Legal

Privacy Policy

How Constructive-IT collects, uses, stores, and protects personal data under UK GDPR.

Last updated: July 2026

1. Introduction

This privacy policy explains how Constructive-IT Limited ("Constructive-IT," "we," "our," or "us") collects, uses, stores, shares, and protects personal data when you visit www.constructive-it.co.uk, contact us, subscribe to updates, or use our IT infrastructure services.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) as incorporated into UK law, the Data Protection Act 2018, and — where applicable — the Privacy and Electronic Communications Regulations 2003 (PECR).

We are required to provide you with this information under the UK GDPR transparency obligations (including Articles 13 and 14). Please read this policy carefully. Where we rely on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

2. Data Controller

Constructive-IT Limited is the data controller for the personal data described in this policy.

Legal entity: Constructive-IT Limited
Company number: 10464496
Registered office: 167-169 Great Portland Street, 5th Floor, London W1W 5PF, United Kingdom
General enquiries: info@constructive-it.co.uk
Data protection contact: privacy@constructive-it.co.uk
Telephone: +44 207 1832744

We have not appointed a Data Protection Officer (DPO) because we are not required to do so under UK GDPR. Questions about this policy or our use of your personal data should be sent to our data protection contact.

3. Personal Data We Collect

"Personal data" means information that identifies, or could reasonably identify, an individual. We may collect the following categories, depending on how you interact with us:

Identity and contact details — such as first name, last name, job title, company name, email address, telephone number, and postal address.
Enquiry and project information — information you provide about your premises, technical requirements, timelines, budgets, and other details needed to assess or deliver our services.
Communications — the content of messages, emails, call notes, and support records relating to your enquiry or our services.
Marketing preferences — whether you have subscribed to updates and any opt-out requests.
Website and technical data — such as IP address, browser type, device type, operating system, referring URL, pages viewed, date/time of access, and similar server or security log data.
Cookie and consent data — your cookie consent choices stored in your browser or device.

We do not intentionally collect special category data (such as health data or information about criminal convictions) through this website. If such information is included in a message you send us, we will only use it as necessary to respond to your enquiry or deliver services and will protect it accordingly.

We do not collect payment card details through this website. Payment terms for contracted work are handled separately under our commercial agreements.

4. How We Collect Personal Data

We collect personal data from the following sources:

Directly from you — when you complete a contact or quote form, subscribe to our newsletter, email us, call us, or otherwise communicate with us.
Automatically — when you browse our website, including through server logs and similar technologies used to operate and secure the site.
From third-party service providers — where necessary to operate our website, protect against abuse, or manage enquiries (for example, hosting logs or bot-protection services).
From your organisation — where a colleague or supplier provides your contact details in connection with a project.

Where we obtain personal data from a source other than you, we will provide you with the privacy information required by UK GDPR within a reasonable period and no later than one month, unless an exemption applies.

5. How and Why We Use Personal Data (Purposes and Lawful Bases)

UK GDPR requires us to have a lawful basis for each purpose for which we use personal data. The table below sets out our main purposes, the types of data involved, and the lawful basis we rely on under Article 6 of the UK GDPR.

Responding to enquiries and preparing quotations

Data used: identity, contact, enquiry, and communication data.
Lawful basis: Article 6(1)(b) — steps at your request prior to entering a contract; and/or Article 6(1)(f) — our legitimate interests in operating our business and responding to prospective customers.

Delivering contracted services and managing projects

Data used: identity, contact, project, communication, and billing-related contact data.
Lawful basis: Article 6(1)(b) — performance of a contract or steps prior to entering a contract.

Managing customer relationships and providing support

Data used: identity, contact, project, communication, and service history data.
Lawful basis: Article 6(1)(f) — our legitimate interests in maintaining accurate records, providing support, and managing ongoing relationships; and/or Article 6(1)(b) where the activity is necessary for our contract with you.

Newsletter and marketing communications

Data used: email address, name where provided, marketing preference data, and engagement data where available.
Lawful basis: Article 6(1)(a) — consent, where you subscribe through our website or otherwise opt in; and/or Article 6(1)(f) — our legitimate interests in promoting relevant services to business contacts, where permitted by law and subject to your right to object or opt out.
PECR: we send electronic marketing messages in compliance with PECR. You may unsubscribe at any time using the link in our emails or by contacting us.

Operating, securing, and improving our website

Data used: website, technical, cookie/consent, and security log data.
Lawful basis: Article 6(1)(f) — our legitimate interests in ensuring our website works correctly, remains secure, and is maintained; and, for non-essential cookies or similar technologies, Article 6(1)(a) — consent where required by PECR.

Preventing fraud, abuse, and unauthorised access

Data used: contact, technical, and security-related data submitted through forms or detected in logs.
Lawful basis: Article 6(1)(f) — our legitimate interests in protecting our website, systems, and users from misuse.

Legal, regulatory, and accounting obligations

Data used: identity, contact, contract, billing, and communication data as required.
Lawful basis: Article 6(1)(c) — compliance with a legal obligation; and/or Article 6(1)(f) — our legitimate interests in establishing, exercising, or defending legal claims.

Legitimate interests

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and freedoms. These interests include running an efficient B2B services business, responding to enquiries, maintaining customer records, securing our website, and promoting our services to relevant business contacts. You have the right to object to processing based on legitimate interests, including direct marketing, as explained in section 12.

6. Who We Share Personal Data With

We do not sell your personal data. We share personal data only where necessary and under appropriate safeguards, including with:

Service providers (processors) who process data on our instructions to help us operate our business and website.
Professional advisers such as accountants, insurers, or legal advisers, where necessary.
Regulators, courts, or law enforcement where required by law or to protect our legal rights.
Business transferees in connection with a merger, acquisition, or asset sale, subject to appropriate protections.

