Terms, privacy and legal notice
1. Introduction
Cysnova is the service brand under which CHC Dynamics Ltd provides cybersecurity and compliance services. CHC Dynamics Ltd is the legal entity responsible for the provision of those services, the operation of this website and the processing of personal data described in this notice.
This website provides information about the services available under the Cysnova brand, together with the means to purchase and receive those services online.
These Terms, Privacy and Legal Notice provisions apply to the use of this website and, where applicable, to the purchase and delivery of Cysnova services.
By placing an order for a Cysnova service, you confirm that you have read and accepted these terms and the terms applicable to the service purchased. The resulting contract is between you and CHC Dynamics Ltd.
2. Cysnova Services
Cysnova is the service brand of CHC Dynamics Ltd and provides defined cybersecurity and compliance services to business customers.
Each service has its own stated scope, price, required information, deliverables and expected delivery timeframe. Services are purchased online and performed using the information and documentation provided by the client.
Unless expressly stated and agreed otherwise, Cysnova services do not include technical implementation, system administration, penetration testing, legal advice or activities outside the stated scope of the service purchased.
Free Sample
Cysnova may provide a free sample consisting of up to 10 security questionnaire responses based on information and supporting material supplied by the Client. The questions are selected by Cysnova and the sample is provided for demonstration and evaluation purposes. One free sample is available per organisation. The free sample is provided at no cost and does not create any obligation to purchase further services. Cysnova may identify questions requiring clarification or additional information and does not guarantee that every question can be answered based solely on the information provided.
The free sample is treated as a Service for the purposes of this document, including the confidentiality and data retention provisions set out in other sections of this document.
3. Orders, Payment and Contract
Services offered through Cysnova are intended for business customers acting in the course of their trade, business, craft or profession.
The applicable price, scope and deliverables are stated on the related service page at the time of purchase.
By submitting an order and completing payment, the customer confirms acceptance of these Terms and of the scope and conditions applicable to the service purchased. A confirmation of the order will be immediately provided electronically.
Work will begin once payment has been received and the information and documentation required for the service have been submitted through the applicable process.
The delivery timeframe begins once all information and documentation reasonably required to perform the service have been received, including any additional information or clarification specifically requested from the client during the course of the work.
Where the information initially provided is insufficient or clarification is reasonably required to complete the work, the delivery timeframe may therefore be extended until the requested information or clarification has been received.
Work outside the scope of the purchased service is not included. Where additional work is required, a separate service or other written arrangement before undertaking that work may be proposed.
4. Client Information and Documentation
To provide Cysnova services, information and documentation relating to the client organisation, its activities, security arrangements, contractual requirements, suppliers or other matters relevant to the service purchased may be required.
Clients should provide information and documentation that is relevant to the agreed scope and should avoid providing information that is unnecessary for the service.
Where possible, personal data that is not required for the work should be removed or redacted before documents are submitted.
Clients must not submit passwords, authentication credentials, private encryption keys, payment card details, access tokens or other information that could provide direct access to systems, accounts or services.
The client remains responsible for ensuring that it has the necessary rights and permissions to provide information and documentation for the purpose of delivering Cysnova services.
Where reasonably necessary to understand the material provided or to complete the agreed work properly, additional information or clarification may be requested.
5. Confidentiality and Non-Disclosure
Information and documentation provided by a client in connection with a Cysnova service will be treated as confidential.
As part of the service process, CHC Dynamics Ltd may require the client to enter into a separate Non-Disclosure Agreement (NDA) before confidential client documentation is submitted for review. Where applicable, access to the document submission process may be made conditional upon completion of the NDA.
The NDA and these Terms operate together to govern the confidentiality and handling of client information.
Client information will not be used for marketing, public examples or other unrelated purposes without the client’s permission.
Confidential information will be accessed and handled only to the extent reasonably required for the provision of the relevant service and the administration of the client relationship.
