Privacy Policy
Have any questions or concerns? Get in touch with our friendly team by giving us a call or sending us an email!
Cloud10 Privacy Policy
1. Who we are and what this policy covers
This policy explains how Cloud10 collects, uses and protects personal data, and the rights you have. It was last updated in October 2026.
Cloud10 is a trading name of IT4Business Solutions Ltd, a company registered in England (company number 07701152). Our address is G5 Chorlton Mill, 3 Cambridge Street, Manchester, M1 5BY. Our Data Protection Officer is Ant Lomas, who you can contact at [email protected].
When this policy applies
This policy applies where Cloud10 decides how and why personal data is used. In data protection law, that makes us the controller. It covers:
- people who visit our website or contact us
- prospective customers and people who sign up for our events, newsletters or whitepapers
- contacts at our customers and suppliers, such as the people who sign contracts, receive invoices or raise support requests
- people who apply to work for us
When this policy does not apply
When we provide IT services, we often have access to personal data held in our customers’ systems. Examples are user accounts, mailboxes, files, devices and the details in support requests. In that role we act only on our customer’s instructions, which makes us a processor.
If your employer or an organisation you deal with is a Cloud10 customer, their privacy notice explains how your data is used. Our obligations to them are set out in clause 18 (Data Protection) of our Terms and Conditions. Questions about that data should go to the organisation concerned first. We will help them respond.
2. Personal data we collect
We collect personal data when you visit our website, fill in a form, contact us by phone, email or our client portal, raise a support request, buy from us, or apply for a job. We also receive some data from third parties, such as credit reference and fraud prevention services, and the suppliers we work with to deliver services.
Type of data | Examples |
Identity and contact | Name, job title, organisation, email address, phone number, postal address |
Account and billing | Contract details, invoices, payment and bank details, credit checks |
Support and service | The content of support requests, emails, chat messages and call notes; what was done and when |
Technical | IP address, device and browser information, server logs, location derived from IP address |
Website use | Pages viewed, services viewed or ordered, how you arrived at our site |
Marketing | Your marketing preferences, event attendance, whitepaper downloads, survey responses |
Recruitment | CV, employment history, references, interview notes |
Call recordings | Recordings of calls to and from our service desk |
Data you give us about other people
Customers often give us details of other people, such as a new starter who needs an account set up. If you do this, you must have a lawful basis to share that person’s data with us and must have told them how it will be used, for example through your own staff privacy notice. You do not usually need their consent.
3. How we use personal data and our lawful bases
The law only allows us to use personal data where we have a lawful basis. The table shows what we use data for and the basis we rely on for each purpose.
Purpose | Lawful basis |
Providing the services you or your organisation have bought, including support, monitoring, security and billing | Contract; or legitimate interests where the contract is with your employer |
Handling, triaging and resolving support requests, including with automated and AI-assisted tools (see section 5) |
|
Verifying the identity and authority of people who request account, access or security changes | Legitimate interests in protecting our customers’ systems and data |
Recording calls and reviewing the quality of our support, and reporting on service performance | Legitimate interests in running and improving our service |
Handling complaints, disputes and debt recovery | Contract; legitimate interests |
Keeping accounting and tax records | Legal obligation |
Preventing fraud and assessing credit risk | Legitimate interests |
Running and improving our website | Legitimate interests; consent for non-essential cookies |
Sending marketing about our products, services and events | Consent for individuals; legitimate interests for business contacts, with an easy opt-out |
Following up on whitepaper downloads and event registrations | Legitimate interests |
Drafting documents, correspondence and reports, analysing information and researching technical issues, with the help of AI assistants (see section 5) | Contract where this is part of delivering services |
Assessing job applications | Steps before entering a contract; legitimate interests |
Meeting legal, regulatory or law enforcement requests | Legal obligation |
Where we rely on legitimate interests, we have weighed our interests against your rights and freedoms. You can ask us for details of that assessment. Where we rely on consent, you can withdraw it at any time.
4. How we handle data for each service
For every service, we use your data for administration, billing, support and delivering the service. The table adds what is specific to each one.
