Privacy policy

1. About this policy

This policy explains how Cloud Smart Solutions Ltd handles personal data when you visit our website, make an enquiry, become a client, or interact with us while we deliver managed IT, cloud, and cyber security services. We are committed to handling personal data fairly, transparently, and securely in accordance with the UK General Data Protection Regulation, the Data Protection Act 2018, and other applicable data protection laws.

This policy is written for website visitors, prospective clients, client contacts, suppliers, and the staff of our clients whose data we may handle while providing services. It does not replace the service agreement or data processing terms agreed with a client, which may contain additional detail for a particular service.

2. Who we are and how to contact us

Cloud Smart Solutions Ltd is registered in England and Wales under company number 08884589. Our trading address is Pattisson House, Addison Road, Chesham, Buckinghamshire, HP5 2BD. You can contact us about privacy matters at support@cloudss.co.uk.

We are usually the data controller for personal data relating to our own business contacts, website enquiries, marketing activity, suppliers, and staff. When we provide managed IT services and handle personal data within a client's systems on that client's instructions, the client is normally the data controller and we act as its data processor. In that role, we process data only as needed to provide the contracted services and in line with the client's documented instructions.

3. Personal data we collect

Depending on how you interact with us, we may collect and use the following categories of personal data:

• Website enquiries: your name, business name, email address, telephone number if supplied, your optional answer about how you heard about us, and the message or request you send us through our website or by email.
• Business contact information: names, job titles, work contact details, communications, meeting notes, and relationship information for prospective clients, clients, suppliers, and partners.
• Client-service information: user account details, device and system identifiers, security logs, support tickets, service configuration information, and other personal data that may be present in systems we manage for a client.
• Technical website information: limited information necessary to operate and secure our website, including IP address, browser and device information, and information generated by anti-spam controls.

Please do not send sensitive personal data through a website enquiry form unless it is necessary. If you need to provide special category data or confidential information, contact us first so we can agree an appropriate secure method.

4. How and why we use personal data

We use personal data to respond to enquiries, discuss and deliver services, manage our client and supplier relationships, administer contracts and accounts, maintain security, comply with legal obligations, and improve our services. The optional enquiry source helps us understand how people find us. Where we are acting as a processor for a client, the purpose and means of processing are determined by that client and the relevant contract.

Our lawful bases depend on the activity. We rely on legitimate interests for ordinary business-to-business relationship management, responding to relevant enquiries, securing our systems, and keeping records of communications. We use contract performance where processing is necessary to provide services, prepare for a contract at your request, or manage a client relationship. We use legal obligation where records must be retained or information disclosed by law. We rely on consent for marketing where consent is required, and you can withdraw it at any time using the unsubscribe option or by contacting us.

5. Marketing and communications

We may send relevant business communications about our services to existing clients and business contacts where permitted by law and where we believe the communication is likely to be of interest. We will not use personal email addresses for unsolicited marketing where consent is required. Every marketing email includes a way to unsubscribe, and you may also ask us to stop marketing at any time by emailing office@cloudss.co.uk. Opting out of marketing does not affect essential service, security, billing, or contractual communications.

6. Sharing data and subprocessors

We do not sell personal data. We may share it with trusted service providers and professional advisers where necessary to run our business or deliver client services. These recipients can include cloud hosting and productivity providers, email and communications providers, backup, monitoring, security, and support vendors, payment and accounting providers, certification bodies, insurers, legal advisers, and public authorities where required by law.

When we act as a processor, we use subprocessors only as appropriate for the service and require them to protect personal data through contractual and security controls. A current subprocessor register is available to clients on request. We may also share personal data where necessary to establish, exercise, or defend legal claims, protect people or systems, or comply with a lawful request.

7. International transfers

We aim to process personal data in the United Kingdom wherever practical. Some of the cloud, security, communications, or other specialist providers we use may process personal data outside the UK. Where this happens, we take appropriate steps to ensure the transfer is lawful and protected. These steps may include transferring data to a country covered by UK adequacy regulations, using the UK International Data Transfer Agreement or Addendum, or relying on another lawful safeguard recognised by UK data protection law.