Our key processors include:

Zoho (customer relationship management)

We use Zoho CRM to record enquiries, manage sales interest, and support customer communications. Zoho processes contact and enquiry data on our behalf under a data processing agreement. Zoho's privacy information is available at https://www.zoho.com/privacy.html.

Website hosting and infrastructure providers

Our website is hosted on secure cloud infrastructure. Hosting providers may process server logs and technical data necessary to deliver the site, maintain uptime, and protect against security threats.

Google (embedded map content and bot protection, where used)

Our contact page embeds Google Maps, which may process technical data such as your IP address when the map loads. Where bot-protection or spam-prevention tools from Google are used in connection with our forms, Google may process technical and interaction data for security purposes. Google's privacy information is available at https://policies.google.com/privacy.

We require processors to handle personal data securely, only for specified purposes, and in accordance with UK GDPR. A copy of our processor safeguards can be requested by contacting privacy@constructive-it.co.uk.

7. Cookies and Similar Technologies

We use cookies and similar technologies on our website in accordance with PECR and UK GDPR. Our Cookie Policy provides full details of the cookies and similar technologies we use, your consent choices, and how to manage them.

In summary:

We store your cookie consent choice locally in your browser (for example, under the key site_shell_consent). This is strictly necessary to remember your preference.
Non-essential cookies are only used where you have given consent through our cookie banner. We do not currently deploy third-party analytics or advertising cookies.
Embedded third-party content, such as Google Maps on our contact page, may set its own cookies when loaded.

8. International Transfers

Some of our processors may store or access personal data outside the United Kingdom. Where personal data is transferred internationally, we ensure a valid transfer mechanism is in place under UK GDPR, such as:

an adequacy regulation in respect of the destination country;
the UK International Data Transfer Agreement (IDTA) or UK Addendum to standard contractual clauses;
Binding Corporate Rules, where applicable; or
another mechanism recognised under UK data protection law.

You may request further information about international transfers and the safeguards we use by contacting privacy@constructive-it.co.uk.

9. How Long We Keep Personal Data

We retain personal data only for as long as necessary for the purposes set out in this policy, including to satisfy legal, accounting, or reporting requirements. Retention periods depend on the nature of the data and our relationship with you.

Sales enquiries that do not proceed to contract: typically up to 24 months from last meaningful contact, unless a longer period is needed to handle a live dispute or legal claim.
Customer and project records: for the duration of the contract and relationship, then typically up to 7 years afterwards where needed for legal, tax, warranty, or defence-of-claims purposes.
Newsletter subscription data: until you unsubscribe or withdraw consent, plus a short period to process your request and maintain a suppression record so we do not contact you again.
Website server and security logs: typically up to 90 days, unless longer retention is required for security investigations or legal obligations.
Cookie/consent records: for the period your preference is stored in your browser or device, or until you clear site data.

When personal data is no longer required, we securely delete or anonymise it.

10. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage. These measures include access controls, secure hosting, staff confidentiality obligations, and supplier due diligence.

No method of transmission over the internet or electronic storage is completely secure. While we take reasonable steps to protect personal data, we cannot guarantee absolute security.

11. Automated Decision-Making and Profiling

We do not use automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.

12. Your Rights Under UK GDPR

Subject to applicable law and exemptions, you have the following rights in relation to your personal data:

Right of access (Article 15) — to obtain confirmation of whether we process your personal data and, where we do, access to that data and related information.
Right to rectification (Article 16) — to request correction of inaccurate personal data and completion of incomplete personal data.
Right to erasure (Article 17) — to request deletion of personal data in certain circumstances.
Right to restriction of processing (Article 18) — to request that we limit processing in certain circumstances.
Right to data portability (Article 20) — to receive personal data you provided to us in a structured, commonly used, machine-readable format, and to transmit it to another controller where processing is based on consent or contract and carried out by automated means.
Right to object (Article 21) — to object to processing based on legitimate interests, including direct marketing. If you object to direct marketing, we will stop that processing.
Rights related to automated decision-making (Article 22) — not applicable as we do not conduct relevant automated decision-making.
Right to withdraw consent — where processing is based on consent, to withdraw consent at any time.

We will respond to valid requests without undue delay and within one month, unless the request is complex or numerous, in which case we may extend by up to two further months and will explain why. We may need to verify your identity before responding and may charge no fee unless a request is manifestly unfounded, excessive, or repetitive.

To exercise your rights, contact privacy@constructive-it.co.uk.

13. Requirement to Provide Personal Data

Where you contact us or request services, you are not usually required by law or contract to provide personal data. However, if you choose not to provide information we reasonably need to respond to your enquiry or deliver services, we may be unable to assist you or enter into a contract with you.

14. Complaints

If you have concerns about how we handle personal data, please contact us first at privacy@constructive-it.co.uk so we can try to resolve the matter.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:

Website: https://ico.org.uk
Telephone: 0303 123 1113

15. Children

Our website and services are directed at businesses and adults. We do not knowingly collect personal data from children under 13. If you believe a child has provided personal data to us, please contact us and we will take steps to delete it.

16. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in law, our processing activities, or our services. The "Last updated" date at the top of this page shows when it was last revised. Material changes will be posted on this page. Where required, we will provide additional notice or seek consent before new processing activities begin.

17. Contact Us

For questions about this privacy policy or our processing of personal data, contact:

Email: privacy@constructive-it.co.uk
Post: Data Protection, Constructive-IT Limited, 167-169 Great Portland Street, 5th Floor, London W1W 5PF, United Kingdom
Telephone: +44 207 1832744