Service | What is specific to this service |
Service desk and IT support | Support requests by phone, email and via our client portal which are logged in our service desk system and can be triaged and handled with automated and AI-assisted tools with our staff reviewing sensitive actions (see section 5). |
Managed IT, monitoring and cyber security | Our monitoring and security tools collect device, user and event information from your systems to detect and fix problems and threats. |
Microsoft 365, Azure and email hosting | We administer your accounts in Microsoft’s cloud. Microsoft acts as a processor and stores the data in the region set for your tenancy. Email hosted by Cloud10 is held in the UK. |
Hosted servers, cloud desktops and CloudDeskPRO | We host and manage the servers and desktops your data is stored on. |
Backup and recovery | We copy your data to backup storage so it can be restored. |
VoIP telecoms and internet connections | We share the details needed with carriers and network providers to supply your lines and connections. Calls to and from our service desk are recorded for training, quality and to help resolve disputes. |
Domains | Registrant details are sent to the domain registry or registrar, which may be outside the UK. |
SSL certificates | The certificate owner’s details are sent to the certificate authority, which may be outside the UK, so it can verify and issue the certificate. |
5. Automated tools and artificial intelligence
Our staff use AI-assisted tools to handle support requests faster.
What the tools do
- Read and categorize incoming support requests and route them to the right person.
- Look up the relevant customer documentation and similar past requests.
- Draft or send replies to routine requests, such as status updates.
- Carry out routine tasks in customers’ systems, such as setting up a new user or resetting a password, where our customer has asked for this and the request comes from an authorised person.
- Run scheduled checks and reports, such as licence usage and security settings.
Safeguards
- Each tool only access the systems and data it needs for the task.
- Actions that could materially affect a customer’s systems, users, security settings or data are reviewed or approved by a member of staff.
- Every action is logged.
- Where a reply to a support request is generated automatically, we make that clear, and you can ask to speak to a person at any time.
- We do not allow personal data or customer information to be used to train or fine-tune AI models.
Automated decisions with legal or similarly significant effect
Automated decisions mean making decisions about you using technology without meaningful human involvement. Decisions with legal or similarly significant effects are those that affect your legal rights or have a major impact on your circumstances such as discrimination or not being able to access a significant service. We do not make decisions that have a legal or similarly significant effect on you based solely on automated processing.
6. Who we share personal data with
We never sell personal data, and we do not share it with third parties for their own marketing.
We share personal data only where it is needed to deliver our services, run our business or meet the law. The service providers we use act on our instructions under written contracts that require them to keep data secure and use it only for the service they provide to us.
Who | Why |
Service desk, ticketing and client portal software | To log and manage support requests |
AI and automation providers | To help assess, route and resolve support requests and assist our staff with drafting, analysis and research (see section 5). |
Remote monitoring, management and security tools | To monitor, maintain and protect customers’ systems |
IT documentation platforms | To store the technical documentation we use to support customers |
Cloud hosting providers, including Microsoft | To host our systems and customers’ services |
Licensing distributors | To supply software licences, such as Microsoft 365 |
Telecoms carriers and network providers | To supply phone lines and internet connections |
Domain registrars and certificate authorities | To register domains and issue SSL certificates |
Accounting, payment, credit reference and fraud prevention services | To bill, take payment and manage credit and fraud risk |
Professional advisers, such as lawyers, accountants and insurers | To get advice and protect our business |
A list of the suppliers that process customer data is available on request from [email protected].
We may also share personal data:
- if we are required to by law, a court or a regulator, or to protect the rights, property or safety of Cloud10, our customers or others
- with a prospective buyer if we sell or merge our business, under confidentiality agreements
Some suppliers, such as credit reference agencies and social media platforms, act as controllers in their own right. Their own privacy policies apply.
7. International transfers
Sometimes. We may transfer and process your personal data outside of the United Kingdom (UK) /European Union (EU) to countries where data protection laws are less stringent than those in the UK/EU. For example, we transfer data because our service providers can be based outside the UK/EU. When we transfer your personal data outside of the UK/ EU we only do so to entities that offer our users the same level of data protection as that afforded by the UK Data Protection Act 2018 including the UK GDPR) and the EU GDPR.
- We will only transfer your personal information to countries that have been deemed to provide an adequate level of protection for personal information; or
We will use specific contracts approved for use in the UK or EU which give personal information the same protection it has in the UK/EU. For example, the use of Article 46 UK and EU GDPR safeguard mechanisms to transfer personal data endorsed by the UK Government or European Commission.
