Privacy notice
How Cyber Fibre collects, uses and protects your personal information.
Last updated 2 November 2026.
Who we are
Cyber Fits Solutions Limited (trading as Cyber Fibre) is the controller of your personal data. Our registered office address is shown at the foot of this page. Company number 16254052. We are registered with the Information Commissioner's Office (ICO) on its data protection register under registration number ZB973937. Contact us about privacy at support@cyberfibre.uk or 0191 543 3564.
What we collect
- Contact details: name, email address, phone number, and for businesses your job title and business details.
- Addresses: installation address, billing address and property reference numbers used to check availability.
- Order and contract details, including your signed agreement, the time you signed and the IP address you signed from.
- Payment details handled by GoCardless, or by Stripe if you pay by card. We do not see or store your full bank or card details.
- Service information such as connection details, router details and support records.
- Messages you send us, our emails with you, and recordings and notes of phone calls with us.
- Support needs you choose to tell us about, such as needing large print or relying on a telecare alarm.
How we use it, and our lawful basis
| Use | Lawful basis |
|---|---|
| Checking availability, taking your order, installing and providing your connection, billing and support | Contract |
| Keeping records we are legally required to keep, such as VAT records, and meeting Ofcom rules | Legal obligation |
| Keeping what you enter in an order you start but do not finish (broadband or leased line), so you can carry on where you stopped and our team can help you finish it | Legitimate interests, and steps you ask us to take before a contract |
| Reminding you about a broadband or leased line order you started but did not finish (at most two emails) | Legitimate interests, and the rules for marketing emails to people part way through buying from us. You can say no when you give us your email, and stop reminders at any time with the link in each one. |
| Emailing you the packages at an address, or calling you back, when you ask us to | Steps you ask us to take before a contract |
| Recording support needs you tell us about, so we can help you | Consent, and your explicit consent where it relates to your health (you can ask us to remove it at any time) |
| Recording phone calls with us, for quality and training, and as a record of what was said and agreed, such as orders, changes to your service and complaints | Legitimate interests; and contract, where the call is how you place or change an order |
| Preventing fraud and improving our service | Legitimate interests |
| Counting visits from our campaign links, and keeping the postcode and address of the searches made after one, to see which adverts and emails work and which areas they reach | Legitimate interests |
| Counting, without any personal data, how visitors arrive at our website (for example from a search engine, an AI assistant, an advert or another website), and keeping where you came from with an order or enquiry you make, to see which of our marketing works | Legitimate interests |
| Sending you marketing, where you have agreed | Consent (you can withdraw it at any time) |
| Measuring how our website is used with Google Analytics, if you accept analytics cookies | Consent (you can withdraw it at any time with Cookie settings at the foot of every page) |
| Measuring which of our Google ads led to orders and enquiries, if you also accept advertising cookies | Consent (you can withdraw it at any time with Cookie settings at the foot of every page) |
Some of our adverts and emails use a campaign link (an address starting cyberfibre.uk/go/). When you follow one, we count a click against that campaign, with the name of the website the link was on if your browser tells us; we do not record your IP address, browser details or any other personal data with it. If you then check an address or ask for leased line prices during the same visit, that search is linked to the campaign, and we keep the postcode and address you searched with that campaign for 12 months to help us understand which areas our campaigns reach. After 12 months we keep only the postcode district (the first half of the postcode, for example SR6).
How you found us
When you arrive at our website from another website, a search engine, an AI assistant such as ChatGPT, or one of our adverts or tagged links, we count that arrival: the source and campaign named in the link, the name of the website you came from (not the full address), the page you landed on (without any search details), whether it was a paid advert click (only that it was, never the advert's click reference) and whether you are on a phone, tablet or computer. The count is made by our own systems, sets no cookie and holds no personal data: no IP address, no visitor number and nothing that could identify you. Visits from our own staff and offices are left out. We keep these counts for 25 months. We also count, in totals only, how many visitors were shown our cookie bar and which choice they made, for the same time.
The source of your visit is kept in your visit's session (the cfsid cookie, which ends when you close your browser), and saved with any availability check, quote, enquiry, unfinished order or order you make during the visit, for as long as we keep that record. Only if you accept analytics cookies do we also remember it in your browser for 90 days (the cf_src_f and cf_src_l cookies, listed in our cookie policy), so an order a few days later is still linked to how you first found us; if you turn analytics cookies off, we delete them.
We record all phone calls with our team, and keep the recordings for 30 days. You can ask us for a copy of the recording of a call with you while we still hold it.
Who we share it with
We share only what is needed with:
- Our wholesale connectivity suppliers and the network providers that deliver your connection and book engineer visits.
- GoCardless, which takes your payments and manages your Direct Debit.
- Stripe, which takes your payment if you choose to pay by debit or credit card.
- Companies House, when you use our company lookup.
- Google, which provides Google Analytics, if you accept analytics cookies, and Google Ads, if you also accept advertising cookies (see below).
- Cloudflare, when you use our speed test. The test runs on Cloudflare's servers, which see your IP address while it runs. We do not receive or keep your results.
- VIP VOIP, our telephone system provider, which stores the recordings of phone calls with us.
- Service providers that help us run the business: our email provider (Brevo), cloud file storage (Backblaze), our accounting software (FreeAgent) and Microsoft 365.
- Regulators, courts and dispute resolution schemes when required, and other companies in the Cyber Fits group where needed to support you.
