Introduction
At Purple Computing, we are committed to protecting the privacy of our clients. We handle all personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This Privacy Policy explains how we collect, use, store, and share personal data about our clients in the course of providing our IT support and consultancy services. We aim to be transparent and fair, using clear language so you understand how we safeguard your information.
Scope of this Policy
This Privacy Policy applies solely to Purple Computing’s clients (including individuals acting on behalf of client companies and prospective clients). It covers personal data we collect and process in relation to our client services. This policy does not apply to other groups such as our employees, contractors, job applicants, or suppliers – those are addressed in separate privacy notices. By using our services or website as a client, you acknowledge that you have read and understood this Policy.
Data Controller and Contact Details
Data Controller: The data controller for your personal data is Purple Computing Limited (registered in England and Wales, Company No. 07232399). If you have any questions about this Privacy Policy or our data practices, please contact our Data Protection Lead:
Craig Willott is responsible for overseeing compliance with data protection at Purple Computing. You can reach out to him (or the compliance team) at the email above for any enquiries or to exercise your data protection rights (explained below).
Personal Data We Collect
We only collect personal data that is relevant and necessary for us to provide our services to you. The types of personal data we collect and process about our clients include:
- Contact Information: Names, work email addresses, telephone numbers, job titles, and business addresses of client personnel. This is typically the information needed to communicate with you and perform our services (e.g. the name and contact details of your staff who liaise with us).
- Service and Support Data: Information you provide when engaging our IT support services. This includes details conveyed through support tickets, emails or phone calls – for example, descriptions of IT issues, login usernames or IDs, configuration details of your systems, or any screenshots and attachments you send. We may also collect credentials or access information you supply to enable us to support your IT systems (these are handled securely).
- IT Systems Documentation: We maintain documentation about our clients’ IT infrastructure in our secure IT documentation system (e.g. ITGlue). This may contain personal data such as lists of your staff members who have IT accounts, network user IDs, device assignments, or other information necessary to support and manage your IT environment.
- Communications: Copies of correspondence with you and records of our interactions. For example, if you email us or use our support portal, we will collect the content of those communications. Similarly, if you fill in a form on our website or provide feedback, we will keep that information.
- Call Recordings: If you call our support line or we conduct meetings via phone/VOIP, we may record those calls. Call recordings and voicemail messages may include personal data (such as your voice and any information you share during the call). These recordings are used for quality assurance, training, and record-keeping purposes (see “Call Recordings” and “Data Retention” sections below for more details on how long we keep these).
- Website Usage Data: When clients (or their users) visit our website or client portal, we collect limited information via cookies and similar technologies. This can include IP addresses, browser type, and browsing actions on our site. We use this data to ensure the website functions correctly, to remember your preferences, and to analyze usage for improvements. (See “Cookies and Tracking Technologies” for more details.)
- Analytics Information: If you have agreed to our use of analytics cookies, we may collect statistical data about how you and other users interact with our website (e.g. which pages are visited, time spent, etc.). This information is generally aggregated and not directly linked to you by name, but it may be considered personal data in some cases (e.g. IP addresses or unique IDs).
Note: In general, the personal data we collect is business-related (work contact details and information about your company’s IT systems). We do not usually need or seek any special category data (such as health, political, or religious information) from clients. Please try to avoid providing such sensitive data to us unless it is absolutely necessary for a specific service you’ve requested. If you do provide it, we will treat it with extra care.
