Privacy Policy

Last updated: 06 October 2026

CyberSprouts takes privacy, confidentiality and data protection seriously. This Privacy Policy explains how we collect, use, store and share personal information when people use our website, subscribe to our content, contact us, complete digital safety assessments, request consultancy or advisory services, or otherwise use our services.

CyberSprouts provides digital safety, cyber security, digital resilience and privacy guidance for individuals, families, households, older adults, vulnerable individuals and private clients. Because our work may involve information about household technology, online accounts, children’s device use and digital safety concerns, we aim to collect only the information we need and to handle it carefully.

1. Who we are

CyberSprouts is operated by Cyber Sprouts Limited, a company registered in England and Wales.

• Company number: 13031873
• Registered office: 61 Bridge Street, Kington, United Kingdom, HR5 3DJ
• Privacy contact: hello@cybersprouts.com
• ICO registration number: ZC266780

For the purposes of UK data protection law, Cyber Sprouts Limited is the controller of the personal information described in this Privacy Policy, except where another organisation acts as its own controller for its own services.

Data protection enquiries should be sent to our Privacy Contact using the email address above.

2. What this policy covers

This Privacy Policy applies to personal information we collect and use in connection with:

• our website;
• newsletter and content subscriptions;
• contact forms and enquiries;
• digital safety assessments, including the CyberSprouts Digital Safety Check;
• digital safety consultancy, advisory and support services;
• reports, recommendations and guidance provided as part of those services;
• customer relationship management and business administration;
• communications with prospective clients, clients, suppliers and business contacts.

3. The people whose information we may process

Depending on the service, we may process information about:

• clients and prospective clients;
• parents, guardians and carers;
• children and young people in a household;
• older relatives or vulnerable individuals;
• other household or family members;
• emergency or trusted contacts, where relevant;
• newsletter subscribers;
• website visitors;
• suppliers, partners and business contacts.

Where our work relates to children, we normally collect information from a parent, guardian or responsible adult. We do not usually collect information directly from children.

4. Information we collect

The information we collect depends on the service requested. It may include:

• name and contact details, such as email address;
• household composition, such as number of adults, children or supported relatives;
• children’s age bands, rather than exact dates of birth where possible;
• devices used in the household, such as phones, tablets, laptops, games consoles, smart speakers and connected devices;
• online services, platforms and account types used by the household;
• information about digital safety priorities, concerns and risks;
• information about security controls, such as use of password managers, multi-factor authentication, parental controls, backups and device protections;
• answers provided through digital safety assessments and questionnaires;
• scores, findings, priorities and recommendations generated from assessment answers;
• service access and assessment identifiers, such as invitation or submission identifiers;
• notes from consultations and advisory work;
• recommendations, reports and action plans;
• newsletter subscription and engagement information;
• business records, invoices and payment-related information;
• website, analytics, technical and security information, such as device/browser data, IP address, logs and cookie data.

We do not ask clients to provide passwords, recovery codes, full payment card details, unnecessary identity documents, or unnecessary sensitive personal information.

Some information is necessary for us to provide a requested service. For example, we may need contact details to communicate with you or deliver a report, payment and fulfilment information to process an order, and required assessment answers to complete a digital safety assessment. Where information is required, we will make this clear. If you do not provide it, we may be unable to provide or complete the relevant service. Other information may be optional.

5. Children’s information

Some of our services are designed to help parents, guardians and carers improve children’s online safety. In that context, we may process limited information about children, such as:

• age band;
• types of devices used;
• platforms, games or services used;
• household rules and parental controls;
• digital safety risks or concerns raised by a parent or guardian.

We aim to minimise children’s information wherever possible. The CyberSprouts Digital Safety Check does not require children’s names, passwords, private messages, exact dates of birth, school details or identity documents, and this information should not be provided as part of the assessment.

For other CyberSprouts services, if there is a clear and exceptional reason why additional information about a child is needed, we will explain why before collecting it.

We do not use children’s information for marketing.

6. Sensitive information and practical needs

We do not normally ask for medical, disability or other special-category information, and our digital safety assessments do not require this information.

Clients using consultancy or advisory services may choose to tell us about practical needs, limitations or family circumstances where this helps us provide suitable digital safety advice. For example, a client may explain that a family member needs simpler authentication options, help managing accounts, or support from a trusted person.

We ask clients not to provide unnecessary medical, disability, safeguarding, financial hardship, criminal offence or other sensitive information. If such information is provided and is not needed, we may delete it, minimise it or avoid recording it in detail.

Where we genuinely need to process special-category or other particularly sensitive information, we will ensure that there is an appropriate legal basis and, where required, an additional condition for processing it.

7. Where we get information from

We may collect information from:

• you directly;
• parents, guardians, carers or other authorised household members;
• enquiry forms, assessments and questionnaires;
• the CyberSprouts Digital Safety Check and other digital safety assessments;
• email correspondence;
• consultation notes;
• newsletter and content platforms;
• website, analytics, hosting and security systems;
• payment, accounting or business administration systems.

8. How we use personal information

We use personal information to:

• respond to enquiries;
• provide digital safety assessments;
• calculate assessment scores and identify areas where improvements may be possible;
• prepare digital safety reports, recommendations and action plans;
• provide consultancy, advisory and support services;
• understand household technology use and digital safety risks;
• send newsletters and content updates to subscribers;
• communicate with clients about services they have requested;
• manage client relationships;
• operate, secure and improve our website and services;
• manage purchases, payments, invoices, tax and accounting records;
• comply with legal, regulatory or professional obligations;
• protect our rights, systems, clients and business.

Digital safety assessment scoring

Some digital safety assessments, including the CyberSprouts Digital Safety Check, use the answers provided in the assessment to calculate an overall digital safety score, category-level results, areas where improvements may be possible, and recommended actions.

Where an assessment requires particular questions to be completed before it can be submitted and scored, we will make this clear. Where an answer such as “Not sure” is available, this is a valid response and allows the assessment to be completed without guessing. If a required assessment is not completed and submitted, we may be unable to generate the completed assessment results.

Scoring is carried out automatically using the CyberSprouts digital-safety framework and the rules associated with the relevant assessment. The resulting scores and recommendations are intended to provide practical guidance about digital-safety arrangements. They do not make decisions about a person’s legal rights or determine access to credit, insurance, employment, education or other third-party services.

We do not use digital safety assessment answers or scores for targeted advertising and we do not sell them to third parties.

9. Lawful bases for using personal information

We rely on the following lawful bases under UK data protection law:

Where we rely on legitimate interests, those interests may include responding to enquiries, providing and improving our services, using limited information about household or family members where reasonably necessary to provide a service requested by a client, maintaining appropriate client records, protecting our systems and users, preventing fraud or misuse, managing our business, and establishing or defending legal rights.

We consider whether those interests are necessary and proportionate and whether they are overridden by the rights and freedoms of the people whose information we process.

Your right to object

Where we rely on legitimate interests, you may have the right to object to our use of your personal information. You always have the right to object to the use of your personal information for direct marketing. If you object to direct marketing, we will stop using your personal information for that purpose.

10. Newsletters and content updates

If you subscribe to our newsletter or content updates, we use your contact details to send you the information you requested.

We may collect basic engagement information, such as whether an email was delivered, opened or clicked. This helps us understand whether our content is useful and improve future communications.

You can unsubscribe from newsletter emails at any time by using the unsubscribe link in the email or by contacting hello@cybersprouts.com.

11. Cookies, analytics and similar technologies

CyberSprouts uses cookies, analytics, server logs and similar technologies in connection with our website and online services. Third-party services we use may also use these technologies.

We use analytics technologies, including Google Analytics, to help us understand how visitors use our website and content and to improve our website and services.

These technologies may be used to:

• make our website, assessments, newsletter and online services work properly;
• remember user preferences;
• understand how visitors use our website and content;
• measure website and newsletter performance;
• protect the security and integrity of our services.

Some cookies and similar technologies are necessary for the service to function. Others, such as certain analytics or marketing technologies, may require consent depending on how they are used.

Where consent is required, we will provide appropriate controls or consent options. You can also manage cookies through your browser settings.

We do not currently use cookies for targeted advertising or behavioural advertising.

12. Who we share information with

We do not sell personal information.

