Privacy Policy

Effective Date: 5 September 2026 · Data Controller: Davies IT Consulting

Overview

This Privacy Policy explains how Davies IT Consulting (“we”, “us”, “our”), an IT support and infrastructure consultancy based in Westbury, Wiltshire, collects, uses, stores and protects personal data in connection with our website (daviesitconsulting.co.uk) and the IT support, project and consultancy services we provide to our clients.

We are the data controller for the personal data described in this policy. If you have any questions about this policy or how we handle your personal data, please see the “Contact Us” section at the end of this page.

This policy is written to comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR). We may update this policy from time to time to reflect changes in our practices or in the law; any changes will be posted on this page with a revised effective date.

1. Data We Collect

We collect the following categories of personal data in the course of providing our IT consultancy and support services:

Client & Business Contact Data

Names, job titles, business email addresses, phone numbers, company names and billing or postal addresses collected when you enquire about our services, become a client, or contact us through our website.

Technical Logs & IP Addresses

IP addresses, device and browser information, timestamps and system event logs generated by the IT infrastructure, servers, networks and endpoints we monitor or support on behalf of a client.

Infrastructure Audit Artifacts

Configuration records, asset inventories, screenshots, diagnostic reports and similar technical documentation created during IT support, security reviews or infrastructure projects.

Communication Records

Emails, support tickets, call notes and messages exchanged with us regarding support requests, projects or general enquiries.

2. Lawful Basis for Processing

Under Article 6 of the UK GDPR, we only process personal data where we have a valid lawful basis to do so. Depending on the circumstances, we rely on:

  • Performance of a contract — to deliver the IT support, project work or consultancy services you have engaged us to provide, and to manage the business relationship, invoicing and account administration.
  • Legitimate interests — to maintain and secure the IT systems and networks we support, to monitor for and respond to security incidents, to improve our services, and to communicate with existing clients about matters relevant to their account. We only rely on this basis where our interests are not overridden by your rights and interests.
  • Legal obligation — to comply with our statutory obligations, including accounting, tax and record-keeping requirements, and to respond to lawful requests from courts, regulators or law enforcement.
  • Consent — where we ask for your consent, for example to send marketing communications or to place non-essential cookies, we only process your data on this basis where you have actively agreed. You may withdraw consent at any time.

3. Cookie & Tracking Policy

Our website uses a cookie consent tool to obtain and record your preferences in line with PECR (the Privacy and Electronic Communications Regulations):

  • Strictly necessary cookies — required for the website and its core features (such as the contact form pop-up, page security and load balancing) to function, and cannot be switched off. These do not require consent under PECR because they are essential to providing the service you request.
  • Analytics cookies — used, only where you consent, to understand how visitors use our website (for example, which pages are visited and how long is spent on them) so that we can improve it. These are only set after you provide consent through our cookie banner.
  • Preference cookies — remember choices you have made, such as your cookie consent decision itself, so that we do not ask again unnecessarily.

You can change or withdraw your cookie consent at any time using the cookie preferences control on our website, or by clearing cookies in your browser settings.

4. Third-Party Disclosures

We share personal data with a limited number of trusted third parties, only where necessary to deliver our services, and always under appropriate contractual safeguards (including data processing agreements where a third party acts as a processor on our behalf):

  • Cloud hosting & software providers — providers hosting our website, email, ticketing and cloud infrastructure (for example, Microsoft 365, backup and remote-monitoring platforms).
  • Security vendors — providers of antivirus, endpoint detection and response (EDR), email filtering and web protection tools used to secure client and internal systems.
  • Backup & disaster-recovery providers — providers used to store encrypted backups of systems we manage on behalf of clients.
  • Professional advisers — our accountants, auditors and legal advisers, where necessary for business administration.
  • Statutory authorities — HMRC, regulators, law enforcement or courts, where we are legally required to disclose information.

We do not sell personal data to third parties, and we do not share personal data with third parties for their own independent marketing purposes.

5. Data Storage & International Transfers

Personal data we hold is stored primarily on servers located in the United Kingdom and the European Economic Area (EEA). Where a third-party supplier we use (such as a cloud software or backup provider) stores or processes data outside the UK/EEA, we take steps to ensure an adequate level of protection is in place, such as:

  • relying on the supplier’s inclusion in an applicable UK adequacy regulation; or
  • putting in place the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses; or
  • confirming the recipient is certified under an approved transfer framework.

We only transfer personal data outside the UK/EEA where one of these safeguards is in place.

6. Retention Periods

We keep personal data only for as long as necessary for the purpose it was collected, taking into account our legal and contractual obligations:

  • Client contract and invoicing records — retained for 6 years after the end of the tax year to which they relate, in line with UK statutory accounting and HMRC record-keeping requirements.
  • Support tickets and communication records — retained for up to 6 years after a support relationship ends, to allow us to respond to any follow-up queries or disputes.
  • Technical logs and infrastructure audit artifacts — retained for as long as we actively support the relevant system, and typically deleted or anonymised within 12 months of a contract ending, unless a longer period is required for security or legal reasons.
  • Website enquiry form submissions from non-clients — retained for up to 12 months, then deleted if no client relationship is established.

Where the periods above are not appropriate for a specific type of data, we assess the correct retention period on a case-by-case basis, in line with the data minimisation principle.

7. Your Data Protection Rights

Under the UK GDPR, you have the following rights in relation to your personal data:

Right of Access (SAR)

Request a copy of the personal data we hold about you, and information about how it is used.

Right to Rectification

Ask us to correct inaccurate or incomplete personal data.

Right to Erasure

Ask us to delete your personal data, where there is no legal reason for us to keep it.

Right to Restrict Processing

Ask us to limit how we use your personal data in certain circumstances.

Right to Object

Object to our processing of your personal data where we rely on legitimate interests, or to any direct marketing.

Right to Data Portability

Request that we provide your data in a structured, commonly-used, machine-readable format, or transmit it to another organisation, where technically feasible.

You can exercise any of these rights by contacting us using the details below. We will respond within one calendar month, as required under the UK GDPR. We may need to verify your identity before actioning certain requests.

8. Contact Us & Supervisory Authority

If you have any questions about this Privacy Policy, or wish to exercise any of your data protection rights, please contact us:

Davies IT Consulting
Westbury, Wiltshire
Email: info@daviesitconsulting.co.uk

If you are not satisfied with our response, you have the right to lodge a complaint with the UK’s independent supervisory authority for data protection:

Information Commissioner’s Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk

We would, however, welcome the opportunity to address your concerns directly before you approach the ICO.

Email Us

Privacy PolicyCookie Policy
Powered by CookieAdmin

Get in Touch

Tell us what’s going on and we’ll get back to you the same working day.

First Name
Last Name
I agree to be contacted about my enquiry and to Davies IT Consulting's Privacy Policy.