Free tools and optional reports

Tool calculations and worksheets run in your browser and are not saved to our application database. The domain checker passes the domain you enter to our server and Cloudflare's public DNS-over-HTTPS resolver. The password checker sends only the first five characters of a SHA-1 lookup hash directly to the Have I Been Pwned range service; neither the password nor full hash is sent to Cloud Smart. Downloads are created in your browser.

If you choose “Email me this report”, we process the name, work email, company and report you submit to email the full report to you. Your contact details, tool name and result summary go to support@cloudss.co.uk for your enquiry, not the full worksheet or contact sheet. We do not create a separate tool-result database or automatically subscribe you to marketing. The email records are part of the requested communication and follow the retention policy below. Avoid putting passwords, recovery codes or confidential client records in reports.

For abuse prevention, the tool endpoints keep salted request tokens for up to fifteen minutes rather than retaining raw network addresses. Tool analytics record only the tool's identifier and whether it was started, completed or successfully requested by email, not your entries or result. Report forms use reCAPTCHA only when the form comes into view.

8. Retention

We retain personal data only for as long as necessary for the purpose it was collected, including to meet contractual, legal, accounting, tax, dispute-resolution, and security requirements. Enquiry records are normally retained for up to 12 months after our last meaningful contact unless they develop into a client relationship. Client business records and service information are generally retained for the duration of the contract and for up to six years afterwards where required for legal, tax, or contractual reasons.

Where we act as a processor, retention of data in a client's systems is governed by that client's instructions and the relevant contract. On the end of a service, we will return or securely delete personal data as agreed, subject to any legal requirement to retain it and the practical limits of backups. Security logs and backup data may remain for shorter operational periods before being securely overwritten.

9. Security

We use technical and organisational measures designed to protect personal data against accidental loss, unauthorised access, alteration, disclosure, or destruction. These include access controls, least-privilege practices, multi-factor authentication where appropriate, secure configuration, monitoring, backup, staff awareness, and incident-management processes. Our security programme includes Cyber Essentials certification and ongoing monitoring to help us maintain and improve our controls.

No system can be guaranteed completely secure. If we identify a personal data breach that is likely to create a risk to individuals' rights and freedoms, we will take the action required by law, including notifying the relevant client, regulator, and affected individuals where appropriate.

10. Your UK GDPR rights

Subject to conditions and exemptions in data protection law, you have the right to:

• request access to the personal data we hold about you;
• ask us to correct inaccurate or incomplete data;
• ask us to erase data where there is no lawful reason to continue using it;
• ask us to restrict how we use your data in certain circumstances;
• receive data you have provided to us in a portable format where the right applies;
• object to processing based on legitimate interests, including direct marketing; and
• withdraw consent where we rely on consent, without affecting the lawfulness of earlier processing.

To exercise a right, email office@cloudss.co.uk. We may need to verify your identity before responding. If your request relates to data we process for one of our managed IT clients, we may need to refer you to that client because it controls the purpose of that processing.

11. Cookies and this website

Cookies are small text files that a website or a service it uses may store on your device. We use necessary cookies and similar technologies where needed to make the website work, protect it from abuse, and remember essential settings. You can manage or delete cookies through your browser settings, although doing so may affect parts of the site.

Our contact and assessment forms use Google reCAPTCHA to help prevent spam and automated misuse. reCAPTCHA may collect technical information such as your IP address, browser and device details, and interaction data, and Google may use cookies or similar technologies when providing that service. Google's handling of this information is governed by its Privacy Policy and Terms of Service. We use this protection only where relevant to secure our forms and services.

12. Complaints and changes

Please contact us first if you have a concern about how we use personal data, and we will do our best to resolve it. You also have the right to complain to the Information Commissioner's Office, the UK data protection regulator, at ico.org.uk.

We may update this policy from time to time to reflect changes in our services, legal obligations, or the way we handle data. The latest version will always be published on this page with its revised date.