Catzen Limited respects your privacy. As an IT service provider, we take data protection seriously — both as a matter of law and as a matter of professional practice. This policy explains what we collect, why, and the rights you have under UK GDPR.
1. Who we are
Catzen Limited ("Catzen", "we", "us", "our") is a company registered in England & Wales with its registered office at Apollo House, Hallam Way, Whitehills Business Park, Blackpool FY4 5FS. We provide managed IT, cybersecurity, cloud, and related services to businesses across the United Kingdom.
As an IT service provider, we often process personal data on behalf of our clients. In those cases, we act as a data processor under UK GDPR, and our clients are the data controllers. Our obligations in that capacity are set out in a Data Processing Agreement with each client. This privacy policy primarily covers personal data we process as a data controller — for example, information you give us when enquiring about our services, or when visiting our website.
2. What information we collect
We may collect and process the following categories of personal data:
- Contact details you provide when you fill in our contact form, email us, or call us — typically your name, company, email address, and phone number.
- Enquiry details — the information you share about your business, IT setup, or project.
- Client account data — for active clients, records relating to the services we provide: user accounts, ticket history, asset registers, and technical documentation.
- Technical data — collected automatically when you use our website: IP address, browser type, device information, and pages visited.
- Cookie data — small text files placed on your device to help the site function correctly (see section 9 below).
3. How we use your information
We use your personal information for the following purposes:
- To respond to your enquiry and communicate with you about potential or ongoing projects.
- To deliver managed IT services to your business, including support tickets, monitoring, and remote access.
- To send you invoices and manage our commercial relationship.
- To improve our website, services, and internal processes.
- To comply with legal, tax, and regulatory obligations — including HMRC requirements, Companies House filings, and ICO registrations.
- To send you occasional service updates or relevant information — only where you have a legitimate interest or have explicitly opted in.
4. Legal basis for processing
Under UK GDPR, we rely on the following legal bases:
- Contract — to deliver services you have engaged us for, and to communicate with you about your account.
- Legitimate interests — to respond to enquiries, improve our services, prevent fraud, and ensure the security of our systems.
- Consent — for marketing emails and non-essential cookies. You can withdraw consent at any time.
- Legal obligation — to keep financial records as required by HMRC and to comply with applicable regulations.
5. How long we keep your data
We keep personal data only as long as necessary:
- Enquiries that don't become clients — up to 12 months, then deleted.
- Active client records — for the duration of the engagement plus 6 years, to meet accounting and legal requirements.
- Marketing subscribers — until you unsubscribe, plus 30 days.
- Website analytics — typically 14 months.
- Support ticket history — for the duration of the client relationship plus 2 years, for reference and audit purposes.
6. Who we share your data with
We do not sell your personal data. We may share it with trusted third parties strictly to run our business and deliver services:
- Cloud and infrastructure providers — including Microsoft 365, Azure, and secure file storage used for email, documents, and client data.
- Security and monitoring tools — used to deliver our managed IT services (RMM, EDR, anti-spam, backup).
- Accounting software — for invoicing and financial records.
- Website infrastructure — hosting, analytics, and email delivery providers.
- Professional advisers — accountants, solicitors, or insurers where required.
- Legal authorities — where we are legally required to do so.
Where data is transferred outside the UK (for example, to US-based cloud providers), we ensure appropriate safeguards are in place, such as the UK International Data Transfer Addendum or equivalent standard contractual clauses.
7. Your rights
Under UK GDPR you have the right to:
- Access a copy of the personal data we hold about you.
- Request correction of inaccurate or incomplete data.
- Request erasure of your data ("right to be forgotten"), subject to legal retention obligations.
- Restrict or object to certain processing activities.
- Request data portability — receive your data in a structured, machine-readable format.
- Withdraw consent at any time where processing is based on consent.
- Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
To exercise any of these rights, email info@catzenlimited.uk. We'll respond within 30 days.
8. Security
As an IT service provider, information security is our business. We apply the same security practices to our own data that we recommend to our clients:
- Multi-factor authentication (MFA) enforced on all staff accounts.
- Full-disk encryption on laptops and mobile devices.
- Endpoint detection and response (EDR) across all our systems.
- Regular patching and vulnerability management.
- Least-privilege access controls and regular access reviews.
- Encrypted backups, tested regularly.
- Staff security awareness training.
No system is completely secure — if we ever become aware of a breach affecting your data, we'll notify you and the ICO where required, within the statutory timeframes.
9. Cookies
Our website uses a small number of cookies:
- Essential cookies — required for the site to function (for example, remembering your cookie preference).
- Analytics cookies — anonymised data about which pages are visited, so we can improve the site. No personal identifiers are stored.
You can control cookies through your browser settings. Blocking all cookies may affect how the site works.
10. Data processing on behalf of clients
When we provide managed IT services, we frequently access and process personal data held on our clients' systems — for example, user accounts, emails, or business applications. In these cases:
- We act as a data processor, and the client is the data controller.
- Our processing is governed by a Data Processing Agreement (DPA) signed with each client.
- We only process that data to deliver the agreed services, or as instructed by the client.
- Our staff are bound by confidentiality obligations.
- We implement appropriate technical and organisational security measures, in line with Article 32 of UK GDPR.
If you have questions about data held on a client's systems, please contact the client directly — they are the data controller.
11. Changes to this policy
We may update this policy occasionally. The "Last updated" date at the top of this page tells you when. Significant changes will be communicated to active clients by email.
12. Contact us
If you have any questions about this policy or how we handle your data, contact us: