Privacy Policy
Version 1.1.0 · Approved by management · Effective 5 October 2026
1. Purpose and who we are
This policy explains how THISISITUK LTD, trading as “this is IT” (“we”, “us” and “our”), collects, uses, shares and protects personal data when you use thisisit.uk, interact with our social-media pages, contact us, receive business communications from us or work with us as a supplier or partner.
THISISITUK LTD, trading as “this is IT”, is the data controller for the processing described in this policy.
Questions about this policy or our use of personal data can be sent to info@thisisit.uk.
Data protection principles
We process personal data lawfully, fairly and transparently; collect only what is needed for the stated purposes; keep it accurate and no longer than necessary; and protect it using appropriate security measures.
2. Personal data we collect and how we use it
The list below explains what personal data we use for our website, enquiries and business relationships. The information we hold depends on how you interact with us.
Name, email address, telephone number, company name and enquiry details
- How we obtain it
- When you email us, use our contact form or ask about our services
- Why we use it
- To respond to your enquiry and discuss potential services
- Lawful basis
- Legitimate interests in responding to business enquiries
- How long we keep it
- If no contract follows, 12 months after the last meaningful contact
Business contact details, messages and related correspondence
- How we obtain it
- Through our communications with clients and other business contacts
- Why we use it
- To provide services, manage business relationships and keep relevant records
- Lawful basis
- Legitimate interests in managing our business relationships;
legal obligation where we must retain particular records - How long we keep it
- 7 years after the relationship ends
IP address, browser and device information, pages visited, referral information, access times and diagnostics
- How we obtain it
- Automatically when you use our website, through Cloudflare
- Why we use it
- To operate, secure and maintain the website
- Lawful basis
- Legitimate interests in operating and protecting our website
- How long we keep it
- Cloudflare retains this information under the plan we use. We do not keep separate website security logs.
Website usage, traffic, referral and device information
- How we obtain it
- Through Google Analytics 4, if you consent
- Why we use it
- To understand how people use our website and improve it
- Lawful basis
- Consent
- How long we keep it
- 2 months
Business contact details, job title, employer and relevant professional information about potential clients
- How we obtain it
- We may obtain business contact details from public professional sources, such as LinkedIn, or from third-party prospecting providers, including Lusha.
- Why we use it
- To contact relevant businesses about our IT services
- Lawful basis
- Legitimate interests in relevant business outreach, where the marketing rules permit the contact
- How long we keep it
- 12 months after the last engagement. If you object to marketing, we will stop contacting you and may keep a limited record of your objection so we can respect it.
Names, roles, business contact details and correspondence of suppliers and partners
- How we obtain it
- Directly from the people concerned, their organisations or business correspondence
- Why we use it
- To communicate with suppliers and partners and manage those relationships
- Lawful basis
- Legitimate interests in managing our business relationships
- How long we keep it
- 7 years after the relationship ends
Contact details, CVs and other information sent with a job enquiry or application
- How we obtain it
- Directly from the person
- Why we use it
- Respond to the enquiry and consider the person for work
- Lawful basis
- Taking steps towards an employment contract at the person’s request, where applicable
- How long we keep it
- 12 months after the last meaningful contact
Your first name, the initial of your surname and the words of a review you have published about us
- How we obtain it
- From a review you have published publicly, such as a Google review. We ask your permission before we quote you on our website.
- Why we use it
- To show people considering our services what our clients say about us
- Lawful basis
- Consent. You can withdraw it at any time and we will remove the quote.
- How long we keep it
- Until you withdraw your permission or we stop showing the quote
We may obtain business contact details from public professional sources, such as LinkedIn, or from third-party prospecting providers, including Lusha.
3. Website Infrastructure (Cloudflare)
We use Cloudflare to deliver and protect our website and to understand its overall performance.
Cloudflare website infrastructure
- What it does
- Delivers website content and helps protect the site
- Information involved
- IP addresses and website request information
- Why we use it
- We rely on our legitimate interests in operating and securing the website
- How long we keep it
- Cloudflare retains information under its service arrangements. We do not keep separate website security logs.