8. How we keep personal data secure
Cloud10 is certified to ISO 27001, the international standard for information security, and holds Cyber Essentials certification. Our security measures include:
- encryption of personal data in transit and, where appropriate, at rest, including all payment details
- access controls, so staff and tools can only reach the data they need
- multi-factor authentication for access to our systems and customers’ systems
- due diligence on suppliers before they handle personal data, and contracts that require them to protect it
- staff training on security and data protection
No method of sending data over the internet is completely secure, so we cannot guarantee the security of data while it is being sent to our website. If you have a password for our client portal, please keep it confidential and do not share it.
9. How long we keep personal data
We keep personal data only for as long as we need it for the purposes in section 3, then delete it securely or anonymise it. Our suppliers delete the data they hold for us within the same periods.
Data | How long we keep it |
Contract, billing and accounting records | While you are a customer, then 7 years, to meet tax and accounting law |
Support requests and the actions taken | While your organisation is a customer, then deleted within 90 days of it leaving |
Call recordings | Up to 60 days |
Copies held by our AI-assisted support tools | We keep this data while your organisation is a customer. After your organisation stops being a customer, we delete it within 90 days and delete any remaining backup copies within a further 7 days. |
Marketing contacts | Until you opt out, or after 3 years without contact |
Website and server logs | 2 months |
|
|
When we stop providing services to a customer, we return or delete the data we hold on their behalf, as set out in our Terms and Conditions.
10. Your rights
You have the following rights over your personal data. To use any of them, email [email protected]. We will respond within one month, or tell you within that month if we need longer because the request is complex.
Right | What it means |
Access | Ask for a copy of the personal data we hold about you |
Rectification | Ask us to correct data that is wrong or incomplete |
Erasure | Ask us to delete your data where we no longer need it or have no lawful basis to keep it |
Restriction | Ask us to pause using your data, for example while we check it is accurate |
Objection | Object to our use of your data based on legitimate interests, and always to direct marketing |
Data portability | Ask for data you gave us in a common electronic format, or for us to send it to another organisation |
Automated decisions | Ask for a person to review any decision made solely by automated means (see section 5) |
Withdraw consent | Withdraw consent at any time, where we rely on it |
Some rights only apply in certain circumstances. We may need to keep some data to meet legal or accounting obligations, and limiting how we use it may stop us providing a service. We will explain if that applies.
If we hold your data on behalf of a Cloud10 customer (see section 1), please send your request to that organisation. We will help them respond.
11. Marketing, cookies, social media and links
Marketing
We may send you news about our products, services, events and training by email, phone, text or post. We only do this where you have agreed, or where you are a business contact and we think it will interest you. Every marketing message includes an opt-out link, which you can use at any time to stop receiving marketing from us. If you download a whitepaper, we may phone you to ask for your feedback.
Cookies
Our website uses cookies that are essential for it to work. We also use Google Analytics cookies to understand how visitors use the site. Google acts as our processor for this and may process the data in the United States. We only set non-essential cookies if you agree to them, and you can change your choice at any time through the cookie banner on our website.
Social media, reviews and other websites
Posts and comments you make on our social media pages, or in reviews of our services, are public and are governed by the platform’s own terms and privacy policy. Our website links to other websites. We are not responsible for how those sites handle your data, so please read their privacy policies.
12. Data breaches, changes, contact and complaints
Data breaches
If a personal data breach happens, we will report it to the Information Commissioner’s Office within 72 hours where the law requires. We will tell you without undue delay if it is likely to put your rights and freedoms at high risk. Where the breach affects data we hold for a customer, we will tell that customer so they can meet their own obligations.
Changes to this policy
We review this policy at least once a year and whenever our services or the law change. The “last updated” date at the top shows when it last changed. If we make significant changes, we will tell our customers by email.
Contact us
For any question about this policy or how we use your data, contact our Data Protection Officer, Ant Lomas:
- Email: [email protected]
- Phone: 0161 235 5344
- Post: Data Protection Officer, Cloud10, G5 Chorlton Mill, 3 Cambridge Street, Manchester, M1 5BY
Complaints
If you are unhappy with how we have handled your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office:
- Website: org.uk/make-a-complaint
- Phone: 0303 123 1113
- Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF