This Privacy Policy explains how we collect, use, and protect your personal information in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Please read this policy carefully. It applies to the services we provide to individuals, sole traders, and partnerships. It does not apply to information we hold about incorporated companies or other organisations unless we also process personal data in those contexts.

1. When This Policy Applies

This Privacy Policy applies whether you are:

• A customer using our services directly.
• Someone using our services paid for by someone else.
• Contacting us via phone, email, or webchat.
• Browsing or making enquiries on our website.

If you provide personal data about someone else (such as a joint account holder or authorised user), please ensure they have read this privacy policy and are happy for you to share their data with us.

2. Your Data Rights

Under the UK GDPR, you have rights over your personal data, including:

• The right to access your data.
• The right to correct inaccurate data.
• The right to request erasure (where applicable).
• The right to object to or restrict processing.
• The right to data portability.
• The right to lodge a complaint with the Information Commissioner’s Office (ICO).

To exercise your rights or for general data enquiries, please contact our Data Protection Officer (DPO) at:
📧 [email protected]

3. What Personal Information We Collect

We may collect and process the following categories of personal data:

• Identity & Contact Data: name, address, phone number, email, account credentials.
• Financial Data: billing address, payment method, bank/card details.
• Communication Records: emails, calls, web chats.
• Usage Data: services you use, login times, support interactions.
• Technical Data: IP addresses, login location, browser information.

4. How We Use Your Data

a) To provide our services and fulfil contracts

We use your information to:

• Set up and manage your account.
• Send service-related communications (e.g. maintenance, changes).
• Provide access to the customer portal.
• Invoice you and process your payments.

Legal basis: Performance of a contract (Article 6(1)(b) UK GDPR)

b) For fraud prevention and credit checks

Before and during service provision, we may carry out checks to detect fraud or financial risk. This includes sharing data with fraud prevention agencies.

Legal basis: Legitimate interests (Article 6(1)(f))

Retention: Up to 6 years if risk is identified.

Whenever such data is transferred outside the UK/EEA, we ensure it is protected using approved safeguards (e.g. Standard Contractual Clauses).

c) To recover debts

If you fall behind on payments, we may engage debt recovery agencies and share relevant details. We may also transfer or sell debt to third parties.

Legal basis: Legitimate interests

d) To prevent and detect crime and protect our infrastructure

We monitor usage for cybersecurity threats, malware detection, and abuse prevention.

Legal basis: Legitimate interests

We use the minimum amount of data necessary to ensure the security of our services.

e) To meet legal obligations

We may be required to disclose data to:

• Regulators
• Law enforcement
• HMRC or courts, if legally compelled

We will only do this in accordance with applicable UK laws.

Legal basis: Legal obligation (Article 6(1)(c))

5. How We Protect Your Data

We take your privacy seriously and use a range of security measures to protect your personal data, including:

• Secure encryption protocols (TLS/SSL)
• Firewalls and intrusion prevention
• Data access controls and audits
• Staff training on data protection

We also verify your identity before processing data requests or account access.

6. How Long We Keep Your Data

We retain your data only as long as necessary:

We securely delete or anonymise data after these periods, unless required to keep it for longer by law.

7. International Transfers

Where personal data is transferred outside the UK or EEA, we ensure it is protected through:

• Adequacy decisions
• Standard Contractual Clauses (SCCs)
• Binding Corporate Rules (where applicable)

8. Complaints or Concerns

If you have questions, concerns or complaints about how we process your personal data, contact our DPO at:

📧 [email protected]
📧 [email protected] (for general queries)

If you’re not satisfied with our response, you can contact the UK data protection regulator:

Information Commissioner’s Office (ICO)
📍 Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
🌐 www.ico.org.uk
📞 0303 123 1113

9. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes through our website or via email.