Cloudflare Web Analytics
- What it does
- Shows us overall website traffic and performance
- Information involved
- Aggregate information such as page views, referring sources and approximate location
- Why we use it
- We use it to understand and improve the website. Cloudflare says this service does not collect visitors’ personal data and does not set cookies.
- How long we keep it
- We receive aggregate reports, rather than individual visitor records
Cloudflare Web Analytics does not set cookies. The Cookie preferences control applies to optional Google Analytics cookies. Cloudflare’s services used to deliver and protect the website operate separately from that choice.
4. Business Communications (Microsoft 365)
We use Microsoft 365 to send, receive and store business emails and related communications. Microsoft processes this information on our behalf.
Microsoft 365 business email and communications
- Information involved
- Contact details, messages and attachments
- Why we use it
- To respond to enquiries, administer services and keep relevant business records
- Lawful basis
- Legitimate interests in responding to enquiries and managing business relationships.
Where we contract with an individual personally, the basis may be the contract.
We rely on a legal obligation where the law requires us to retain particular records. - How long we keep it
- Enquiries that do not become clients: 12 months after the last meaningful contact.
Business and contractual correspondence: 7 years after the relationship ends
5. Third-Party Tools We Use
We use the following providers for our website, business communications and business development. The information each provider receives depends on the service involved.
Cloudflare
- Information involved
- IP addresses and website request information; aggregate website performance information
- Why we use it
- Website delivery, security and aggregate website analytics
Google Analytics 4
- Information involved
- Website usage, referral and device information
- Why we use it
- Measuring website use after consent
LinkedIn or similar business contact providers, where used
- Information involved
- Business contact and professional information supplied to us
- Why we use it
- Finding professional contacts at businesses that may be interested in our services
Lusha or similar business contact providers, where used
- Information involved
- Names, job titles, employers, business email addresses, telephone numbers and other relevant professional information
- Why we use it
- Finding professional contacts for business development and outreach about our IT services
Microsoft 365
- Information involved
- Contact details, messages and attachments
- Why we use it
- Business email and communications
The purposes, lawful bases and retention periods for these activities are set out in Personal data we collect and how we use it. Further information about sharing information outside the UK appears under Data Sharing.
6. Cookies and Similar Technologies
Cookies are small files stored on your device. Our website also uses technologies that can collect information without setting a cookie. We ask for your consent before using optional Google Analytics cookies.
Cloudflare website infrastructure
- What it does
- Helps deliver and protect the website
- Consent or choice
- Used to operate and secure the website
- Duration
- Website request information is retained by Cloudflare under its service arrangements; we keep no separate security logs
Cloudflare Web Analytics
- What it does
- Gives us aggregate information about website use and performance
- Consent or choice
- It does not set cookies, so there is no consent choice to make. A visitor who wants to object to this aggregate analytics on legitimate-interest grounds can contact us at info@thisisit.uk.
- Duration
- No cookie is stored on your device; we receive aggregate reports
Google Analytics 4
- What it does
- Helps us understand how visitors find and use the website
- Consent or choice
- Optional. It runs after you accept analytics cookies.
- Duration
- Google Analytics cookies last approximately 13 months. We keep the resulting analytics information for 2 months.
7. Social Media and Third-Party Links
If you contact us through a social-media platform, that platform handles information under its own privacy arrangements. We also receive and use the information you send us, as described in this policy.
Our website displays a Blockmark certificate verification widget and an ICO registration badge. These embedded features load when you visit the page, so their providers may receive technical information such as your IP address and browser details even if you do not click on them.
If you follow a link from our website to another organisation’s site, that organisation’s privacy information applies when you use its site.
8. Data Sharing
We do not sell or rent personal data. We share it where needed to operate our website, communicate with people, measure website use, or meet legal requirements.
Blockmark widget and ICO badge providers
- Information involved
- Technical information such as IP address and browser details
- Why they receive it
- To display the embedded features on our website
- Where this is explained
- Social Media and Third-Party Links
Cloudflare
- Information involved
- IP addresses and website request information
- Why they receive it
- To deliver and protect our website
- Where this is explained
- Website Infrastructure (Cloudflare)
Google Analytics 4, after consent
- Information involved
- Website usage, referral and device information
- Why they receive it
- To measure and improve our website
- Where this is explained
- Cookies and Similar Technologies
Microsoft 365
- Information involved
- Contact details, messages and attachments
- Why they receive it
- To provide business email and communications
- Where this is explained
- Business Communications (Microsoft 365)
Regulators, courts and professional advisers, where relevant
- Information involved
- Information needed for a legal requirement, complaint, advice or claim
- Why they receive it
- To meet legal requirements, obtain advice or protect legal rights
- Where this is explained
- Data Sharing
Processing outside the UK
We choose UK storage or data-residency settings where they are available and suitable. Some providers supporting our website and business communications may nevertheless access or process personal data outside the UK. Where a transfer requires protection under UK data-protection law, we use an applicable safeguard, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, as appropriate to the provider’s arrangements.
Contact us at info@thisisit.uk if you would like more information about a particular provider.
9. Data Security
We use measures appropriate to the personal data covered by this policy to protect it against unauthorised access, loss and misuse.
- Access controls
- We limit access to business systems by role, review it periodically and remove it when no longer needed. Business accounts use multi-factor authentication.
- Device and system protection
- We use managed endpoint protection and keep business systems and devices updated.
- Email protection
- We use email filtering and phishing protection.
- Monitoring
- We monitor relevant security and diagnostic information to help identify faults or unusual activity.
- Service providers
- We use established providers to operate our website and business systems.
10. Data Retention and Minimisation
We keep personal data only for as long as we need it for the purposes described in this policy. We then delete or anonymise it, unless we need to keep particular information to meet a legal requirement or deal with a claim.
- Business and contractual correspondence, including supplier and partner correspondence
- 7 years after the relationship ends
- Business prospect contact details
- 12 months after the last contact or engagement. If someone objects to marketing, we may keep limited details of that objection so we do not contact them again.
- Cloudflare Web Analytics information
- We receive aggregate reports, rather than retaining identifiable visitor records.
- Enquiries that do not become clients, including contact-form messages
- 12 months after the last meaningful contact
- Google Analytics 4 information
- 2 months. The lifespan of its cookies is explained in Cookies and Similar Technologies.
- Job enquiries and applications
- 12 months after the last meaningful contact
- Review quotes published on our website
- Until the person withdraws their permission or we stop showing the quote
- Website security and diagnostic information handled by Cloudflare
- Cloudflare’s Free plan retains Security Events for up to 24 hours and Security Analytics for up to 7 days. We do not export these logs or store a separate copy.
11. Your Rights
If you have a question or concern about this policy or how we use personal data, please contact us at info@thisisit.uk. We will review your concern and respond as soon as reasonably possible.
To request a copy of your personal data (a subject access request), please email sar@thisisit.uk.
- Access your information
- Ask for a copy of your personal data.
- Correct your information
- Ask us to correct information that is wrong or incomplete.
- Delete or limit use
- Ask us to delete information or restrict how we use it.
- Object
- Object to certain uses of your information. You can object to its use for direct marketing at any time.
- Receive or move information
- Ask for your information in a reusable format where this right applies.
- Withdraw consent
- Change your mind where we rely on consent, including for optional website analytics.
We respond to requests to exercise these rights without undue delay and within one calendar month. If a request is complex or you make several requests, we may need up to two further months; we will tell you within the first month if this applies.
Complaints about personal data
If you believe we have handled your personal data incorrectly, please email info@thisisit.uk. We will acknowledge a data-protection complaint within 30 days, look into it and tell you the outcome. You can also complain to the Information Commissioner’s Office.
12. Review and Document Control
We review this policy at least once every 12 months and sooner if our website, services or use of personal data changes significantly. We publish an updated version here when the policy changes.
| Document owner | Last reviewed | Next review |
|---|---|---|
| THISISITUK LTD | 5 October 2026 | 5 October 2027 |