Privacy Notice

Northern IT looks after IT for businesses and home users in and around Bolton — from a single laptop repair to a server, mailboxes and backups. This page explains what we do with personal information, in plain English, and what you can ask us to do about it.

1. Who we are

Northern IT is the trading name of Northern Information Technology Consultancy Limited. We are the data controller for the information described on this page, which means we decide why and how it is used.

We are a small firm, so there is no separate data protection officer. Data protection is the responsibility of our Managing Director, Ritesh Mehta, who can be reached at the address above.

2. What we collect

If you are a customer

• Contact details — name, business name, job title, email, phone and postal address.
• Commercial details — what you have bought, quotes, invoices, payment status and contract dates. We do not store card numbers; card payments are handled by our payment provider.
• Support details — what went wrong, what we did about it, dates and times, who spoke to whom, and any screenshots or photographs you send us.
• Technical details — device names and serial numbers, software versions, licence keys, IP addresses, backup logs and the configuration of systems we manage.
• Access credentials — administrative passwords and remote-access details, held in an encrypted password manager and used only to deliver the service you have asked for. Remote access is taken with your permission and removed when the job is done.

If you are a home customer and bring a device in for repair, we may see files on it. We do not copy, read or keep them, except where a backup or a data transfer is part of the job — and any temporary copy is deleted when the device is collected.

If you are a business we have contacted

We hold only what is published: business name, address, phone number, business email, website, and a note of any publicly visible technical fact (for example, which company provides your email). We do not buy contact lists.

We do not set out to collect special category data such as health, ethnicity, religion, biometrics or criminal records. Where a client’s system contains such data — a dental practice’s patient records, for example — it is covered by section 3, not by this notice.

3. When we act for a client, we are a processor

If we manage your server, mailboxes, backups or software, then you are the controller of the personal data on those systems and we are your processor.

That means we act only on your written instructions, we do not use that data for our own purposes, we keep it secure, we tell you if something goes wrong, and we delete or return it when our agreement ends. Our data processing agreement is available on request.

4. Where the information comes from

• From you — when you call, email, use the contact form, open an account or bring a device in.
• From your systems — logs and alerts generated by equipment and software we manage for you.
• From public sources — for business-to-business contact, information published on your own website, in public business directories, and on the Companies House register. We record which source each entry came from.
• From referrals — where an existing customer recommends you.

We do not buy marketing lists and we do not use credit reference agencies for consumer customers.

5. Why we use it, and our lawful basis

Where we rely on legitimate interests we have weighed our interest against your rights. For support records, the interest is fixing a recurring fault and being able to show what was done. For business outreach, the interest is offering a relevant local service; the balancing factors are that we write to a business address, in small numbers, about something specific, with an opt-out we honour immediately.

6. Who we share it with

We do not sell personal data and we do not share it for advertising. We share it only where necessary, with:

• Suppliers whose products we resell or support — for example Microsoft, software vendors and hardware manufacturers, where a warranty claim or licence transfer needs it.
• Services that run our own business — email and cloud hosting, our backup platform, our accounts package, our accountant, our insurer and our payment provider.
• Professional advisers — a solicitor or insurer, if a claim or dispute makes it necessary.
• The police, a court or a regulator — where the law requires it, or to defend a legal claim.
• A buyer — if the business is ever sold, customer records may transfer with it. You would be told before that happened.

Every supplier that handles data for us is bound by a written contract requiring them to keep it secure and to act only on our instructions.

7. Data outside the UK

Our email and cloud services are provided by Microsoft, and some backup and accountancy platforms may store data outside the UK. Where that happens the transfer is covered by the UK’s adequacy regulations, the International Data Transfer Addendum, or the provider’s own approved safeguards. We check that a safeguard is in place before adopting a new supplier.

8. How long we keep it

At the end of a retention period the data is deleted or irreversibly anonymised.

9. How we keep it safe

• Access to client systems is through named accounts with multi-factor authentication. Shared administrator logins are not used.
• Passwords and credentials sit in an encrypted password manager, not in email or spreadsheets.
• Our own devices are encrypted, patched and backed up, and we test a restore rather than assuming the backup works.
• Remote access is granted per job, with the client’s permission, and removed afterwards.
• Staff and contractors see only the systems they need for a job.
• We keep a record of what changed on a client system and when, so a fault can be traced.

If a personal data breach occurs that is likely to put people’s rights at risk, we report it to the ICO within 72 hours of becoming aware of it and tell affected clients without undue delay.

10. Your rights

To use any of these, email info@nitc.co.uk or write to us at the address in section 1. We reply within one month and it is free.

If you are unhappy with how we have handled your data, please tell us first — we would rather fix it. You also have the right to complain to the Information Commissioner’s Office: ico.org.uk, 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

11. Marketing and business outreach

We contact local businesses about our services. This section explains exactly how, because it is the part most privacy notices leave out.

• Who we contact: business addresses only — a company, partnership or sole trader’s business email or business phone number.
• Where the details come from: your own website, public business directories and the Companies House register.
• What we hold: business name, address, phone, email, website, and any note of what we publicly observed. We do not hold personal information about individuals beyond a business contact name.
• Why: legitimate interests — offering a relevant local service to a business that may need it. We keep the volume low, we write about something specific, and we do not use automated sequences.
• How to stop it: reply to any email with “no thanks”, or email info@nitc.co.uk and ask to be removed. We remove you immediately and keep only a note that you asked not to be contacted, so we do not contact you again by mistake.
• Phone calls: we screen business numbers against the Corporate Telephone Preference Service before calling, and we do not call numbers registered there.

If you are a consumer and we send you offers, it is because you asked for them, and every message has an unsubscribe link.

12. Cookies

Our website uses the minimum needed to work: a session cookie to keep the site running, and, if you use the contact form, a cookie that stops repeated submissions. We do not use advertising or cross-site tracking cookies.

You can block cookies in your browser settings; the site will still work.

13. Changes to this notice

We review this notice at least once a year, and whenever we change a supplier or start a new service. If a change materially affects you, we will tell customers by email.

14. How to contact us

If we cannot resolve a concern, you can complain to the ICO using the details in section 10.

Back to top