In one minute

We collect what we need to run your IT and nothing we do not. We never sell it. You can ask for a copy or ask us to delete it at helpdesk@it-360.co.uk and we reply within a month.

Who we are

IT 360 Group Ltd (company number 16259600), trading as IT-360, is the data controller for this website. We are also the controller for the IT, security, connectivity, software and marketing services we provide. Our registered office is 3rd Floor, 86-90 Paul Street, London EC2A 4NE. We are registered with the Information Commissioner's Office (ICO) as a data controller. Questions about this notice go to helpdesk@it-360.co.uk or 0113 216 6777.

What we collect and where it comes from

We collect only what we need to do the job you have asked for.

Contact details you give us: name, job title, company, email address and phone number, through our forms, by email, by phone, or on a contract.
Service data when you are a client: the devices, user accounts, systems and licences we look after; tickets and the notes on them; monitoring and security alerts from the tools we run for you; and call records from the phone systems we provide.
Website data: pages visited, the device and browser used, and approximate location, collected through cookies only if you accept them (see the Cookie policy).
Quick Support sessions: when an engineer connects to your screen at your request we log the session time and the engineer's name. Nothing is recorded or stored from your screen.
Information from suppliers we buy services through for you, such as Microsoft, 8x8 and Zest4, limited to what is needed to provision and support your account.

Why we use it and our lawful basis

UK GDPR requires a lawful basis for each use. Ours are:

What we do	Lawful basis
Deliver the services in your contract: run your IT, answer tickets, provision lines and licences	Contract
Invoice you and keep accounting records	Contract and legal obligation
Monitor systems for faults and security threats, and keep logs	Legitimate interests (keeping your systems and ours secure) and, for regulated clients, legal obligation
Reply to an enquiry or quote request	Steps before a contract, at your request
Send service notices such as outages, maintenance windows and renewal dates	Contract and legitimate interests
Send marketing by email	Consent, or the soft opt-in for existing clients; every message has an unsubscribe link
Website analytics	Consent, through the cookie banner
Hold references and reviews you have agreed to give	Consent

Who we share it with

We never sell personal data. We share it only with:

Suppliers whose services we provide to you, such as Microsoft, 8x8 and Zest4, and the data-centre and hosting providers we use, each under its own contract and data-processing terms.
The software we run the business on: our helpdesk and CRM, remote monitoring and management, backup, accounting and email platforms. Each provider acts as our processor under a written agreement.
Professional advisers: accountants, auditors, insurers and solicitors, when needed.
Certification bodies and regulators where a certification or the law requires it, for example during an ISO 27001 or Cyber Essentials Plus audit.
The police or a court where we are legally required to.

International transfers

We keep data in the UK or the European Economic Area wherever we can. Some of our suppliers, including Microsoft, may process data in other countries. Where they do, the transfer is covered by the UK adequacy regulations, the UK International Data Transfer Agreement or Addendum, or the supplier's binding corporate rules. We can tell you which applies to a specific service.

How long we keep it

Data	Kept for
Client contract, tickets and service records	The life of the contract plus 6 years
Invoices and accounting records	6 years after the end of the financial year, as HMRC requires
Enquiries that do not become a contract	12 months
Monitoring and security logs	12 months, longer where a certification or a client's regulator requires it
Marketing consent and unsubscribe records	Until you withdraw consent, then a record of the withdrawal
Website analytics	As set out in the Cookie policy

Security

We hold ISO 27001:2022 and Cyber Essentials Plus. We apply the same controls to our own systems that we run for clients: multi-factor authentication on every account, encryption of devices and backups, least-privilege access, logging, tested restores and vetted staff. A personal data breach that puts you at risk is reported to the ICO within 72 hours and to you without undue delay.

Your rights

Under UK GDPR you can ask us to:

give you a copy of the personal data we hold about you (a subject access request);
correct anything that is wrong;
delete it, where we no longer have a reason to keep it;
restrict or object to how we use it, including stopping marketing at any time;
give you a copy in a portable format where the basis is contract or consent;
withdraw consent where consent is the basis.

Email helpdesk@it-360.co.uk with "data request" in the subject. We respond within one month and do not charge. We may ask you to confirm your identity first.

Cookies

This website uses cookies. The Cookie policy lists each one, what it does and how to change your choice at any time.

Complaints and changes

If you are unhappy with how we have handled your data, tell us first. Ring 0113 216 6777 and ask for a director; we will acknowledge your complaint within one working day. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

We review this notice at least once a year and whenever the services change. The date at the top is the current version.

Last updated 30 October 2026 · IT 360 Group Ltd · company number 16259600

Privacy notice