6. Handling of Client Material
Client documentation is used solely for the purposes for which it has been provided, including the performance of the purchased service, related administration, and compliance with applicable legal or contractual obligations.
Client documentation is never used to develop public content, training material, marketing material or examples identifying the client.
Client documentation is not used for purposes unrelated to the service or the client relationship.
7. Intellectual Property
The Cysnova name, brand, logo, website content, graphics and other materials made available through this website are owned by or licensed to CHC Dynamics Ltd and are protected by applicable intellectual property laws.
The Cysnova services are provided by CHC Dynamics Ltd under the Cysnova service brand.
Unless otherwise agreed in writing, deliverables produced specifically for a client as part of a purchased service may be used by that client for its own internal business purposes.
CHC Dynamics Ltd retains ownership of its underlying methodologies, know-how, frameworks, templates, tools and working materials used in producing the deliverable.
8. Disclaimer and Use of Deliverables
Cysnova services are professional cybersecurity and compliance services intended to assist the client in reviewing information, understanding requirements, improving documentation and addressing identified areas of concern within the agreed scope.
A Cysnova deliverable does not constitute a certification, accreditation, formal regulatory determination, legal opinion, guarantee of compliance, guarantee of security, guarantee of acceptance by a customer or regulator, or guarantee of any particular business outcome.
The client remains responsible for determining how a deliverable is used, for making its own business, security, regulatory and contractual decisions, and for implementing any actions it considers appropriate.
Cysnova does not represent that completion of a service, or the recommendations or documentation provided as part of a service, will result in certification, regulatory compliance, successful audit outcomes, contractual acceptance, or any other particular result.
The client is responsible for evaluating and applying the deliverable in the context of its own organisation, obligations, systems and circumstances.
Nothing in a Cysnova service is intended to replace legal advice, regulatory advice, independent certification or any other assessment or approval that may be required by law, regulation, contract, customer or other competent authority.
9. Service Limitations
Cysnova services are performed within the defined scope of the service purchased and are based on the information and documentation provided.
All information provided may be assessed for consistency, completeness and relevance as part of the agreed service, but it will not be independently audited or verified with regard to every factual statement, technical configuration, document or representation supplied by the client or by a third party unless such verification is expressly included in the scope of the service.
Where information is incomplete, inaccurate, unavailable or unclear, this may affect the conclusions, observations or recommendations that can reasonably be provided.
10. Responsibility for Use of Services and Deliverables
The information, analysis, observations, recommendations and documentation provided through a Cysnova service are intended to support the client’s own decision-making and activities.
The client remains responsible for the accuracy of information provided, for decisions taken on the basis of a deliverable and for any actions taken or not taken as a result of the service.
CHC Dynamics Ltd does not assume responsibility for the client’s security, compliance, regulatory or contractual obligations merely as a result of providing a Cysnova service.
11. Third-Party Websites and Service Providers
This website may contain links to third-party websites. CHC Dynamics Ltd is not responsible for the content, availability, security or privacy practices of external websites.
Third-party technical service providers may be used where necessary to operate the Cysnova website and support the service process, including: website hosting, website infrastructure, online forms, customer accounts, email, security, authentication, payment processing and related technical functions.
Such providers may process personal data where necessary to provide their services to CHC Dynamics Ltd and will be used in accordance with applicable data protection requirements.
Payment card details are processed directly by the applicable payment service provider. CHC Dynamics Ltd does not receive or store full payment card details.
12. Privacy and Data Protection
12.1 Data Controller
CHC Dynamics Ltd is the data controller for personal data processed in connection with the operation of the Cysnova website, the administration of its business activities and the provision of Cysnova services, except where CHC Dynamics Ltd processes personal data solely on behalf of a client and acts as a processor under applicable data protection law.
Cysnova is the service brand of CHC Dynamics Ltd and is not a separate legal entity.