Some providers may process data outside the UK. Brevo stores data in the European Union, and our Backblaze file storage is in its EU Central region (Amsterdam, the Netherlands); the European Union is covered by UK adequacy regulations. Microsoft 365 keeps our email and documents in the UK or the European Union, and where Microsoft processes data in the United States it is certified under the UK Extension to the EU US Data Privacy Framework. Cloudflare is based in the United States and is certified under the UK Extension to the EU US Data Privacy Framework (the UK US data bridge), which is also covered by UK adequacy regulations. Where any other provider processes data outside the UK, we rely on UK adequacy regulations or the International Data Transfer Agreement (or the UK Addendum to the EU standard contractual clauses), as UK data protection law requires.
How long we keep it
- Contracts, orders and invoices: for as long as you are a customer and then at least 6 years, as required for tax records.
- Unfinished checkouts (what you entered in an order you did not finish): deleted 90 days after you last made a change. If you go on to place the order, your answers are cleared from it straight away and kept with your order instead.
- Addresses checked on our website, with what we showed and how far the checkout went (used to improve our service, without your name or contact details): deleted after 90 days.
- Postcodes and addresses searched after following one of our campaign links: 12 months, after which we keep only the postcode district (the first half of the postcode).
- Counts of how visitors arrived at our website, and of cookie bar choices (no personal data): 25 months.
- How you found us, saved with an availability check, quote, enquiry, unfinished order or order: as long as we keep that record.
- Email delivery records: 24 months.
- Records of calls made on a Cyber Fibre phone line (numbers, times, durations and charges): 12 months after the call, once it has been billed. The charges stay on your invoice, which we keep with your other billing records.
- Recordings of phone calls with us: 30 days, then deleted.
- Enquiries that do not lead to an order: up to 2 years.
- Google Analytics data linked to the _ga cookie: 14 months at most, then only totals that do not identify anyone are kept.
- Google Ads cookies on our website (_gcl_au, _gcl_aw and other _gcl_ cookies), if you accept advertising cookies: 90 days.
- Extra help you tell us about (for example that you rely on your landline or need large print): for as long as you are a customer and then 6 years, kept with your contract, unless you ask us to remove it sooner.
Google Analytics
If you choose "Allow all", or turn analytics cookies on in Cookie settings, our website loads Google Analytics, a service from Google. It sets cookies in your browser (listed in our cookie policy) and tells us, in total, which pages are visited, how people arrive and how they move around the site, with general details such as the type of device and an approximate location. We use this only to improve our website. If you leave analytics cookies off, or do not choose, Google Analytics is not loaded and nothing is sent to Google.
- Our lawful basis is your consent. You can withdraw it at any time with Cookie settings at the foot of every page; we then stop loading Google Analytics and delete its cookies from your browser.
- Google processes this data for us as our processor, under Google's data processing terms. We have turned off Google signals and ad personalisation. Unless you also accept advertising cookies, this data is not shared with Google Ads.
- We also record when an order, quote request or enquiry has been confirmed by our systems, and when one of our phone numbers is tapped. For an order this is the order reference, the package, the type of customer (home or business), the minimum term and the total price over the minimum term; for a quote request or enquiry, which form it was and the type of service; for a phone number tap, where on the page it was, not the number.
- We record the steps towards an order in the same way: whether an availability check found services (not the address checked), the packages shown and the one chosen with its price, starting the checkout, signing the agreement (not your name) and whether you chose to pay by card or Direct Debit. We also record when you ask us to email your packages or a link to your basket (not your email address), and when one of our email addresses is tapped (not the address).
- We never send Google your name, email address, phone number, postcode or address. On our availability check, checkout and leased line pages we send only the page's address without any search details, and pages whose address contains a personal link or reference are not measured. Google says Google Analytics does not log or store the IP addresses of visitors in the UK.
- Google may process this data in the United States. Google states that it complies with the UK Extension to the EU US Data Privacy Framework (the UK US data bridge), which is covered by UK adequacy regulations.
- Google Analytics keeps data linked to the cookie for 14 months at most; after that only totals that do not identify anyone are kept.
Google Ads conversion measurement
Advertising is a separate choice, and it only works with analytics cookies on. If you choose "Allow all", or turn advertising cookies on in Cookie settings, Google Analytics may share the orders, quote requests, enquiries, phone number taps and steps towards an order described above with our Google Ads account, so we can see which of our Google ads led to them. Google sets Google Ads cookies on our website for this (listed in our cookie policy).
- Our lawful basis is your consent. You can withdraw it at any time with Cookie settings at the foot of every page; we then stop sharing with Google Ads and delete the Google Ads cookies set on our website.
- We use it only to measure our ads. We do not use it for remarketing or to personalise the ads you see, and ad personalisation is turned off.
- For Google Ads, Google uses this data as a separate controller under its own terms and privacy policy. Google explains how it uses information from websites that use its services at policies.google.com/technologies/partner-sites.
- If you leave advertising cookies off, nothing from Google Analytics is shared with Google Ads for you, even with analytics cookies on.
Your rights
You can ask to see the personal data we hold about you, and ask us to correct it, delete it, restrict or object to how we use it, or send it to you or another organisation. Some rights have exceptions, for example we must keep certain records by law. Contact us to use your rights.
If you are unhappy with how we handle your data, please tell us. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Cookies
See our cookie policy, where you can also change your choices about analytics and advertising cookies.