Trading disclosure and privacy notice.

01Trading disclosure

Trading name

Northwatch Group

Operator

Northwatch Group is a trading name of Little Jam Jar Ltd, registered in England and Wales, company no. 17539606. Registered office: The Barn, Bexfields Farm, Galleywood Road, Chelmsford, Essex, CM2 8BY.

Data protection

Registered with the Information Commissioner's Office: ZC283636.

Postal address

The registered office above. Visits by appointment only.

Country

United Kingdom

Email

hello@northwatchgroup.com

Governing law

Engagement terms are governed by the law of England and Wales.

Northwatch Group provides security assessment and advice. It does not supply security staff or install equipment. Engagement terms, including scope, authorisation and confidentiality, are agreed in writing for each piece of work. Nothing on this site is an offer to test any system.

02Privacy notice

Who is responsible

The controller of the personal data described here is Little Jam Jar Ltd trading as Northwatch Group, registered in England and Wales, company no. 17539606. Registered office: The Barn, Bexfields Farm, Galleywood Road, Chelmsford, Essex, CM2 8BY. Registered with the Information Commissioner's Office: ZC283636. Contact: hello@northwatchgroup.com.

This website

The site is static. It sets no cookies, uses no analytics, and makes no requests to any third party from your browser. The fonts are served from this site, and so is the one script it runs, which submits the contact form.

The web server keeps an access log with the time of each request, the page requested, the browser's description of itself, and the visitor's network address as presented to it. The site is delivered through Cloudflare, which sits between your browser and the server and processes your connection to do so; Cloudflare's own privacy notice covers that processing.

Access logs are rotated daily and kept for 14 days, then deleted. They are used only to keep the site running and to deal with abuse.

The contact form

What you type into the form is sent to the server that hosts this site, which Northwatch runs, and stored there with the time of submission and your connection's network address and country. A notification that a message has arrived, carrying nothing you typed, goes to Northwatch through a notification server Northwatch also runs. Nothing goes to a third-party form service. A daily job on that server deletes every stored message 183 days after it arrived. The legal basis is legitimate interest in responding to you.

Two emails follow a message: a copy of it to Northwatch's mailbox, and a short confirmation to the address you gave, which says only that the message arrived and never repeats what you wrote. Both are sent through Cloudflare Email Sending. Cloudflare acts as Northwatch's processor for this, under its data processing addendum, and may not use your data for its own purposes. It is based outside the UK; transfers to it are covered by the UK's adequacy regulations for companies certified to the UK Extension to the Data Privacy Framework, as Cloudflare is, and by its standard contractual clauses with the UK Addendum. Northwatch's mailbox is hosted by Proton AG in Switzerland, a country the UK government recognises as providing an adequate level of data protection. Neither email contains images, links that track you or anything loaded from the web. The copy is then kept as an email, covered by the next section.

Email

If you write to Northwatch, the email and any reply are kept for as long as needed to deal with your enquiry and, if it leads to work, for the duration of the engagement and the retention period agreed in its terms. The legal basis is legitimate interest in responding to you and, where there is an engagement, performance of a contract.

Engagements

During an engagement, the information collected is set out in the written scope, and its handling in the engagement terms. In short: findings belong to the client; raw evidence is deleted 30 days after the report is delivered; the report itself is kept for comparison in later reviews and deleted on request.

Your rights

Under UK data protection law you can ask what personal data is held about you, ask for it to be corrected or deleted, and object to its processing. Write to the email address above. You can also complain to the Information Commissioner's Office.