How We Use Your Personal Data
Purple Computing will only use your personal data for legitimate purposes, and primarily to serve you as our client. Below is an overview of the purposes for which we process client personal data, along with the corresponding legal bases under the UK GDPR:
- Service Delivery and Administration: We use your information to perform our contract with you – for example, to set up and manage your account, provide IT support and consultancy services, and ensure your requests are handled effectively. This includes using contact details to communicate with you about support tickets or projects, and using technical information (like system details or login credentials you provide) to carry out troubleshooting, maintenance, and other IT services you’ve requested. (Legal basis: Performance of a contract)
- Support Desk and Communications: We process data contained in support tickets, emails, and calls in order to respond to your enquiries, resolve technical issues, and provide customer service. For instance, if you raise a helpdesk ticket, we will use the information in that ticket (which may include personal data) to investigate and fix the problem and then update you on the outcome. We also may use your name and contact details to inform you of important service information (such as downtime notices or security alerts relevant to you). (Legal basis: Performance of a contract; and in some cases our Legitimate Interests in providing efficient support)
- IT Systems Documentation and Management: We maintain documentation about your IT setup (using our secure documentation tools) to ensure continuity of service. This may involve processing personal data like staff names associated with user accounts or asset ownership. We use this data to fulfil our contractual obligations of managing and supporting your IT environment. Keeping detailed records allows us to resolve issues faster and manage changes or projects for you effectively. (Legal basis: Performance of a contract)
- Quality Assurance and Training: We may review certain interactions – such as call recordings or ticket histories – for quality control and staff training purposes. This helps us improve our customer service and ensure we continue to meet our high standards. For example, a recorded support call might be replayed during training to illustrate best practices or to identify areas for improvement. We limit access to such recordings and use them internally only. (Legal basis: Legitimate Interests in maintaining and improving service quality)
- Service Improvement and Analytics: We analyse how our clients use our services and website in order to improve our offerings and user experience. This might include aggregating data from support requests to spot common issues or using website analytics (with your consent) to understand user navigation patterns on our site. The insights gained help us optimise our services, develop new features, and better tailor our support. (Legal basis: Legitimate Interests in improving our services)
- Marketing and Client Updates: We may use your contact details to send you marketing communications and business updates relevant to our services. As an existing client, you may receive occasional newsletters, product/service announcements, event invitations, or tips and advice for IT best practices. We value your privacy – so we will only send you marketing messages that relate to the services we provide to you, and you can opt out at any time (see “Email Marketing” section below). For non-clients or in cases where law requires, we will obtain your consent before sending marketing emails. (Legal basis: Legitimate Interests – specifically the “soft opt-in” for existing customers under PECR – for clients; and Consent for any non-client marketing or where required by law)
- Billing and Business Administration: We will process personal data as needed for billing, invoicing, and account management. For example, we use your name and contact information on invoices and contracts, and we keep records of payments. We also maintain copies of contracts and communications as part of our business records. Some of this processing is necessary for us to comply with legal obligations (for instance, retaining transaction records for tax and accounting purposes) as well as to perform our contract with you (ensuring we get paid for our services and handle any billing queries). (Legal basis: Performance of a contract; Legal Obligation for financial record-keeping)
- Legal Compliance and Dispute Resolution: Finally, we may need to process and retain personal data to comply with our legal obligations or to protect our legal rights. For example, we could be required to disclose information under a court order or to law enforcement, or we might keep certain data to resolve disputes, enforce our contracts, or defend against legal claims. If we process your data for these reasons, it will typically be because we are under a legal obligation to do so, or because we have a legitimate interest in safeguarding our business (and such use is consistent with your rights). (Legal basis: Legal Obligation; or Legitimate Interests in establishing, exercising or defending legal claims)
We will not use your personal data for any purpose that is incompatible with the purposes outlined above without first obtaining your consent or unless required/permitted by law. We do not engage in any automated decision-making that produces legal or similarly significant effects on you (such as profiling for credit decisions, etc.) – so you will not be subject to decisions made solely by algorithms in our relationship (more on your rights regarding this in “Your Rights” below).
Third-Party Service Providers (Subprocessors)
To deliver our services efficiently, Purple Computing relies on a number of trusted third-party service providers (subprocessors) who assist in various aspects of our operations. We only share client personal data with these providers to the extent necessary for them to perform their functions, and always under appropriate contracts (Data Processing Agreements) that protect your information. Below is a list of the key subprocessors and tools we use, with a brief description of what they do:
- Zendesk Support: We use Zendesk (a customer support platform) to manage our helpdesk ticketing system and service desk communications. When you email our support address or submit a ticket, the details are logged in Zendesk. This may include your contact information and the content of your request. Zendesk helps us track, prioritize, and resolve support tickets efficiently. (Zendesk, Inc. – our Zendesk instance is hosted in data centers within the EU.)
- ITGlue: ITGlue is an IT documentation system in which we securely store information about your IT environment and any documentation you provide to us. This can include network configurations, hardware inventories, passwords or access credentials (encrypted), and other technical notes necessary to support your organisation. By centralising this data in ITGlue, our team can quickly retrieve accurate information when servicing your account. (ITGlue is provided by Kaseya; our data is stored in their EU-based cloud infrastructure.)
