Privacy Policy

We share personal data only with parties who need it for the purposes set out in this notice and only under appropriate written terms.

Sub-processors that handle personal data on our behalf to deliver our services are listed in our Sub-processor List, which we keep current. The list is available at superfast-it.notion.site/client-assurance-pack. Each sub-processor is bound by a written contract that includes UK GDPR Article 28 obligations.

Other recipients include our accountant, our cyber insurer and broker, our solicitor, our pension provider and our bank, all under their own professional and legal duties. We share data with HM Revenue and Customs and other public authorities where the law requires it. We share data with law enforcement and regulators where the law requires it or to defend our rights. If we sell or restructure parts of our business, personal data may be transferred to a successor entity that takes on the same obligations.

We do not sell personal data, and we do not share it with third parties for their own marketing.

Most of the personal data we control stays in the United Kingdom or the European Economic Area. Some of our sub-processors are headquartered outside the UK, and limited processing may take place in the United States or other countries.

Where personal data leaves the UK we rely on one of the following safeguards: a UK adequacy decision (including the UK extension to the EU-US Data Privacy Framework, often called the UK-US Data Bridge); the UK International Data Transfer Agreement (IDTA); or the EU Standard Contractual Clauses with the UK International Data Transfer Addendum. A transfer risk assessment is recorded for each arrangement where a UK adequacy decision does not apply. Our Data Protection Lead approves every international transfer before it is implemented.

We keep personal data only for as long as we need it for the purposes set out in this notice, or for a longer period where the law requires us to. Retention periods by data category are set in our Data Retention Policy and recorded in our Data Register. Examples include:

• enquiry and lead data: retained while there is a live commercial relationship and for a limited period afterwards, then deleted or anonymised

• client service records and contracts: retained for the life of the contract and for six years after termination to meet legal and tax obligations

• finance and tax records: retained for at least seven years to meet HMRC requirements

• applicant data for unsuccessful candidates: retained for up to twelve months for candidate management, then deleted unless you have agreed otherwise

• CCTV footage: retained for thirty days by default, unless required for an investigation or legal claim

• website analytics: retained per the cookie and analytics provider's defaults, as described in our cookie banner

When personal data is no longer needed it is securely deleted or anonymised.

In some circumstances you can ask us to delete your data: see “Request erasure” below for further information.

In some circumstances, we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

We operate a documented information security programme aligned to Cyber Essentials Plus, IASME Cyber Assurance, the IASME Quality Principles and the UK Cyber Assessment Framework (CAF 4). Controls include encryption in transit and at rest, phishing-resistant multi-factor authentication, least-privilege access, vulnerability management, logging and monitoring, and tested incident response.

Where a personal data breach occurs and is likely to risk your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware. Where the risk is high we will also notify you directly without undue delay.

You have rights over your personal data under the UK GDPR:

• the right to be informed (this notice and any further notices we give you at the point of collection)

• the right of access (a copy of the personal data we hold about you)

• the right to rectification (correction of inaccurate or incomplete data)

• the right to erasure in defined circumstances

• the right to restrict processing in defined circumstances

• the right to data portability for data you provided to us and which we process by automated means under consent or contract

• the right to object, including an absolute right to object to direct marketing

• the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects (we do not currently make such decisions)

• the right to withdraw consent where we rely on consent

To exercise any of these rights, contact us using the details in section 14. We respond within one calendar month, extendable by a further two months for complex or numerous requests, in which case we will tell you why. We may need to verify your identity before responding.

Where your request relates to personal data we process on behalf of a client (for example, your employer), we will forward the request to that client without undue delay and support them in responding under the Data Processing Agreement.

Our website uses cookies and similar technologies. Strictly necessary cookies are required for the website to work and are set without consent. Analytics, marketing and preference cookies are only set after you give consent through our cookie banner. You can withdraw or change consent at any time using the cookie controls on the site. Most browsers also allow you to block or delete cookies. If you block cookies, parts of the website may not work as intended.

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. We may use simple segmentation (for example by sector or company size) to tailor marketing communications. You can opt out of marketing at any time using the link in every marketing email or by contacting us.

If you are unhappy with how we have handled your personal data, please contact us first using the details in section 14 so we can try to put things right.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection. The ICO can be reached at ico.org.uk, on 0303 123 1113, or by post at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

We review this notice at least once a year and whenever a change to our processing, our suppliers or applicable law requires it. The version and last review date are shown at the top of the page. Where a change materially affects how we handle your data, we will tell you directly where we can.