12.2 Personal Data We May Collect
Depending on how you interact with Cysnova, the following data may be processed:
- name and business contact details;
- email address and other contact information;
- company name, business role and relevant organisational information;
- account and order information;
- information provided when purchasing or enquiring about a service;
- information and personal data contained in documents submitted as part of a service;
- records of communications and correspondence;
- transaction and payment-related information provided by the payment service provider;
- technical information relating to the use, security and operation of the website; and
- information required to comply with legal, regulatory, accounting or other legitimate business requirements.
Only information that is relevant and necessary for the applicable purpose are collected and processed.
12.3 Purposes and Lawful Bases for Processing
Personal data are processed only where there is a lawful basis for doing so under applicable data protection law.
Depending on the circumstances, personal data may be processed for the following purposes:
Service provision and contract administration — to process orders, administer accounts, obtain required information, perform purchased services, communicate with clients and provide deliverables. The lawful basis is generally the performance of a contract or steps taken at the request of the individual before entering into a contract.
Legal and regulatory obligations — to maintain records, meet accounting and other statutory obligations, respond to lawful requests and comply with applicable law. The lawful basis is legal obligation where applicable.
Website operation and security — to maintain the availability, integrity and security of the website, systems and information. The lawful basis may be legitimate interests where appropriate.
Business administration and protection of legal rights — to manage records, prevent misuse, establish or defend legal claims and protect the legitimate interests of CHC Dynamics Ltd. The lawful basis may be legitimate interests where appropriate.
Consent-based processing — where consent is required by law, CHC Dynamics Ltd will request consent before processing and will provide a means of withdrawing it.
12.4 Data Protection Standards
CHC Dynamics Ltd processes personal data in accordance with the applicable requirements of the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable UK data protection legislation.
Where EU data protection law applies to particular processing activities, CHC Dynamics Ltd will also comply with the applicable requirements of the EU General Data Protection Regulation (EU GDPR).
Personal data is processed in accordance with the principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability.
CHC Dynamics Ltd applies appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage.
12.5 Client Documents and Personal Data
Documents submitted by clients may contain personal data relating to employees, customers, suppliers or other individuals.
Where the purposes and means of processing such personal data are determined by the service provider, it acts as a data controller.
Where personal data is processed solely on behalf of a client and in accordance with the client’s documented instructions, the service provider may act as a data processor.
Where acting as a processor, the processing will be subject to the applicable requirements of Article 28 UK GDPR and, where applicable, Article 28 EU GDPR, including appropriate contractual arrangements governing confidentiality, security, processing instructions, assistance and deletion or return of personal data.
Clients should avoid submitting personal data that is not necessary for the Cysnova service and should redact or remove unnecessary personal data where appropriate.
12.6 Retention of Client Information and Documents
Client-provided documents and other service materials will normally be securely deleted within 30 days after delivery of the completed deliverable.
The 30-day period allows time to address any immediate clarification or administrative matters relating to the completed service.
This retention period does not apply where information must be retained for a longer period to comply with a legal, regulatory or accounting obligation, to establish or defend legal claims, to resolve a dispute, or where a longer period has been expressly agreed with the client.
Where CHC Dynamics Ltd acts as a processor, personal data will be deleted or returned in accordance with the applicable data processing agreement and the client’s documented instructions, subject to any legal requirement to retain it.
Business records that CHC Dynamics Ltd is required to retain, such as transaction, accounting or contractual records, may therefore be retained for longer than client working documents.
12.7 Security of Personal Data and Client Information
CHC Dynamics Ltd applies appropriate technical and organisational measures to protect personal data and confidential client information, taking into account the nature, scope, context and purposes of the processing and the risks involved.
Measures may include access controls, authentication controls, secure systems and storage, appropriate encryption or other protective measures, secure handling of documents, data minimisation and procedures for responding to security incidents.
Access to client information is restricted to what is reasonably required for the provision and administration of the relevant service.
Passwords, authentication credentials, private keys or similar secrets are not requested as part of its standard services.
