (five-controls.co.uk) is operated by AlphaSec, a trading name of Alphabyte IT Limited (“we”, “us”, “our”). Alphabyte IT Limited is the data controller for personal data collected through this website.

  • Company number: 07014261 (registered in England and Wales)
  • Registered office: 9/10 Connies House, Rhymney River Bridge Road, Cardiff CF23 9AF
  • ICO registration number: ZA040494
  • Email for privacy queries: hello@five-controls.co.uk
  • Telephone: 029 2240 4615

2. What personal data we collect and why

We collect only the information needed to deliver the tools, reports, reminders and preparation advice you ask for:

  • Auto-fail checker & Scope builder: You can use the on-screen checker and scope builder in your browser without giving us your name or email. If you request the full report or emailed summary, we collect your first name, work email address, company name, optional phone number, and your tool answers (such as staff band, certification reason, deadline, email platform and count of red items) so we can generate your report and tailor any follow-up advice you request.
  • Evidence pack generator: We collect your first name, work email address, company name and organisation profile inputs to generate your policy and register templates.
  • Renewal reminder service: We collect your work email address, company name, certification level and certificate/expiry date to send you reminders at 90, 60 and 30 days before expiry.
  • Get help & Contact forms: We collect your name, work email, phone number, company name, staff band, deadline and message so we can respond to your enquiry and provide a quote.
  • Optional marketing updates: Only if you tick our separate, unticked marketing opt-in checkbox (“Send me occasional Cyber Essentials updates and offers”) will we add you to our update list. You can unsubscribe at any time.

3. Lawful bases under UK GDPR and PECR

  • Delivering a report, template pack or renewal reminder you requested: Legitimate interests (Article 6(1)(f) UK GDPR) in fulfilling your direct request, or steps taken at your request prior to entering into a contract (Article 6(1)(b)). Sending a one-off report or reminder service you specifically asked for is not marketing.
  • Responding to Get help or Contact enquiries: Steps prior to entering into a contract (Article 6(1)(b)) and legitimate interests (Article 6(1)(f)).
  • Email marketing and nurture sequences: Consent (Article 6(1)(a) UK GDPR and Regulation 22 of the Privacy and Electronic Communications Regulations 2003 (PECR)) via our separate, unticked opt-in checkbox.
  • Security and spam prevention: Legitimate interests (Article 6(1)(f)) in protecting our website and forms against abuse.

4. Processors and where data is stored

We share personal data only with trusted processors acting under written data processing agreements:

  • Hosting and serverless functions: Netlify, Inc. hosts the static website, processes form submissions (with serverless functions executing in London, UK eu-west-2 and form/blob storage in the United States) and keeps short-term security logs.
  • Email and internal systems: Microsoft 365 (Microsoft Corporation) receives lead notifications and enquiries sent to hello@five-controls.co.uk and ross@alphabyte.it.
  • Website analytics: We do not use third-party advertising trackers or cross-site tracking cookies on Five Controls.

Where any processor transfers data outside the UK or European Economic Area (including Netlify, Inc. and Microsoft Corporation in the United States), transfers are safeguarded by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses or the UK Extension to the EU–US Data Privacy Framework (the UK–US Data Bridge).

5. How long we keep your data

  • Tool report requests and general enquiries (where you do not become a client): Up to 24 months from our last interaction, then deleted.
  • Renewal reminders: Kept until your reminder cycle completes (or until you cancel the reminder).
  • Marketing opt-in list: Kept until you unsubscribe or after 24 months of inactivity. When you unsubscribe, we keep a minimal suppression record of your email address so we do not email you again.
  • Client records: For the duration of our contract plus 6 years for legal and accounting obligations.

6. Your data protection rights

Under UK data protection law, you have the right to access a copy of your personal data, correct inaccurate data, request erasure, restrict processing, object to processing (including an absolute right to object to direct marketing), withdraw consent at any time, and request data portability where applicable.

To exercise any right, email hello@five-controls.co.uk. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or by calling 0303 123 1113.