LEGAL
Privacy policy
How we collect, use and protect personal data, and what rights you have over it under UK GDPR.
Who we are
Thorne Technology Ltd is the company behind this website and the services described on it. We are registered in England and Wales, company number 15879105, VAT number GB473009601.
For the information described on this page we are the data controller, which means we decide what is collected and why. We are registered with the Information Commissioner's Office, and our registration number is available on request.
If you want to ask anything about your data, email hello@thornetechnology.co.uk or call 01656 521 505. You will get a person rather than a form.
What this policy covers, and what it does not
This policy covers the personal data we decide the use of: enquiries through this website, our dealings with you as a client or supplier, and the analytics described in the cookie policy.
It does not cover the data inside the systems we manage for a client. When we administer your Microsoft 365 tenant, your server or your CCTV, we are acting on your instructions, which makes you the controller and us the processor. What we may and may not do with that data is set by the data processing terms in your contract with us, not by this page. If you are a client and want a copy of those terms, ask and we will send them.
What we collect through this website
The website itself collects very little. There is no account to create and nothing to sign up to.
| What | Why we have it | Our lawful basis |
|---|---|---|
| Your name, email, phone and whatever you type into the contact form | To answer you, and to quote if you have asked us to | Legitimate interests: you asked us a question and we are answering it |
| Which pages you looked at, and for how long | To work out which of our services people actually want to read about | Consent, which you give or refuse on the cookie banner |
| Your email address, if you ask us to keep you posted | To send you the thing you asked for | Consent, withdrawn by replying or using the unsubscribe link |
We do not buy lists, we do not sell anything to anyone, and we do not run advertising that follows you around other websites.
What we collect when you become a client
Running an IT contract means holding more than an enquiry does. Broadly:
| What | Why we have it | Our lawful basis |
|---|---|---|
| Contact details for the people we deal with at your organisation | To do the work and to reach the right person when something breaks | Performance of our contract with you |
| Support tickets, call notes and site visit records | To fix things, and to know what was done last time | Performance of our contract with you |
| Asset and network records: what hardware you have, how it is configured, where it sits | To support it, and to tell you what you own | Performance of our contract with you |
| Invoices, payment records and bank details for direct debits | To get paid, and to keep the books | Legal obligation under the Companies Act and tax law |
| Administrative accounts and credentials for systems we manage | To administer them | Performance of our contract with you |
Credentials are held in an encrypted vault, are not shared outside the people who need them, and are handed over or destroyed when a contract ends, whichever you ask for.
Cookies and analytics
Until you choose, this site sets nothing beyond the one cookie that remembers your choice. If you accept, we record which pages were viewed and for how long, and Google Analytics does the same. We deliberately do not record your IP address.
The cookie policy lists every cookie by name, what it does and how long it lasts, and the link in the footer of every page lets you change your mind as often as you like.
Who else handles your data
We use other companies to run parts of the business. Each of them only gets what they need for their part, and each is bound by a contract that stops them doing anything else with it.
| Who | What they do for us | What they see |
|---|---|---|
| Hostinger | Hosts this website and the client portal | Anything submitted through the site |
| Cloudflare | Sits in front of the site to keep it fast and online | Traffic passing through, briefly |
| Brevo | Sends our email | Names and email addresses of recipients |
| Microsoft | Our own email, files and Teams | Correspondence with you |
| Website analytics, if you have accepted it | Page views, no IP address | |
| Xero | Our accounts | Billing contacts and invoice records |
| Stripe and GoCardless | Take card payments and direct debits | Payment details, which we never see or store ourselves |
| Datto | Backs up systems we manage | Whatever is in the systems being backed up |
| Ubiquiti UniFi | Manages network equipment we support | Network configuration and device records |
We will also hand over data where the law requires it, for example to HMRC or in response to a court order. We have never been asked, and if we are we will tell you unless we are legally barred from doing so.
Where your data is held
Most of it stays in the UK or the European Economic Area. Some of the companies above are based elsewhere, mainly the United States, so some data is transferred outside the UK.
Where that happens it is covered either by UK adequacy regulations, which say the destination protects data to a comparable standard, or by the Information Commissioner's International Data Transfer Agreement, which is the contract the UK regulator publishes for exactly this. If you want to know which applies to a particular supplier, ask and we will tell you.
How long we keep it
Keeping data forever because it is easier is not a reason. These are our periods. They are ours to set and we will tell you if they change.
| What | How long | Why that long |
|---|---|---|
| An enquiry that did not become anything | 12 months | Long enough to recognise you if you come back, short enough not to be hoarding |
| Client records, tickets and site notes | The contract, then 12 months | So we can answer a question about work we did shortly after you leave |
| Invoices and financial records | 7 years | Tax law requires six; the extra year covers a late enquiry |
| Credentials for systems we manage | Destroyed at the end of the contract | There is no reason to keep a key to a door that is no longer ours |
| Analytics | 14 months | Cut from Google's two year default. Long enough for a year on year comparison |
| Backups of systems we manage | As set in your contract | It is your data and your retention decision, not ours |
Your rights
Under UK GDPR you can ask us to do any of the following. There is no charge and we will answer within one month.
| Right | What it means in practice |
|---|---|
| See what we hold | We send you a copy of your personal data |
| Correct it | If something is wrong, tell us and we will fix it |
| Delete it | We delete it, unless the law requires us to keep it, in which case we will say which law |
| Restrict how we use it | We keep it but stop doing anything with it while a dispute is sorted out |
| Take it elsewhere | We give it to you in a format another supplier can read |
| Object | Where we rely on legitimate interests, you can tell us to stop and we will unless we have a compelling reason not to |
| Withdraw consent | Where we relied on consent, you can take it back at any time, and it does not affect what we did before you did |
Email hello@thornetechnology.co.uk to use any of these. We may ask you to confirm who you are first, which is a protection for you rather than an obstacle.
If you are asking about data inside a system we manage for a client, we will pass your request to that client, because it is theirs to answer and not ours.
If you are not happy
Tell us first. Email hello@thornetechnology.co.uk or call 01656 521 505, and read the complaints page, which sets out what we do and how long we take.
You also have the right to complain to the Information Commissioner's Office, the UK regulator, at ico.org.uk or on 0303 123 1113. You do not have to come to us first, though it is usually quicker.
Changes to this policy
If we start doing something with personal data that this page does not describe, we update the page before we start, not after. Where the change affects something you consented to, we ask again rather than treating an old answer as covering a new question.
This policy is written under the law of England and Wales. Data protection is UK wide: there is no separate Welsh data protection regime, and anyone telling you otherwise is mistaken.