Privacy notice.

Reformed IT Limited
Effective from 26 September 2026 · Version 2.1 · Replaces the notice dated 24 September 2026

1. About this notice, and the two roles we act in

This notice explains how Reformed IT Limited uses personal data for which we are the data controller. That means information we decide the purposes for: details about the people we deal with at our clients, people who contact us or visit our website, our suppliers' contacts, and the records we keep in order to run and secure the services we provide.

Where we access or store personal data inside our clients' own systems in the course of providing IT services, we act as a data processor, not a controller. That processing is carried out on the client's documented instructions and is governed by our Data Processing Addendum. If you are an employee, customer or contact of one of our clients and you want to know how your employer or supplier uses your personal data, their own privacy notice covers that, not this one.

Both roles are described here so that it is clear which applies to you.

2. Who we are and how to contact us

Reformed IT Limited

Registered in

England and Wales

Company number

12132045

Registered office

10 Farrington Way, Eastwood, Nottingham NG16 3BF

ICO registration

ZA755268

Email

[email protected]

Telephone

0115 824 4824

Post

Data Protection Lead, Reformed IT Limited, 10 Farrington Way, Eastwood, Nottingham NG16 3BF

For any question about this notice or about how we handle personal data, including to exercise any of the rights described in section 11, contact us using the details above.

We have appointed an internal Data Protection Lead, who is accountable for data protection at Reformed IT, is the contact for the queries above, and is the contact named on our ICO registration. We are not required to appoint a statutory Data Protection Officer under Article 37 of the UK GDPR and have not done so.

3. Who this notice is for

This notice covers:

• Visitors to our website and people who contact us through it
• Prospective clients and business contacts we approach or who approach us
• Our clients' staff and authorised users, whose contact details and service records we hold in order to deliver and support the services
• Our suppliers' and partners' contacts
• Anyone who telephones us or whom we telephone, including people who are not our clients' staff, such as a receptionist, a client's own supplier or contractor, or someone joining a call to help resolve an issue

It does not cover job applicants, who have their own job applicant privacy notice, or our own employees and workers, who receive a separate privacy notice directly.

4. What information we collect, why, and our lawful basis

4.1 Website visitors and enquirers

What we collect: name, business email address, telephone number, employer, and the content of your enquiry; IP address, device and browser information, pages viewed and referral source.

Why: to respond to your enquiry, to provide information you asked for, to operate and secure the website, and to understand how the website is used.

Lawful basis: legitimate interests. Our interest is in responding to enquiries, running our website and understanding how it performs. We consider this has limited impact on you because the information is business contact information provided voluntarily, and you can object at any time. Where analytics or advertising cookies are used, we rely on your consent, given through the cookie banner.

4.2 Client contacts and authorised users

What we collect: name, job role, business email address, telephone number, employer and site; user account identifiers; records of your contact with us, including tickets, emails, chat messages, remote support sessions and call records; and details of the devices and services assigned to you.

Why: to set up and maintain your access to the services, to identify you when you contact us, to deliver support, to keep an accurate record of the work we have done, to manage our contract with your employer, and to bill for the services.

Lawful basis: legitimate interests. Our interest, and your employer's, is in our being able to identify authorised users, support them, and keep a reliable service record. We consider the impact on you limited because the information is business contact information and service records, and it is used for the purpose you would expect.

Note that most of this information reaches us from your employer rather than from you. Section 6 explains that, and section 11 explains your rights.

4.3 Recording and summarising telephone calls

We record telephone calls between our team and the people we support, including calls you make to our service desk and calls we make to you. Recorded calls are transcribed, and an AI-generated summary of the call is added to the relevant support ticket.

Why: to keep an accurate record of what was reported and agreed, to make sure nothing is missed between the call and the work, for quality monitoring and training, and to resolve any dispute about what was said.

Lawful basis: legitimate interests, being our interest in accurate service records, service quality and staff training.

How we tell you. Where you call our service desk, an announcement at the start of the call tells you that recording takes place and gives you the option to decline. Where we call you, we will have told you about recording when your access to our services was set up, and your employer's agreement with us covers it. If you have not been told before, or if you are not one of our regular contacts, the person calling you will tell you at the start of the call.

If you would rather not be recorded, say so and we will stop. If a call is not recorded, no transcript or AI summary is produced.

How AI is used: transcription and summarisation are carried out by approved AI providers engaged on business or enterprise terms under which customer content is not used to train their models. We do not use consumer AI subscriptions for this. No decision about you is made by automated means as a result of a call summary; the summary is a note for the engineer handling your ticket.

What the summary contains. The summary records what was discussed, what was agreed and what happens next. It will normally name the people involved in the call, including anyone else who took part.

Retention. The recording and its transcript are held in our telephone system for six months and are then deleted. The summary forms part of the support ticket and is kept with it, for six years from the end of our relationship with the client, in line with the rest of our client records.

