Privacy Policy

Beyond Your Cloud is committed to protecting the privacy and personal data of all individuals who interact with our business. This Privacy Policy sets out how we collect, use, store, and protect personal data in connection with our website and consultancy services.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. By using our website or engaging our services, you acknowledge that your personal data will be handled as described in this policy.

If you have any questions about how we handle your data, please contact us using the details provided in Section 14 of this policy.

The data controller responsible for your personal data is:

As data controller, Beyond Your Cloud determines the purposes and means of processing personal data collected through our website and in the course of providing consultancy services.

We may collect and process the following categories of personal data:

• Contact and identity information: name, job title, company name, email address, and telephone number provided through our contact form or direct email communications.
• Enquiry and project information: details of your IT environment, business requirements, and project scope shared voluntarily during the enquiry or engagement process.
• Communication records: correspondence exchanged by email, telephone, or through our website contact form.
• Website usage data: anonymised or pseudonymised data collected through analytics tools, including pages visited, time on site, and referral source. This data does not directly identify you unless combined with other information.
• Business contact details: professional contact information obtained through networking, referrals, or publicly available sources in the context of a legitimate business relationship.

We do not collect special category data (such as health, biometric, or political data) and do not process personal data relating to children.

We collect personal data through the following means:

• Direct submission: when you complete and submit our website contact form.
• Email and telephone: when you contact us directly to discuss a project or enquiry.
• Client engagement: when you share information as part of an active consultancy engagement, including scoping documents, system inventories, or project briefs.
• Analytics tools: automatically, when you visit our website, through cookies and similar tracking technologies (see Section 12).
• Third-party sources: from referrals, professional networks, or publicly available business directories, where there is a clear legitimate interest in making contact.

We rely on the following lawful bases under UK GDPR to process your personal data:

• Legitimate interests (Article 6(1)(f)): to respond to business enquiries, maintain professional relationships, and operate our consultancy business. We have assessed that our legitimate interests are not overridden by your rights and freedoms.
• Contract performance (Article 6(1)(b)): to fulfil our obligations under a consultancy agreement or to take steps at your request prior to entering into a contract.
• Consent (Article 6(1)(a)): where you have explicitly consented to receive communications from us, such as subscribing to our blog or newsletter. You may withdraw consent at any time.
• Legal obligation (Article 6(1)(c)): where we are required to process data to comply with applicable law, including tax and financial record-keeping obligations.

We use personal data for the following purposes:

• Responding to enquiries submitted through our website or by email.
• Providing IT architecture, workplace technology, and commercial optimisation consultancy services.
• Managing and maintaining our client and prospect relationships.
• Sending relevant technical insights, blog updates, or service information where you have subscribed or where we have a legitimate interest in doing so.
• Fulfilling contractual obligations and managing project delivery.
• Complying with legal and regulatory requirements, including financial record-keeping.
• Improving our website and understanding how visitors use our services.

We will not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

Beyond Your Cloud does not sell, rent, or trade personal data. We may share data in the following limited circumstances:

• Trusted contractors and sub-consultants: where necessary to deliver a recommended project or service, we may share relevant information with vetted third-party specialists. Such parties are bound by appropriate confidentiality and data processing obligations.
• Technology service providers: we use third-party platforms to operate our website and manage communications (including GoDaddy's infrastructure). These providers act as data processors under contractual terms consistent with UK GDPR.
• Legal and regulatory authorities: where we are required to disclose information by law, court order, or regulatory obligation.

Any third party with whom we share data is required to handle it securely and in accordance with applicable data protection law.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Our general retention periods are as follows:

• Enquiry and contact form data: retained for up to 12 months from the date of last contact, unless an engagement commences.
• Client project data: retained for up to 7 years following the conclusion of an engagement, in line with standard business and tax record-keeping requirements.
• Financial and contractual records: retained for 7 years in accordance with HMRC requirements.
• Marketing and newsletter subscriptions: retained until you unsubscribe or withdraw consent.
• Website analytics data: retained in anonymised or aggregated form in accordance with the terms of the analytics platform used.

When data is no longer required, it is securely deleted or anonymised.

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, or disclosure. These measures include:

• Use of cloud-based platforms with enterprise-grade security controls, including encryption at rest and in transit.
• Secure email communications and restricted access to personal data on a need-to-know basis.
• Regular review of our data handling practices and access controls.
• Use of strong authentication practices for systems that hold personal data.

While we take all reasonable steps to protect your data, no method of electronic transmission or storage is completely secure. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) and affected individuals as required by law.

Beyond Your Cloud is based in the United Kingdom and primarily processes personal data within the UK. Where we use third-party service providers (such as cloud infrastructure or communication platforms) that may process data outside the UK, we ensure that appropriate safeguards are in place, including:

• Transfers to countries with an adequacy decision from the UK Secretary of State.
• Use of UK International Data Transfer Agreements (IDTAs) or equivalent contractual protections where required.

We do not knowingly transfer personal data to countries without adequate protections in place.

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access: to request a copy of the personal data we hold about you.
• Right to rectification: to request correction of inaccurate or incomplete data.
• Right to erasure: to request deletion of your personal data where there is no longer a lawful basis for processing it.
• Right to restriction: to request that we limit how we use your data in certain circumstances.
• Right to object: to object to processing based on legitimate interests or for direct marketing purposes.
• Right to data portability: to receive your data in a structured, commonly used, machine-readable format where processing is based on consent or contract.
• Right to withdraw consent: where processing is based on consent, to withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us using the details in Section 14. We will respond to all valid requests within one calendar month. In complex cases, we may extend this period by a further two months and will notify you accordingly.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data has been processed unlawfully. The ICO can be contacted at ico.org.uk or by telephone on 0303 123 1113.

Our website may use cookies and similar tracking technologies to improve your browsing experience and understand how visitors use the site. Cookies are small text files stored on your device.

We may use the following types of cookies:

• Strictly necessary cookies: required for the website to function correctly. These cannot be disabled.
• Analytics cookies: used to collect anonymised information about how visitors use the site, such as pages visited and time spent. This helps us improve the website experience. Analytics data is only collected with your consent.

You can manage your cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of the website.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we provide. The most current version will always be available on this page, with the date of the last update shown at the top.

Where changes are material, we will take reasonable steps to notify affected individuals, such as by email where we hold your contact details.

We encourage you to review this policy periodically to stay informed about how we protect your data.