- Microsoft 365: We utilize Microsoft 365 (part of Microsoft Corporation’s cloud services) for our business email, calendaring, and office productivity. All email correspondence with you (including any personal data contained in those emails) will pass through Microsoft 365. We may also store your contact details in our Outlook contacts or address book. Additionally, documents or spreadsheets related to your account may be created and stored via Microsoft’s cloud (OneDrive/SharePoint). Microsoft 365 services that we use are configured to use servers located in the UK or European Economic Area, ensuring your data stays within those regions.
- 3CX Hosted VoIP (Gradwell): Our telephone system is powered by 3CX (a Voice-over-IP phone system) and hosted by Gradwell, a UK telecom provider. This service enables us to make and receive calls through a cloud-based PBX. If you call us on our support or office numbers, the call is routed through 3CX/Gradwell’s infrastructure. Basic call data (such as your phone number, the time and duration of the call) is logged on this system. We also record calls via 3CX as needed for quality and record-keeping (see “Call Recordings” below). All call data and recordings on 3CX/Gradwell are stored in the UK.
- OpenAI ChatGPT (API): We leverage OpenAI’s ChatGPT via its API to assist our service desk team in certain tasks. For instance, we may use it to help draft responses, summarise long texts (such as meeting notes or email threads), or transcribe audio from calls/meetings into text. When we use ChatGPT in this way, limited data might be sent to OpenAI’s systems – for example, the content of a support query or a snippet of a transcript that may include names or technical details, so that the AI can generate a useful summary or suggestion. We do not feed any sensitive or unnecessary personal data into ChatGPT, and we have configured the API usage such that OpenAI does not retain or use our prompts and data to train its models (per OpenAI’s data privacy options for API users). This tool helps us improve efficiency and accuracy in our support, but it is always used under human oversight. (OpenAI is a US-based company; we ensure any data shared via the API is protected under appropriate safeguards and only processed for our purposes.)
- Claude (Anthropic): We use Claude, an AI assistant provided by Anthropic, to help our team with tasks such as drafting documents, proposals and quotes, summarising long texts (for example meeting notes or email threads), and producing service-related documentation for you. To do this, we may input the necessary details about a request, project or service – which might include your company name, contact details, the requirements or technical scope, and pricing details – so that Claude can assist in producing a polished, consistent output. We input only the minimum information necessary, we do not feed in sensitive or unnecessary personal data, and we review all AI-generated content for accuracy under human oversight. We use Claude under Anthropic’s commercial terms, under which Anthropic does not use our inputs or outputs to train its models. (Anthropic is a US-based company; any personal data shared with the service is protected under appropriate safeguards and processed only for our purposes – see “International Data Transfers” below.)
- VeloxServ: VeloxServ is a UK-based connectivity provider that we use for the provision of broadband and related internet access services to our clients. To arrange, provision and support these connections, we may share limited personal and site data such as the client contact name, site/installation address, telephone number and order details. VeloxServ’s services and supporting data are based in the United Kingdom.
- Openreach: Openreach (part of the BT Group) operates much of the UK’s underlying broadband and fibre network. When we order, provision or fault-manage a broadband or fibre line on your behalf, relevant details such as the installation address, line/order references and a site contact name and number may be passed to Openreach to enable the work. Openreach operates within the United Kingdom.
- CityFibre: CityFibre is a UK full-fibre network operator. Where your service is delivered over the CityFibre network, we may share the installation address, order references and a site contact name and telephone number to provision and support the connection. CityFibre operates within the United Kingdom.
- Gigaclear: Gigaclear is a UK rural full-fibre broadband provider. Where your service runs over the Gigaclear network, we may share the installation address, order references and a site contact name and number to arrange and support provision. Gigaclear operates within the United Kingdom.
- FreedomFibre: FreedomFibre is a UK wholesale fibre network operator. Where your service is delivered over the FreedomFibre network, we may share the installation address, order references and a site contact name and telephone number to provision and support the connection. FreedomFibre operates within the United Kingdom.
