Privacy Policy
1. Who we are
This Privacy Policy applies to ApexPoint Data, a sole trader business based in Neath Port Talbot, Wales ("we", "us", "our"). We provide IT and data consultancy services to business clients across the United Kingdom.
We are the data controller for personal data collected through this website and in connection with the delivery of our services. We are committed to handling personal data responsibly and in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
If you have any questions about this policy or how we handle your data, please contact us at: services@apexpointdata.com
ICO registration: [Placeholder — insert ICO registration number once obtained, or remove this paragraph if registration is not required for your processing activities. Most businesses that process personal data as part of their commercial activities are required to register with the ICO. Visit ico.org.uk to check and register.]
2. What personal data we collect
We collect and process the following categories of personal data:
Contact and identity information — name, job title, business name, email address, telephone number, and business address. This is collected when you contact us through the website, by email, or by telephone, or when you engage us to provide services.
Communications data — the content of emails, messages, and other correspondence you send to us in connection with an enquiry or engagement.
Engagement and project data — information provided to us in the course of delivering our services, which may include technical, organisational, or operational information about your business. Where this information contains personal data (for example, within documents, records, or systems we are asked to assess), it is processed solely for the purpose of service delivery and is handled in accordance with Section 5 of this policy.
Website usage data — technical information collected automatically when you visit our website, including IP address, browser type, pages visited, and time of visit. Please refer to our Cookie Policy for further detail.
3. How we collect personal data
We collect personal data in the following ways:
— Directly from you, when you contact us by email, telephone, or through our website contact form.
— In the course of providing services to you or your organisation, including through documents, systems, or information you share with us as part of an engagement.
— Automatically through our website, via cookies and standard web server logging. Please see our Cookie Policy for further information.
4. Why we use your personal data and our lawful basis
We only process personal data where we have a lawful basis to do so under UK GDPR. The purposes for which we use personal data, and our lawful basis for each, are set out below.
PurposeLawful basis
Responding to enquiries and service requestsLegitimate interests
Delivering contracted servicesPerformance of a contract
Managing client accounts and communicationsPerformance of a contract / Legitimate interests
Complying with legal and regulatory obligationsLegal obligation
Improving our website and servicesLegitimate interests
5. Client engagement data
In the course of delivering our services, clients may share with us information — including documents, records, system access, and organisational data — that contains personal data relating to their employees, customers, or other individuals. Where this occurs:
— We process such data only to the extent necessary to deliver the agreed services.
— We do not use client engagement data for any purpose other than service delivery.
— We handle all such data with appropriate confidentiality and security controls.
— Where a client shares personal data with us as part of an engagement, the client remains the data controller for that data and is responsible for ensuring they have a lawful basis for sharing it. Our Terms and Conditions address these obligations in further detail.
6. Who we share your data with
We do not sell, rent, or trade your personal data. We do not share personal data with third-party marketing organisations.
We may share personal data with third parties only in the following limited circumstances:
— Legal and regulatory obligations — where we are required to disclose data by law, court order, or regulatory authority.
— Professional advisers — such as legal or accounting professionals, where necessary and subject to confidentiality obligations.
7. How long we keep your data
We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law. Our standard retention periods are as follows:
— Enquiry and contact data — retained for 12 months from last contact where no engagement follows, then securely deleted.
— Client engagement records — retained for 6 years from the end of the engagement, in line with standard UK legal and contractual limitation periods.
— Financial and invoicing records — retained for 6 years from the end of the relevant tax year, as required by HMRC.
8. How we protect your data
We take the security of personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, destruction, or disclosure. These measures include secure email communication, access controls on devices and systems used to process personal data, and secure disposal of data and media in accordance with our professional services.
No method of transmission or storage is completely secure. In the event of a personal data breach that is likely to result in a risk to individuals, we will notify the ICO within 72 hours and affected individuals where required under UK GDPR.
9. International transfers
We do not routinely transfer personal data outside the United Kingdom. Where any transfer outside the UK is necessary, we will ensure that appropriate safeguards are in place in accordance with UK GDPR requirements.
10. Your rights
Under UK GDPR, you have the following rights in relation to your personal data:
— Right of access — to request a copy of the personal data we hold about you.
— Right to rectification — to request correction of inaccurate or incomplete personal data.
— Right to erasure — to request deletion of your personal data, where we have no lawful basis to continue holding it.
— Right to restrict processing — to request that we limit how we use your data in certain circumstances.
— Right to data portability — to receive your data in a structured, commonly used format where processing is based on consent or contract.
— Right to object — to object to processing based on legitimate interests.
To exercise any of these rights, please contact us at services@apexpointdata.com. We will respond within one calendar month. We may need to verify your identity before processing a request.
If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.
11. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal obligations. The current version will always be available on our website, with the date of last update shown at the top of this page. We encourage you to review this policy periodically.
12. Contact us
If you have any questions, concerns, or requests relating to this Privacy Policy or the way we handle personal data, please contact us:
ApexPoint Data
Neath Port Talbot, Wales