We may share personal information with trusted third parties where necessary to operate our business, provide services or comply with legal obligations. These may include:

• website hosting and cloud infrastructure providers;
• email, document storage and productivity providers;
• form, survey, assessment and customer management providers;
• newsletter and content distribution platforms;
• website analytics providers;
• payment, invoicing and accounting providers;
• professional advisers, such as accountants, insurers or legal advisers;
• regulators, authorities or law enforcement where required by law or necessary to protect rights, safety or security.

We use categories of suppliers in this Privacy Policy rather than listing every individual tool. We keep our supplier arrangements under review and limit access to personal information according to the services those suppliers provide.

Where a supplier processes personal information on our behalf, we take appropriate steps to ensure that the relationship is governed by suitable data-protection terms.

Some third-party services may act as independent controllers for their own purposes, for example where you create an account with them directly or use their platform under their own terms.

13. International transfers

Some of the services we use may process personal information outside the United Kingdom.

Where personal information is transferred internationally, we take appropriate steps to ensure that the transfer complies with UK data protection law.

Depending on the destination and the organisation receiving the information, this may include relying on UK adequacy regulations or using approved contractual safeguards or other transfer mechanisms recognised under UK data protection law. We may also use technical and organisational measures to reduce the risks associated with international processing.

You can contact us at hello@cybersprouts.com if you would like more information about the safeguards relevant to your personal information.

14. How long we keep information

We keep personal information only for as long as we need it for the purposes described in this Privacy Policy, including legal, accounting, tax, security and dispute-resolution purposes.

Our usual retention approach is:

These periods may vary where we need to keep information for legal, regulatory, insurance, security or dispute-resolution reasons.

Clients may ask us to delete working notes or non-essential information sooner, and we will do so where we are not required to retain it.

15. How we protect information

We use appropriate technical and organisational measures to protect personal information. These may include:

• multi-factor authentication on business accounts;
• use of password management;
• access controls and least-privilege access;
• encryption in transit and at rest where available;
• device security controls;
• secure storage and deletion practices;
• separation of business information from personal accounts where practical;
• supplier review and due diligence;
• backup and recovery controls;
• limiting the amount of personal information we collect and retain.

No system is completely secure. We encourage clients not to send unnecessary sensitive information and not to send passwords or recovery codes.

16. Client responsibilities when sharing information

To help us protect information, clients should:

• avoid sending passwords, recovery codes or unnecessary identity documents;
• avoid sending unnecessary sensitive information;
• not provide children’s names, exact dates of birth, school details or other unnecessary identifying information through digital safety assessments unless specifically requested for a legitimate reason;
• use age bands for children rather than exact dates of birth where appropriate;
• only provide information about other household or family members where they have a proper reason to do so;
• tell us if information needs special handling;
• use agreed communication methods for sensitive material.

If we receive information that appears unnecessary for the service, we may delete it or ask for a safer way to proceed.

17. Your rights

Depending on the circumstances, you may have the right to:

• ask for a copy of your personal information;
• ask us to correct inaccurate or incomplete information;
• ask us to delete personal information;
• ask us to restrict how we use personal information;
• object to certain uses of personal information;
• ask for personal information to be transferred to you or another provider;
• withdraw consent where we rely on consent;
• complain about how we have handled your personal information.

These rights are not absolute and may depend on the lawful basis, the type of information and why we hold it.

To exercise your rights, contact hello@cybersprouts.com.

18. Data protection complaints

If you are concerned about how CyberSprouts has collected, used, stored, shared or otherwise handled your personal information, you can make a data protection complaint by emailing hello@cybersprouts.com.

Please provide enough information for us to understand the issue and investigate it. You do not need to use any particular wording or format when making a complaint.

We will acknowledge your complaint promptly and take appropriate steps to investigate it. We will keep you informed about its progress where appropriate and tell you the outcome without undue delay.

You also have the right to complain to the UK Information Commissioner’s Office about our use of your personal information. You do not have to complete our complaints process before contacting the ICO.

The ICO can be contacted through its website or by post at:

19. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, for example if our services, suppliers, website features, assessment processes or legal obligations change.

The latest version will be published on our website with the date it was last updated.