- Onecom Partners: Onecom Partners is a UK telecommunications partner that we use for the provision of SIP and voice services. To set up and support your telephony, we may share details such as the account/business name, site address, contact name, telephone numbers and call routing requirements. Onecom Partners operates within the United Kingdom.
- Giacom: Giacom is a UK cloud and communications distributor through which we provision Microsoft licences, mobile and cellular connectivity for clients. To order and manage these services we may share details such as the business name, the user names and email addresses to which licences are assigned, mobile numbers, and order/billing references. Giacom operates within the United Kingdom.
- Nord Security: We use Nord Security’s tools to scan the dark web for client data (for example, to detect whether client email addresses or credentials have appeared in known data breaches or leaks). To perform this monitoring, identifiers such as client email addresses or domains may be processed. This service helps us alert clients to potential credential exposure so that protective action can be taken. Nord Security processes data within the European Economic Area; where any processing takes place outside the UK/EEA it is subject to appropriate safeguards (see “International Data Transfers” below).
- Xero: Xero is a cloud accounting platform that we use for the handling of accounts data and the storage of payment history, risk scoring and related financial administration. Personal data processed in Xero may include client and contact names, billing email addresses and telephone numbers, invoice and payment records, and associated financial information. Xero hosts data in secure cloud data centres; some of this processing may take place outside the UK/EEA under appropriate safeguards (see “International Data Transfers” below).
- Monday.com: We use monday.com as our CRM and operational platform for the storing of client contract data, client risk scoring, order handling and related account management. Personal data held in monday.com may include client and contact names, job titles, email addresses, telephone numbers, contract and order details, and internal notes about the account. monday.com hosts data in secure cloud infrastructure; some of this processing may take place outside the UK/EEA under appropriate safeguards (see “International Data Transfers” below).
- Ubiquiti Inc.: We use Ubiquiti’s management platform for the provisioning and support of customer networks (for example, managing routers, switches, access points and related network devices). To deliver this, network and device information and limited administrative contact details may be processed through Ubiquiti’s systems. Ubiquiti Inc. is a US-based company; any personal data processed through its platform is protected under appropriate safeguards (see “International Data Transfers” below).
We have carefully chosen these subprocessors for their reliability and high standards of security. Each of these third parties processes data on our behalf only for the purposes listed above and not for their own marketing or other purposes. They are bound by contract to protect your data and must act only on Purple Computing’s instructions. We also ensure that all such providers either store data within the UK/EEA or provide adequate safeguards for data protection (see “International Data Transfers” below).
If in the future we introduce any new significant subprocessors that will handle client personal data, we will update this Privacy Policy accordingly (or otherwise inform you, as required).
Subcontractors
In addition to the software subprocessors listed above, Purple Computing engages a number of trusted subcontractors – specialist organisations that perform certain functions on our behalf as part of delivering services to you. Where a subcontractor needs access to client personal data to carry out its role, it does so only on our documented instructions and under a written agreement that includes confidentiality and data protection obligations equivalent to those in this Policy. We remain responsible to you for the work our subcontractors perform. Our current subcontractors are:
- Get Cadence Limited: Engaged as a subcontractor for account management and sales functions. In this role, Get Cadence may process client and contact names, job titles, email addresses, telephone numbers, account and contract details, and notes relating to the management of your account and any sales or renewal discussions.
- DISCLOSURE CYBERSECURITY Limited: Engaged as a subcontractor for support and project functions. In this role, DISCLOSURE CYBERSECURITY may process information necessary to deliver support and project work, which can include contact details of your staff, descriptions of IT issues, system and configuration details, and (where required and handled securely) access credentials.
- JGS Fire and Electrical Ltd: Engaged as a subcontractor for network installations and support. In this role, JGS may process site and installation details, including the installation address and an on-site contact name and telephone number, to plan and carry out cabling, network and related on-site work.
- TimeEtc: Engaged as a subcontractor for accounts and operations functions. In this role, TimeEtc may process information needed to support our administrative, accounts and operational activities, which can include client and contact names, email addresses, telephone numbers and billing or order-related details.
- DARKO-M ANALYTICS LTD: Engaged as a subcontractor for financial analytics and accounts functions. In this role, DARKO-M ANALYTICS may process financial and account-related information – such as client and contact names, invoice and payment records, and related financial data – to support reporting, analysis and accounts activities. Company details are available from Companies House (company no. 15216362).
