Last updated: 27 October 2026
This policy explains how IT Zero Ltd (“IT Zero”, “we”, “us”) collects and uses personal data when you visit our website, contact us, book a call, or work with us as a client or supplier. We are committed to handling your information securely, fairly and in line with UK data protection law, including the UK GDPR and the Data Protection Act 2018.
Who we are
IT Zero Ltd is a company registered in England & Wales (company number 10456031) with its registered office at 5 Penta Court, Station Road, Borehamwood, Hertfordshire, WD6 1SL. We are the controller of the personal data described in this policy and are registered with the Information Commissioner’s Office (registration number ZB380905).
If you have any questions about this policy or how we use your data, email [email protected], call 0203 8833 444, or write to us at the address above.
Our clients’ data
When we provide IT services, we often have access to personal data held on our clients’ systems, such as emails, files and user accounts. In that case our client is the controller and we act as their processor, only on their instructions and under our General Terms and Conditions. If your data is held by one of our clients, please contact them about how it is used.
The information we collect
- Contact details, such as your name, job title, organisation, email address and phone number.
- Correspondence, including emails, messages and notes of phone calls with us.
- Booking details you provide when you schedule a call or meeting through our online booking page.
- Support information, such as ticket details, device and system information, and logs of remote support sessions.
- Account and billing details, such as billing contacts, invoices, payments and order history.
- Website usage data, such as your IP address, browser and device type, and the pages you visit, collected through cookies and similar technologies (see “Cookies” below).
How and why we use your information
We only use personal data where the law allows us to. The table below sets out what we use it for and our lawful basis.
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries, arranging calls and preparing quotes or proposals | Legitimate interests (responding to people who contact us) and taking steps at your request before entering into a contract |
| Providing our services and support, including remote support sessions and our helpdesk | Performance of a contract, and legitimate interests where we deal with a client’s staff rather than the client itself |
| Invoicing, payments and keeping accounting records | Performance of a contract and compliance with our legal obligations |
| Keeping our website, systems and clients secure, and preventing fraud | Legitimate interests |
| Understanding how our website is used so we can improve it | Legitimate interests – we use cookieless statistics that only report overall visitor numbers |
| Sending business contacts relevant updates about our services | Legitimate interests; you can opt out at any time using the link in our emails or by contacting us |
| Complying with the law and dealing with legal claims | Legal obligation and legitimate interests |
Who we share it with
We do not sell your personal data. We share it only where necessary with:
- service providers who support our business, including Microsoft (email, Microsoft 365 and our booking page), Cloudflare (website security, performance and cookieless visitor statistics), and the helpdesk, remote support and monitoring platforms we use to deliver our services;
- suppliers and distributors, where needed to fulfil an order you have placed with us;
- our accountants, banks, insurers and professional advisers; and
- law enforcement, regulators or other authorities where we are required to by law.
Our service providers act on our instructions and must keep your data secure.
International transfers
Some of our service providers store or process data outside the United Kingdom. Where they do, we make sure the transfer is protected, for example by relying on UK adequacy regulations or the UK International Data Transfer Agreement or Addendum.
How long we keep it
- Enquiries from people who do not become clients: up to 2 years after our last contact.
- Client and supplier records, contracts, support tickets and invoices: for the length of our relationship and 6 years afterwards, to meet our legal, tax and accounting obligations.
- Website statistics: reported by Cloudflare in aggregate form only, without cookies or individual visitor profiles.
- Marketing preferences: we keep a record of opt-outs so that we respect them.
How we protect it
As an IT security provider, we take protecting data seriously. We use measures including multi-factor authentication, encryption, access controls, monitored endpoint protection and regular backups, and our staff are bound by confidentiality obligations.
Cookies
Cookies are small files stored on your device. We keep them to a minimum and do not use advertising or tracking cookies:
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
| __cf_bm, cf_clearance | Cloudflare | Protects the website from bots and malicious traffic (strictly necessary) | 30 minutes to 1 year |
| wordpress_*, wp-settings-* | WordPress | Keeps staff signed in to manage the website; not set for ordinary visitors | Session to 1 year |
We measure visits to our website using Cloudflare Web Analytics, which does not use cookies or track individual visitors. Our contact page includes an embedded Google Map; if you interact with it, Google may set its own cookies under Google’s privacy policy. You can block or delete cookies at any time in your browser settings.
Your rights
You have the right to:
- ask for a copy of the personal data we hold about you;
- ask us to correct inaccurate or incomplete data;
- ask us to delete your data, or restrict how we use it;
- object to how we use your data, including for direct marketing;
- ask us to transfer your data to you or another organisation; and
- withdraw your consent at any time, where we rely on it.
To exercise any of these rights, contact us using the details above. We will respond within one month. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113, though we would appreciate the chance to resolve your concern first.
Changes to this policy
We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated.