Privacy Notice

ITHelpDirect Ltd
Last updated: 4 November 2026

1. Introduction and scope

ITHelpDirect Ltd (“ITHelpDirect”, “we”, “us” or “our”) is committed to handling personal information fairly, lawfully and securely.

This Privacy Notice explains how we collect, use, share, retain and protect personal information when you visit the ITHelpDirect website at https://www.ithelpdirect.com, contact us, request a quotation, receive our marketing communications, or deal with us as a customer, supplier or business contact. It also explains how we handle personal information in connection with the administration and support of our managed IT and communications services when we act as a data controller.

We comply with applicable UK data protection law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (as amended), and the Privacy and Electronic Communications Regulations (PECR).

Where we process information solely on the instructions of a customer as their data processor, that processing is primarily governed by our agreement with that customer and the customer’s own privacy information. See Section 6.

2. Who we are and how to contact us

Data controller: ITHelpDirect Ltd
Company number: 11632922

Registered office:
1 Nelson Mews
Southend-on-Sea
Essex
SS1 1AL
United Kingdom

Southend office:
36 Clarence Street
Southend-on-Sea
Essex
SS1 1BD
United Kingdom

Privacy enquiries: admin@ithelpdirect.com
Telephone: 0800 779 7779
Website: https://www.ithelpdirect.com/

Please mark written privacy enquiries “Data Protection”.

3. Personal information we collect

The information we handle depends on your relationship with us and the services you use. It may include:

Identity and business contact information: names, job titles, organisations, business addresses, email addresses and telephone numbers.
Enquiry and correspondence information: contact-form submissions, emails, telephone enquiry details, quotation requests, meetings and other communications.
Customer, supplier and transaction information: account contacts, orders, contracts, invoices, payment status and other records needed to manage a business relationship. We do not ask you to submit payment-card details in general website forms.
Support and service-administration information: names and contact details of people raising tickets, support correspondence, ticket history, service requests and information about the devices or systems concerned, where needed to administer or evidence our services.
Technical and security information: IP addresses, browser and device details, website access records, timestamps, diagnostics, system events and security logs generated when you use our website or interact with our systems.
Marketing information: newsletter subscriptions, business contact details, communication preferences, campaign interactions where measured and records of objections or unsubscribes.

Please do not put passwords, payment-card details or sensitive personal information into general website contact forms. If sensitive information is necessary for a support matter, use the secure method agreed with your organisation.

4. Where we obtain personal information

We receive information:

Directly from you, for example when you complete a form, contact our team, request support, subscribe to marketing or place an order.
From your organisation or our customer, for example when an employer or authorised contact identifies you as an account contact, user or person requiring assistance.
From business relationships and referrals, including introductions by existing contacts or suppliers.
From publicly accessible professional sources, such as company websites, business directories and professional profiles, where relevant to legitimate business enquiries or outreach.
Automatically through our website and systems, including server logs and, where enabled, cookies, analytics and similar technologies.

Where we obtain personal information about you from someone else, we provide relevant privacy information as required by law, including when we first contact you where appropriate.

5. How we use information and our lawful bases

We only use personal information when we have a valid lawful basis. The main purposes and bases for our own activities are:

Purpose	Lawful basis and explanation
Responding to enquiries, preparing quotations and communicating with business contacts	Legitimate interests in responding to requests and running our business. Steps before a contract may apply where you personally ask us to enter into a contract.
Managing customer and supplier relationships, orders and service delivery	Contract where you personally are a party; otherwise legitimate interests in fulfilling obligations to organisations and communicating with their authorised representatives.
Running support operations, managing tickets, service communications and maintaining an appropriate service history when acting as controller	Legitimate interests in operating and supporting our services and documenting work performed; contract where applicable to an individual customer.
Operating, securing, troubleshooting and improving our website, network and business systems	Legitimate interests in providing secure and reliable services and preventing misuse. Where the law requires consent for cookies or similar technologies, we obtain it; any permitted exemption is used only where its conditions are met.
Sending newsletters, promotions and relevant business-to-business marketing	Consent where required, or legitimate interests in promoting relevant services to corporate business contacts where permitted. Marketing is also subject to PECR.
Keeping accounts, meeting tax and other statutory requirements and responding to lawful requests	Legal obligation where the relevant law requires processing.
Dealing with complaints, protecting our rights and managing disputes	Legitimate interests in investigating issues and establishing, exercising or defending legal claims; legal obligation where applicable.

Where we rely on legitimate interests, we consider whether the activity is necessary and whether your rights and interests outweigh ours. We do not rely on legitimate interests where consent or another lawful basis is required.

You do not generally have to provide personal information to browse our public website. However, if you do not provide the details necessary for an enquiry, order or support request, we may be unable to deal with it or provide the requested service. Certain information must be retained to comply with legal requirements.

6. Managed IT services: when we act for customers

ITHelpDirect supplies managed IT, technical support, telecommunications, cloud, backup, security and related services to organisations, including schools.

For the operation of our own business, such as maintaining customer account contacts, invoices and our service administration records, we will generally act as a data controller.

When we access, host, protect, back up, troubleshoot or otherwise process information within a customer’s systems on that customer’s behalf and under its instructions, the customer will generally be the data controller and ITHelpDirect will be its data processor. The relevant services agreement, data processing terms and the customer’s instructions govern that activity.

In the course of providing customer services, our authorised personnel or service providers may encounter personal information relating to the customer’s staff, pupils, parents, service users or other individuals. This may include sensitive information where it is present in the customer’s environment. We do not treat that information as ours to use for unrelated purposes or marketing.

If your request relates to information controlled by a customer organisation, you should normally contact that organisation first. We assist our customers with relevant data protection requests in accordance with our contractual and legal obligations.

7. Newsletters and direct marketing

We may send news, service updates, promotional emails and information about relevant IT products and services.

We distinguish between:

Corporate subscribers, such as limited companies and limited liability partnerships. Relevant business-to-business marketing emails may be sent without prior consent under PECR, provided we comply with applicable identification, opt-out and UK GDPR requirements.
Individual subscribers, including individuals, sole traders and certain partnerships. We send electronic direct marketing only where we have the necessary consent or a valid exception, such as the soft opt-in where its conditions are satisfied.

Where we use named business contacts’ personal information for marketing, we identify an appropriate UK GDPR lawful basis, explain the use of that information and respect objections.

Every marketing email identifies us and provides a way to unsubscribe. You can also request removal from marketing at admin@ithelpdirect.com.

You have the right to object to the use of your personal information for direct marketing at any time. If you object, we will stop using it for that purpose.

We may keep the minimum contact information needed on a suppression list to make sure we respect your decision. Unsubscribing from marketing will not stop essential messages about contracts, orders, security incidents or support.

8. Who we share information with

We do not sell or rent personal information.

Where needed for the purposes explained above, information may be shared with:

Website hosting, email, communications and cloud infrastructure providers.
Helpdesk, remote support, device-management, security monitoring, backup and other technology providers used to deliver services.
Customer relationship management, billing, accounting and marketing platform providers.
Suppliers, distributors, delivery partners and other organisations involved in fulfilling orders or providing requested services.
Professional advisers, insurers, auditors and legal advisers.
Public authorities, regulators, courts or law enforcement bodies where legally required or otherwise lawful.

Our website uses Google technologies, including a Google tag installed through Google Site Kit and embedded Google Maps. Depending on their configuration and whether they are activated, Google may receive IP addresses, device information and information about interactions with the relevant feature. See Section 12 and Google’s Privacy Policy.

When service providers process personal information for us, we require suitable contractual and security protections. We share only what is reasonably necessary for the relevant purpose. Where we provide services as a processor, subprocessors are governed by the applicable customer agreements and data processing terms.

9. International data transfers

Some of our service providers operate internationally, and personal information may be accessed or processed outside the United Kingdom.

Where a transfer is subject to UK international transfer restrictions, we use an applicable lawful transfer mechanism. This may include UK adequacy regulations, an approved UK international data transfer agreement or UK addendum to standard contractual clauses, or another legally permitted mechanism. Where required, we assess the risks of the transfer and apply appropriate additional safeguards.

You may contact us for further information about relevant transfer arrangements and how to obtain a copy of applicable safeguards.

10. Keeping information secure

We use appropriate technical and organisational measures designed to protect personal information from accidental loss, unauthorised access, alteration, misuse or disclosure. These may include access controls, account security measures, staff procedures, monitoring, backups and appropriate protections for suppliers and service platforms.

Access is limited to authorised people who need information for their work. No internet-based system can be guaranteed completely secure, but we review safeguards according to the nature of the information and the risks involved.

11. How long we keep information

We keep personal information only for as long as necessary for the purpose for which it was collected, including any applicable legal, contractual, regulatory or dispute-related requirements. We assess retention by the type of record, the status of the relationship, whether an issue remains open and the need for an accurate audit trail.

Our main retention criteria are:

Enquiries and quotations: while an enquiry is active and for a proportionate period afterwards where follow-up, a developing business relationship or a complaint makes retention necessary. Inactive enquiries are reviewed and removed when no longer needed.
Customer and supplier contact and contract records: while the relationship is active and afterwards to the extent needed for ongoing obligations, an appropriate service history or potential disputes.
Accounting and tax records: generally six years from the end of the company financial year to which they relate, or longer where applicable law or an ongoing HMRC enquiry requires it.
Support tickets and service-administration records that we control: for as long as needed to deliver and document support, investigate issues or meet contractual and legal requirements. Customer-controlled data processed on their behalf follows the relevant service agreement and retention instructions.
Marketing information: while we have a valid reason to contact you and the contact remains relevant. We review outdated information and honour all unsubscribe requests. Suppression records are retained for as long as necessary to prevent unwanted marketing.
Website, diagnostic and security logs: for limited periods proportionate to their operational or security purpose, with longer retention only where needed to investigate incidents, address disputes or meet legal requirements.
Backups: according to applicable backup rotation and retention arrangements, taking account of contractual requirements and technical deletion cycles.

When the relevant retention period ends, we delete or anonymise information securely, unless a lawful reason requires us to retain it for longer.

12. Cookies, analytics and embedded content

Cookies are small files and similar technologies that can store or access information on your device. Our website may use them for functionality, security, measurement and embedded content.

The technologies we use or may enable include:

Necessary website technologies, which support functions requested by users or the security and operation of the site.
Analytics and statistical measurement, including Google technologies configured through Google Site Kit, where enabled. These can help us understand visits, page usage and website performance.
Embedded Google Maps, which may connect to Google and receive technical information when map content loads.

We provide information about the purposes of these technologies. We obtain consent before using technologies that require it. If we rely on an applicable statistical or similar exception to the consent requirement, we comply with the relevant conditions, including providing an easy means of objecting where required.

You can manage or withdraw your non-essential cookie choices using the Cookie Settings control provided on our website. You can also manage cookies through your browser, although browser settings may not cover every similar technology. A list of active cookies and similar technologies, including their providers, purposes and durations, is available through our Cookie Settings control.

See Google’s explanation of cookies for more information about Google’s technologies.

13. Your data protection rights

Depending on the circumstances and the lawful basis relied on, you may have rights to:

Ask for access to your personal information.
Request correction of inaccurate or incomplete information.
Request deletion of personal information where the law allows.
Ask us to restrict certain processing.
Object to processing based on legitimate interests.
Receive certain information in a portable format, or have it transferred where applicable.
Withdraw consent at any time where consent is the lawful basis.

These rights are subject to applicable conditions and exemptions. Withdrawing consent does not affect processing that was lawful before the withdrawal.

To exercise a right, email admin@ithelpdirect.com. We may need reasonable information to verify your identity or understand your request. We respond within the applicable statutory timescales.

Your right to object to direct marketing is unconditional: we will stop using your personal information for direct marketing if you object.

14. Data protection complaints

If you have a complaint about how we handle your personal information, please contact admin@ithelpdirect.com and mark your message “Data Protection Complaint”.

We will acknowledge receipt of a data protection complaint within 30 days, investigate it appropriately, keep you informed of progress and provide an outcome without undue delay.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at the ICO website. You do not have to contact us before raising a concern with the ICO.

15. Updates to this notice

We review this Privacy Notice and update it when our services, use of information or legal obligations change. The latest version will be available on our website and will show its revision date. Where required, we will provide additional notice of material changes.