12.8 Recipients and Categories of Recipients
Personal data is not sold or rented to third parties.
Where necessary for the operation of Cysnova and the provision of its services, personal data may be processed by categories of service providers supporting:
- website hosting, infrastructure and storage;
- online forms and customer account functionality;
- email and communications;
- payment processing and transaction administration;
- website security and technical services; and
- analytics and website performance, where applicable.
Payment card details are entered directly into the applicable payment provider’s secure payment environment and are not stored or accessible through Cysnova website systems.
Personal data will only be disclosed to other recipients where there is a lawful basis for doing so and where the disclosure is necessary, appropriate or required by law.
12.9 International Transfers
Some of the service providers used to operate the Cysnova website and provide Cysnova services may process personal data outside the United Kingdom.
Where personal data is transferred to a country covered by UK adequacy regulations, the transfer will rely on the applicable adequacy decision.
Where a restricted transfer is not covered by an adequacy regulation, an applicable transfer mechanism or safeguard permitted under UK data protection law will be used.
This may include appropriate safeguards such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism where required.
No restricted transfer will knowingly be made unless the requirements of applicable UK data protection law have been satisfied.
12.10 Cookies and Essential Website Technologies
Cysnova uses cookies and similar technologies that are necessary for the operation, security and functionality of the website and its online service process.
These may include technologies required for website functionality, customer accounts, authentication, shopping cart and checkout functionality, payment processing, security and other essential technical functions.
Cysnova website will not use non-essential cookies or similar technologies requiring consent before the applicable consent has been obtained.
Where consent is required, the applicable cookie consent mechanism will provide users with the relevant choices.
12.11 Data Protection Rights
Subject to the applicable legal conditions and exemptions, individuals may have rights in relation to their personal data, including the right to:
- access their personal data;
- request correction of inaccurate or incomplete data;
- request erasure of personal data;
- request restriction of processing;
- object to certain processing;
- request data portability where applicable; and
- withdraw consent where processing is based on consent.
The availability of these rights depends on the applicable legal basis and circumstances of the processing.
Requests relating to personal data should be sent to the contact address provided in Section 17.
Individuals also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) where they consider that their personal data has been processed in breach of applicable data protection law.
13. Complaints
If you have a concern about a Cysnova service, the handling of your information or the operation of this website, you should contact CHC Dynamics Ltd first using the details below so that the matter can be reviewed and addressed.
Data protection complaints will be handled in accordance with applicable data protection requirements.
14. Governing Law and Jurisdiction
These Terms and this Notice are governed by and construed in accordance with the laws of England and Wales.
Subject to any mandatory rights or protections that apply under applicable law, the courts of England and Wales shall have jurisdiction over disputes arising from or in connection with this website, these Terms or the provision of Cysnova services.
15. Legal Notice / Company Details
Cysnova is the service brand of CHC Dynamics Ltd, a company incorporated in England and Wales.
Legal entity: CHC Dynamics Ltd
Company number: 16413608
Registered office: 27 Old Gloucester Street, London, United Kingdom, WC1N 3AX
Trading name / service brand: Cysnova
Website: https://www.cysnova.com
Contact email: legal [@] cysnova.com
CHC Dynamics Ltd is responsible for the provision of services offered under the Cysnova brand.
Commercial orders, invoices, contractual arrangements and other legal transactions relating to Cysnova services are entered into with CHC Dynamics Ltd.
16. Changes to These Terms and Privacy Notice
These Terms and this Privacy Notice may be updated from time to time to reflect changes to the services, website, technology, legal requirements or the way personal data is processed.
Where a change materially affects the way personal data is processed, the relevant information will be updated before the new processing begins where required by applicable data protection law.
17. Contact
For questions about these Terms, Cysnova services, confidentiality, privacy or data protection, please contact:
CHC Dynamics Ltd
Email: legal [@] cysnova.com