Privacy Policy

We are an IT services company. Most of the personal data we hold belongs to people at client businesses who have contacted us about a project, and to visitors who browse this website. This policy explains what we collect, why we are allowed to collect it, how long we keep it and what you can tell us to do with it.

We serve clients principally in the United Kingdom and the United States while operating from India. We therefore apply UK GDPR standards to everyone we deal with, regardless of where you are, and honour the additional rights that US state privacy laws give their residents.

1. Who this policy covers

• Website visitors — anyone browsing troubleshootersit.com.
• Enquirers and prospective clients — people who complete our contact form, email us or call.
• Clients and their staff — the individuals we work with day to day during a project.
• Suppliers and contractors — the people at businesses that supply us.

Where we build, host or maintain a system for a client and that system holds data about the client's own customers, the client is the controller of that data and we act as their processor. Our handling of it is governed by our contract with them, not by this policy.

2. What we collect

2.1 Information you give us

• Identity and contact details — your name, job title, employer, email address, telephone number and postal address.
• Project information — the requirements, briefs, brand assets, credentials and content you send us so we can do the work.
• Correspondence — the content of emails, calls, meeting notes and support tickets between us.
• Billing details — invoicing address, purchase order references and tax registration numbers.

2.2 Information collected automatically

• Technical data — IP address, browser type and version, operating system, device type, screen size and time zone.
• Usage data — pages viewed, time on page, referring site and the path you took through our site.
• Cookie data — as set out in our Cookie Policy.

2.3 What we do not collect

We do not ask for and do not want special category data — information about health, race, religion, political opinions, trade union membership, sexual orientation, genetics or biometrics. Please do not send it to us. If you do, we will delete it unless we are legally required to keep it.

We do not collect card numbers. Payments are handled by regulated payment providers who take the card details directly; we see only a confirmation that payment succeeded and the last four digits.

Our services are aimed at businesses. We do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, tell us and we will remove it.

3. Why we use it, and our lawful basis

UK and EU law requires us to have a specific legal reason for each use of your data. Ours are set out below.

Where we rely on legitimate interests, we have weighed our interest against your rights and concluded ours does not override yours. You can ask us for that assessment, and you can object at any time under clause 8.

4. Marketing

We only send marketing emails where you have opted in, or where you are an existing client and the message concerns services similar to those we have already provided. Every marketing email carries an unsubscribe link that works immediately and without needing to log in. Unsubscribing from marketing does not stop the operational emails we must send about a live project.

5. Who we share it with

We do not sell personal data. We share it only where it is necessary, and only with:

• Service providers acting on our instructions — email and productivity platforms, cloud hosting, CRM, accounting software, analytics providers and payment processors. Each is bound by a written contract restricting what they may do with the data.
• Professional advisers — accountants, auditors, insurers and lawyers, where they need it to advise us.
• Authorities — where we are legally compelled to disclose, or where disclosure is necessary to establish or defend a legal claim.
• A buyer or successor — if the business is sold or merged, personal data may transfer as part of the assets, subject to the buyer continuing to honour this policy.

We do not permit our service providers to use your data for their own purposes.

6. International transfers

We are based in India and use cloud services hosted in several countries, including the United States and the European Economic Area. If you are in the UK or EEA, this means your data will be transferred outside your home jurisdiction.

India has not been the subject of a UK or EU adequacy decision. Where we transfer personal data from the UK or EEA to ourselves or to a provider in a country without adequacy, we rely on the appropriate safeguards permitted by law — principally Standard Contractual Clauses, together with the UK International Data Transfer Addendum where the transfer originates in the UK. We assess each transfer for risk and apply additional technical measures such as encryption in transit and at rest.

You may request a copy of the safeguards we rely on by emailing us.

7. How long we keep it

The six-year figure for project records reflects the period during which a contractual claim could still be brought. When a retention period expires we delete the data or anonymise it so it can no longer identify you.

8. Your rights

Subject to the conditions in the applicable law, you may ask us to:

• Give you access to the personal data we hold about you, and a copy of it.
• Correct anything inaccurate or incomplete.
• Erase your data, where we no longer have a good reason to keep it.
• Restrict what we do with it while a dispute about its accuracy or our basis is resolved.
• Port it — receive it in a structured, machine-readable format, or have it sent to another provider.
• Object to processing based on legitimate interests. Where you object to direct marketing, we will always stop.
• Withdraw consent at any time, where consent was the basis. This does not affect what we did lawfully beforehand.

We do not make decisions about you by automated means that produce legal or similarly significant effects.

8.1 How to exercise a right

Email info@troubleshootersit.com telling us which right you want to use. We may ask for proof of identity so that we do not disclose your data to someone else. We respond within one month. If a request is unusually complex we may extend that by up to two further months and will tell you why within the first month. There is no charge, unless a request is manifestly unfounded or excessive.

8.2 Complaints

Please raise concerns with us first — we would rather fix it directly. You also have the right to complain to a supervisory authority.

• United Kingdom — the Information Commissioner's Office, at ico.org.uk.
• European Economic Area — the data protection authority in the country where you live or work.
• India — the Data Protection Board of India, under the Digital Personal Data Protection Act 2023.

9. United States residents

If you live in California, Colorado, Connecticut, Utah, Virginia or another state with comprehensive privacy legislation, you have rights to know what personal information we have collected, to have it deleted, to correct it, to obtain a portable copy, and to opt out of its sale or of targeted advertising. You are entitled to exercise these rights without being discriminated against in the price or quality of service you receive.

We do not sell personal information, and we do not share it for cross-context behavioural advertising in exchange for money. Where our advertising measurement cookies could be treated as "sharing" under California law, you can opt out through the cookie settings link in our footer or by sending a Global Privacy Control signal from your browser.

To make a request, email us at the address above with "US privacy request" in the subject line. An authorised agent may act for you if you give them written permission and we can verify it with you directly.

10. How we protect your data

We apply access controls so that staff see only what their role requires, encrypt data in transit using TLS and at rest where our providers support it, require multi-factor authentication on business-critical accounts, keep systems patched, and review supplier security before engaging them.

No system is perfectly secure, and we will not pretend otherwise. If a breach occurs that is likely to result in a risk to your rights, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and tell affected individuals directly where the risk is high.

11. Other websites

Our site links to third-party websites and embeds a video player. Following a link takes you outside our control, and this policy stops at our boundary. Please read the privacy notice of any site you visit.

12. Changes to this policy

We review this policy at least annually and whenever we change how we handle data. The effective date at the top shows when it last changed. Where a change materially affects your rights, we will tell you directly rather than relying on you noticing the update.

13. Contact us