We do not intend summaries to contain passwords, access codes or other credentials, and we ask our team not to read these out on recorded calls. If you believe a summary has captured something it should not have, tell us and we will remove it.

A call may occasionally touch on sensitive information, such as someone mentioning they are unwell. We do not intend summaries to record this, and if we find it has been captured we remove it.

4.4 Security monitoring

To deliver our security services we operate monitoring across the systems and devices we support. This generates personal data about identifiable users.

What we collect: sign-in events including time, location and IP address; device identifiers and health; DNS queries and the sites requested; email metadata and details of messages quarantined or blocked; alerts and detections raised by our security tooling.

Why: to detect, investigate and respond to security threats affecting our clients, to demonstrate that the services are working, and to improve our detection of threats across the client base.

Roles: where we monitor a client's systems on that client's instruction, we act as processor and the client's own privacy notice applies. Where we retain and analyse monitoring data for our own purposes, including threat intelligence and service improvement, we act as controller and this notice applies.

Lawful basis: legitimate interests, being the interest we and our clients share in securing systems and protecting the people who use them. We consider this proportionate because monitoring is limited to business systems, is directed at security rather than at assessing individuals, and is subject to access controls within our team.

Retention: monitoring data is retained for up to 12 months, after which it is deleted or aggregated so that individuals can no longer be identified. Some data is held for shorter periods depending on the platform.

Monitoring is not used to assess individual performance or conduct, and we do not provide monitoring data to a client for that purpose unless we are lawfully required to, or the client instructs us to in connection with a specific security or misuse investigation.

4.5 Prospective clients and marketing

What we collect: business contact details; the organisation you work for; information about your organisation's likely requirements; details of your interactions with our emails, website and advertising.

We use website visitor identification tools. These identify the organisation associated with a visitor's IP address, not the individual, and we may then research publicly available business contact information for that organisation. We do not use these tools to identify you personally from your browsing.

The visitor identification tool runs on every visit and uses your IP address to identify the organisation. Until you accept analytics cookies through our cookie banner it keeps only a temporary identifier in your browser, which is cleared when you close the tab, and it only sets cookies to recognise you on later visits if you accept. This, and the research we then carry out on the organisation, relies on our legitimate interests, described below. You can object at any time using the contact details in section 2.

Why: to identify organisations that may benefit from our services, to contact relevant people at those organisations, and to send marketing about our services to clients and prospective clients.

Lawful basis: legitimate interests, being our interest in promoting our services to businesses likely to want them. We restrict this to business contacts in a business capacity, we keep the volume proportionate, and we stop as soon as anyone asks us to. Marketing by electronic mail is also subject to the Privacy and Electronic Communications Regulations, described in section 12.

4.6 Suppliers and partners

What we collect: name, role, business contact details and records of our dealings with you.

Why: to manage our relationship with your organisation, to procure and pay for goods and services, and to carry out due diligence on suppliers who handle personal data on our behalf.

Lawful basis: legitimate interests in managing our supply chain, and where we contract with you personally, performance of a contract. Some records are kept to meet legal obligations, including tax and accounting law.

4.7 Whether you have to give us your data

You are not required by law to give us personal data. If you are an authorised user at one of our clients, we need your contact details to provide support, and without them we cannot verify your identity or help you. If you contact us with an enquiry, we need enough detail to reply.

5. Special category and criminal offence data

We do not seek or intentionally collect special category data (such as health, racial or ethnic origin, or trade union membership) or data about criminal convictions and offences in our role as controller.

Where such data exists inside a client's systems that we support, we process it only as a processor, on that client's instructions, and only to the extent necessary to deliver the services. The client is responsible for identifying it and for the condition permitting its processing.

6. Where your personal information comes from

We obtain personal data:

• Directly from you, when you contact us, raise a ticket, speak to us on the telephone, or use our website
• From your employer or the organisation you work for, when they ask us to set up or support your access to systems, or give us contact details for authorised users
• From the systems and devices we support, through the monitoring and management tools described in section 4.4
• From publicly available sources, including company websites, Companies House and professional networking sites, when researching prospective clients
• From our suppliers and partners, where they refer a potential client to us

Where we receive your details from your employer rather than from you, we will make this notice available to you at or before the point we first communicate with you, and in any event within one month, as required by Article 14 of the UK GDPR.

7. Automated decision-making and artificial intelligence

We do not make decisions about you by automated means that produce legal effects or otherwise significantly affect you.

We do use AI to assist our team, including:

• transcribing and summarising telephone calls (section 4.3)
• categorising and prioritising support tickets
• assessing the tone of a message so that urgent or difficult issues are escalated to a person sooner
• drafting suggested responses and retrieving relevant knowledge for an engineer to review

In every case the output is reviewed by a person before it is acted on. AI providers we engage are contracted on business, enterprise or API terms under which customer content is not used to train their models, and we do not permit client data to be used to train publicly available AI models without the client's prior written consent.

