Security, data and trust

Built to pass procurement.

This page answers the questions procurement, IT and data protection teams ask before they let an agency near their website. Everything here is backed by a published policy; the links are at the bottom.

Send us your questionnaire

Certifications and registrations

On the record.

Cyber Essentials certified. Certificate (PDF).
ICO registered data controller, registration ZB688380.
Companies House 15596721. VAT GB479593913.
Shopify Partner and Omnisend Partner.
Member of the Federation of Small Businesses.

How we protect your data

What our IT and BYOD policy requires of everyone who works here.

Full-disk encryption on every device.
Multi-factor authentication on every work account, with authenticator apps rather than SMS.
All credentials, including yours, held in the company password manager. Nothing shared by email or chat.
Operating systems and work applications kept current with security patches.
Client data stored only in company-controlled Google Workspace, never in personal accounts or personal cloud storage.
No client data entered into public AI tools.
Security awareness training on induction and at least once a year, covering phishing, password hygiene and UK GDPR obligations.
Leavers offboarded on their last day: accounts revoked and shared credentials rotated.

The full policy is published: IT and BYOD Policy.

Your data when we build or run your site

You are the controller. We are the processor.

Where we host, maintain or integrate your website, we process the personal data that passes through it on your behalf. We sign a data processing agreement before any personal data is shared.

Sub-processors are named in the project's data processing agreement, and we tell you before adding one.
Hosting is specified per project and named in the proposal, with daily off-site backups under a care plan.
Breach notification without undue delay, with enough detail for you to meet your own 72-hour obligation to the ICO.
Return and deletion of your data within 30 days of the end of an engagement, confirmed in writing on request.
Ownership of every account (domain, hosting, CMS, analytics) sits with you. We are administrators you can remove.

The terms are set out in the Data Protection and Privacy Policy, section "Client and Project Data".

Accessibility

We build to WCAG 2.2 AA and supply an accessibility statement for every site we launch. This site has its own: accessibility statement.

Business continuity

No single point of failure on your account.

A lean, fully remote core team with documented processes and credentials held in a shared vault, so no client account depends on one person's laptop. Support hours are Monday to Friday, 09:00 to 17:30; what a care plan covers is on the maintenance page.

Responsible business

Published and reviewed every year.

Modern Slavery, Equal Opportunities, Equal Pay, Environmental, Whistleblowing, Harassment and Bullying, Conflict of Interest and Health and Safety policies are all published.

Supplier questionnaires

Send it over.

We complete most supplier questionnaires within five working days and can supply policies and certificates alongside. Email info@kickassonline.com, which reaches our Data Protection Lead.

Policy library

The most requested.

Data Protection and Privacy, IT and BYOD, Privacy, Cookie, Terms of Service, Modern Slavery, Equal Opportunities and Environmental. The full list is at Policies.

Questions

Are you Cyber Essentials certified?

Yes. The certificate is published on this page and linked from the footer of every page on the site.

Will you sign our data processing agreement?

Yes. We sign yours or supply ours before any personal data is shared. Our Data Protection and Privacy Policy sets out our processor obligations, sub-processor terms and breach procedure.

Where is our data stored?

Project files and correspondence live only in company-controlled Google Workspace, never in personal accounts. Hosting for your site is named in the proposal, and we do not move client data outside the UK without your agreement and appropriate safeguards.

Who has access to our accounts?

The core team on the project, each with multi-factor authentication and credentials held in the company password manager. Leavers are offboarded on their last day and shared credentials rotated.

What happens if Kickass Online disappears?

You keep everything. Code, content, domain, hosting and analytics accounts are in your name from day one, with us as administrators you can remove in an afternoon.

Procurement