How Hexalogic IT handles personal data.

Overview

Hexalogic IT respects the privacy of the people and organisations we work with. We only collect personal data where it helps us respond to enquiries, provide managed IT services, protect systems, manage client relationships or meet legal and contractual duties.

This policy is written for website visitors, prospective clients, suppliers, client contacts and authorised users who interact with Hexalogic IT. It should be read alongside our Terms of Use and Cookie Policy.

Who We Are

Hexalogic IT provides managed IT support, cyber security, infrastructure, data management, device management and vendor management services for organisations in the UK.

The organisation responsible for your personal data is currently shown as Hexalogic IT. The team must confirm the legal entity that trades under this name, its company number, registered address and the contact responsible for privacy and data protection complaints before final publication.

Data We Collect

Depending on how you interact with us, we may collect:

• Contact details such as name, job title, organisation, email address and telephone number.
• Enquiry information such as services of interest, business size, support needs, timelines and messages submitted through the website.
• A generated website enquiry reference so we can identify the message in follow-up communications.
• Client administration details needed to manage accounts, proposals, contracts, invoices, support communications and service reviews.
• Technical and service information supplied to us as part of managed IT support, such as device, user, ticket, network, supplier or security context.
• Website and device information such as browser type, pages visited, approximate location, referral source and cookie preferences, where such tools are active.

The current website contact form forwards enquiries through the hosted email delivery route and does not create a separate website database record for each enquiry.

Where Data Comes From

We usually receive personal data directly from you, your employer or another authorised contact when you use the website, contact us, enter into a service relationship or ask us to provide support. We may also receive business contact and technical information from clients, suppliers, service providers, public business records and systems that we are authorised to support.

If another organisation gives us personal data about you, that organisation is responsible for making sure it has authority to share the information. We will provide privacy information when required.

How We Use Data

We use personal data to respond to enquiries, prepare proposals, provide and improve services, manage client relationships, administer contracts, protect client systems, maintain service records and meet legal or regulatory obligations.

The contact form uses Cloudflare Turnstile to distinguish genuine visitors from automated submissions. Turnstile processes limited browser, device and interaction signals for this security purpose and does not receive the information entered into the contact form. Brevo processes the submitted enquiry to deliver it to the Hexalogic IT team.

Where a client asks Hexalogic IT to provide technical support, we may process personal data on the client's behalf under the relevant service agreement. In that situation, the client may be the controller of the data and Hexalogic IT may act as processor.

Lawful Basis

The lawful basis depends on why we use the information. We may use personal data to take steps at your request before entering into a contract, to perform a contract, to comply with a legal obligation, or for legitimate interests where those interests are not overridden by your rights.

Our legitimate interests may include responding to business enquiries, managing client and supplier relationships, operating and improving the website, securing systems, preventing abuse, maintaining appropriate audit records and communicating with relevant business contacts. We use consent where the law requires it, including for optional website analytics under the current website configuration. You can withdraw analytics consent at any time through Cookie settings.

Where information is required for a contract or legal obligation, not providing it may mean that we cannot enter into or perform the relevant service, respond fully to a request or meet the applicable requirement.

Sharing Data

We do not sell personal data. We may share data with trusted service providers, professional advisers, hosting and communication platforms, support tooling providers, payment or accounting services, security and monitoring services, and regulators or authorities where required.

The current website uses managed hosting on Cloudflare infrastructure, Cloudflare Turnstile for contact-form security, Brevo for email delivery, Google Fonts for the Inter typeface and cdnjs for selected animation files. The first-party SiteOps service receives consented website analytics. These providers receive only the information needed for their role, subject to the relevant arrangements.

The final supplier list must be checked against the live website, email, support, accounting, monitoring and client-service stack before sign-off.

International Transfers

Some providers may process or make personal data available outside the UK. Before making a restricted transfer, Hexalogic IT should identify the destination and recipient and use an applicable safeguard, such as UK adequacy regulations or an approved contractual mechanism with the required assessment.

The team must confirm the locations and safeguards that apply to the hosting, Cloudflare, Brevo, Google, support and other supplier arrangements before this section is final.

Retention

We keep personal data only for as long as needed for the purpose it was collected, including enquiry follow-up, service delivery, account management, dispute handling, security, audit and legal record keeping.

The website deletes individual SiteOps analytics events after 30 days. It also deletes the website's counts-only contact-delivery status records after 30 days; those records contain a timestamp and delivery outcome rather than the enquiry contents. Contact-form enquiries are delivered by email and are not stored as separate enquiry records in the website database.

The team must approve retention periods for delivered enquiry emails, client records, support tickets, contracts, finance records, security logs, backups and supplier systems before this policy is final.

Your Rights

Under UK data protection law, you may have rights to access, correct, erase, restrict, object to or receive a copy of your personal data. You may also have the right to withdraw consent where processing is based on consent. The rights that apply can depend on the purpose and lawful basis.

You can raise a privacy request using the contact route provided on this website. We may need to verify your identity before acting on a request, and we will explain if a legal exception affects what we can provide.

Automated Decisions

Hexalogic IT does not currently use website enquiry information to make solely automated decisions that produce legal or similarly significant effects. Cloudflare Turnstile makes an automated security assessment to help decide whether a form submission appears genuine; this is used only to protect the form from abuse.

Security

Hexalogic IT takes reasonable technical and organisational steps to protect personal data against unauthorised access, loss, misuse or disclosure. These steps may include access controls, secure configuration, monitoring, staff awareness, supplier review and appropriate service procedures.

No website, email route or IT environment can be guaranteed completely secure. If you believe data has been sent to us in error or there is a security concern, please contact us promptly.

Data Protection Complaints

You can make a data protection complaint through the contact page. Please state clearly that the message is a data protection complaint and explain what happened, when it happened and the outcome you are seeking. Do not include passwords or unnecessary sensitive information.

We will acknowledge a data protection complaint within 30 days, investigate it appropriately and communicate the outcome without undue delay. The team must confirm the responsible person, internal escalation route and complaint record-retention period.

If you remain unhappy, you can complain to the UK Information Commissioner's Office. We would appreciate the opportunity to address the matter first.

Contact

Questions about this policy, requests about personal data and data protection complaints should be sent through the contact page until the dedicated privacy contact is confirmed.

The team must publish a monitored privacy contact and confirm whether a Data Protection Officer has been appointed or is legally required. If there is no Data Protection Officer, the policy should identify the person or role responsible for privacy enquiries.