You can ask us how AI has been used in relation to a ticket or call involving you, and you can object to our use of it under section 11.

8. Who we share your information with

We share personal data with:

• Our sub-processors and suppliers, being the technology providers we use to deliver and support the services. We maintain a current list of these, showing what each one does and where it processes data. We provide it to our clients on request, and we tell them before we add or replace any sub-processor. We do not publish the list of named providers, because a public inventory of the tools we use to manage our clients' systems would be of more use to an attacker than to anyone else. Our trust centre sets out our security and data protection policies and certifications, and clients and prospective clients can request access there to its documents, including the sub-processor list
• Our professional advisers, including accountants, insurers and lawyers, where necessary
• Regulators, law enforcement and other authorities, where we are legally required to disclose information
• A purchaser or successor, if we sell or transfer our business or assets, subject to appropriate confidentiality protections

We do not sell personal data, and we do not share it for third parties' own marketing purposes.

9. International transfers

Some of our suppliers are based outside the United Kingdom, principally in the United States and the European Economic Area.

Where personal data is transferred outside the UK, we make sure an appropriate safeguard is in place, which will be one of:

• a UK adequacy decision covering the destination country
• the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses
• the UK Extension to the EU-US Data Privacy Framework

Before relying on a safeguard, we consider, acting reasonably and proportionately, whether the data protection test in Article 46(6) of the UK GDPR is met, and we record that consideration. You can ask us for details of the safeguard relied on for any particular transfer using the contact details in section 2.

10. How long we keep your information

Where a longer period is required by law, or a record is needed for an ongoing legal claim, we keep it for as long as necessary for that purpose and no longer.

11. Your rights

You have the right to:

• Be informed about how we use your personal data, which is the purpose of this notice
• Access the personal data we hold about you, and receive a copy
• Rectification of personal data that is inaccurate or incomplete
• Erasure of your personal data in certain circumstances
• Restrict processing of your personal data in certain circumstances
• Object to processing based on legitimate interests, including profiling. Where you object to direct marketing we will always stop
• Data portability, where processing is based on consent or contract and is automated
• Withdraw consent at any time, where we rely on consent. Withdrawing consent does not affect processing carried out before you withdrew it

To exercise any right, contact us using the details in section 2. We will respond within the period allowed by law, which is normally one month from when we have received your request together with any information we need to identify you. We may ask for information to confirm your identity, and we will tell you if we need longer because a request is complex.

Exercising these rights is free. We will only charge a fee, or decline, if a request is manifestly unfounded or excessive, and we will explain why if that happens.

If the personal data concerned sits inside a client's systems and we hold it as a processor rather than controller, we will tell you promptly and direct you to that client, who is responsible for responding. We will assist them in doing so.

12. Marketing and how to stop it

We send marketing by email to business contacts at organisations we believe would benefit from our services, and to our clients and former clients about services related to those they have bought.

Every marketing email tells you how to opt out, either through an unsubscribe link or by replying to ask us to stop, and we act on it straight away. You can also email us at the address in section 2 and ask us to stop, which we will do without question and without asking for a reason.

Objecting to direct marketing is an absolute right. We do not weigh it against our own interests.

We also advertise on third-party platforms, including LinkedIn, Meta, Google and Reddit. Those platforms process personal data as controllers in their own right, under their own privacy notices. Where their advertising tags are on our website (LinkedIn, Google, Microsoft and OpenAI), they load only if you accept advertising cookies through the cookie banner. For the collection of data through those tags we and the platform are joint controllers, under the platform's joint controller terms, and the platform is responsible for its own processing after that. Our Cookie Policy lists each tag.

13. Cookies

Our website uses cookies and similar technologies. Non-essential cookies, including analytics and advertising cookies, are set only where you consent, and you can change or withdraw your choice at any time. The exception is the fraud-detection tool that protects our advertising against bots and fake clicks, which runs on every visit; our Cookie Policy explains how it works.

Full details are in our Cookie Policy.

14. How we keep your information secure

We maintain technical and organisational measures appropriate to the risk, including access controls and least-privilege administration, multi-factor authentication, encryption of data in transit and at rest, endpoint protection and monitoring, logging of administrative access, staff vetting and regular training, and documented incident response.

We hold Cyber Essentials and Cyber Essentials Plus certification, and evidence is available on request.

We assess every supplier who handles personal data on our behalf before engaging them, and we require each of them to give commitments equivalent to those we give.

15. Changes to this notice

We review this notice at least annually and whenever our processing changes materially. The version number and effective date at the top show when it last changed.

Where a change materially affects how we use personal data about you, we will tell you directly rather than relying on you noticing an update here.

16. How to complain

If you are unhappy with how we have handled your personal data, please contact us first using the details in section 2. We take complaints seriously, we will acknowledge yours within 30 days, and we will tell you the outcome.

You also have the right to complain to the Information Commissioner's Office at any time:

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk/make-a-complaint

Complaining to us first does not affect your right to complain to the ICO.