Privacy Policy

This Privacy Policy explains how Cognumi Ltd (“we”, “us”, “our”), operating the BrightCert service at brightcert.co.uk, collects, uses, and protects your personal data. We are the data controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Cognumi Ltd is a company registered in England and Wales, based in London. For any privacy questions or to exercise your rights, contact us at hello@brightcert.co.uk.

2. What data we collect

• Account data: your email address and organisation name.
• Organisation details: business size and sector.
• Assessment data: the answers you provide across the five Cyber Essentials control areas, and the scores and gap analysis generated from them.
• Payment data: processed by Stripe. We do not store your card details.
• Technical data: basic log and device information collected automatically when you use the service.
• Outreach and prospect data: business contact details, job role, company details, public business context, the source and date we collected it, and records of contact, replies, objections, and suppression. We use this only for corporate B2B outreach, not personal consumer marketing.

3. How we use your data

• To provide the readiness assessment and generate your report.
• To create and manage your account and process payments.
• To send you service-related emails (sign-in links, report notifications).
• To operate, secure, and improve the service.
• To identify and contact relevant UK corporate prospects about BrightCert, manage replies and opt-outs, and measure our B2B outreach responsibly.

Our legal bases are performance of a contract with you, our legitimate interests in operating, improving, and marketing our service to relevant businesses, and your consent where required. For B2B outreach, we assess our legitimate interests against the rights and expectations of the people we contact before sending anything.

4. Automated processing (AI)

Your assessment answers are sent to Google’s Gemini API to generate control-area scores, plain-English gap descriptions, and remediation guidance. This processing supports, but does not replace, your own decision-making. BrightCert does not make legally significant decisions about you on a solely automated basis.

5. Who we share data with

We use the following processors and sharing categories to run the service and our outreach operations:

• Supabase — database and authentication (data hosted in the EU/London region).
• Google Cloud — the Gemini API (assessment analysis) and Cloud Storage (report PDFs, EU region).
• Stripe — payment processing.
• Resend — transactional email delivery.
• Vercel — application hosting.
• Clay and licensed data providers — B2B prospect research and enrichment, where we use them. We may also collect public business context from company websites, public professional profiles, and public registers including Companies House.
• Professional advisers and authorities — only where needed for legal, accounting, fraud-prevention, or regulatory purposes.

We do not sell your personal data. Where data is transferred outside the UK, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or adequacy regulations.

6. Data retention

We keep data only for as long as it is needed for the purpose collected:

• Account and assessment data: while your account is active, then only as needed for legal, accounting, or reporting obligations.
• Active B2B outreach records: for the sequence and up to 90 days after it ends, unless you become a customer or ask us to stop sooner.
• Other non-converted prospect records: deleted or de-identified no later than 180 days after the sequence ends.
• Suppression records: the minimum identifier and evidence needed to honour an opt-out are retained for as long as reasonably necessary to make sure we do not contact you again.

7. Your rights

Under UK GDPR you have the right to:

• Access a copy of your personal data.
• Request correction of inaccurate data.
• Request erasure of your data.
• Restrict or object to certain processing.
• Data portability.
• Withdraw consent where processing is based on consent.
• Object at any time to direct marketing. We will stop direct marketing when you object; this right is unconditional.

To exercise any of these, email hello@brightcert.co.uk. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

To opt out of outreach: reply “stop” or “opt out” to any BrightCert outreach email, or email hello@brightcert.co.uk. We will add the minimum details needed to our suppression list and stop sending direct marketing.

8. Cookies

We use essential cookies required for authentication and to keep you signed in. These are necessary for the service to function.

We also use Google Analytics to understand how visitors use the site (e.g. which pages are viewed). This sets analytics cookies and shares usage data with Google. It does not include your assessment responses. If you arrived via a marketing link (e.g. an email or campaign), we also record which campaign referred you, so we can tell which channels are working. Neither of these run until you accept the cookie banner shown on your first visit — declining, or never responding, means neither loads or is set. You can change your choice at any time via “Cookie Settings” in the footer, or in Settings if you have an account — withdrawing consent also removes the analytics cookies already set.

9. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the “Last updated” date above.