All subcontractors are subject to our due diligence and contractual controls. They process client personal data only to the extent necessary for their function, only on our instructions, and they may not use it for their own purposes or engage further sub-contractors involving your data without our authorisation. If we appoint a new subcontractor that will handle client personal data, we will update this Policy (or otherwise inform you, as required).
Data Retention
We will not keep your personal data for longer than is necessary for the purposes for which we collect and use it. Retention periods are determined based on legal requirements and our business needs. Below is a summary of how long we typically retain different types of client data:
- Active Client Data: For current clients, we will retain your personal data throughout the duration of our relationship. This allows us to continuously provide you with services and maintain necessary records (support history, documentation, etc.).
- After Contract Ends: When you stop being a client (for example, if our contract terminates or you no longer use our services), we will review and securely archive or delete personal data that we no longer need. In general, we will retain relevant client records for up to six (6) years after the end of our relationship. This retention period is chosen because 6 years is the standard statutory limitation period for contractual claims in the UK – meaning we may need to keep records for that time in case of any legal disputes or contractual obligations that arise. Data that may be kept during this period can include contracts, invoices, important communications, and support records, especially if they might be needed to establish or defend legal claims. We may retain data for a shorter period if we determine it’s not needed that long, or longer only if a specific law requires it (for example, we are required to keep certain company financial records for 6-7 years for tax audit purposes).
- Call Recordings: Call recordings are retained for 12 months by default. This means any routine support call or meeting recording is typically deleted after one year. However, if a particular call recording is tied to a project or contains information that we need to keep as part of our contract documentation, we may store that recording for up to six (6) years (aligning with the duration of our contractual liability period). For instance, if in a call you provided approvals, specifications, or critical instructions for a project, we might retain that audio as evidence of the agreed details. These extended retentions are done to protect both you and us under contract law.
- Support Tickets and IT Documentation: Support ticket histories and IT documentation in our systems will generally follow the same rule – we keep them for as long as you are a client, and then archive or delete them after you leave, usually within the 6-year post-contract window. In practice, for efficiency, we may perform data clean-ups periodically. If you’d like us to delete specific records sooner (and we have no overriding legal need to keep them), you can request that.
- Marketing Records: If you have opted in to marketing communications, we will retain your contact details on our mailing list until you unsubscribe or otherwise inform us that you no longer wish to receive such emails. We also periodically clean our marketing lists and may remove contacts that consistently do not engage (e.g. email addresses that bounce or show no activity for an extended period, typically 12-24 months of inactivity). Records of consent (e.g. when and how you agreed to marketing) are kept as long as you’re on the list and for a short period after, to demonstrate compliance.
- Deletion and Anonymisation: Once the applicable retention period has elapsed, or if we determine that we no longer need certain personal data, we will securely erase it from our systems. In some cases, rather than complete deletion, we may anonymise the data (so that it can no longer be linked to you). For example, we might keep aggregate service usage statistics or anonymised notes for trend analysis, but without any identifiers attached to those records. Backups are also managed – if personal data is stored in our backups, we allow the backups to cycle out and get overwritten according to our backup retention schedule (no longer than 60-90 days for typical system backups). During the time that data remains in our backups, it remains protected and we will not restore or use it unless absolutely necessary for data recovery or required by law.
Please note that in certain circumstances, we may retain data for a longer period if required to do so by law (for example, if involved in litigation or responding to regulatory requirements) or if you request us to keep information. We always aim to ensure that personal data is not kept longer than necessary and that it’s safely handled throughout. If you have any specific questions about our data retention practices for particular types of records, feel free to contact us.
Cookies and Tracking Technologies
Our website uses cookies and similar tracking technologies to provide a smooth user experience and to help us understand how our site is used. Cookies are small text files placed on your device (computer, tablet, smartphone) when you visit a website. They serve a variety of functions, from enabling website features to remembering user preferences and collecting analytics data. In this section, we explain the categories of cookies we use, and how you can manage your cookie preferences.
Types of cookies by duration and source:
- Session Cookies: These are temporary cookies that remain on your device only for the duration of your browsing session on our site. A session cookie helps recognise you as you navigate between pages, so for example, the site doesn’t ask you to log in again on every page. Session cookies are deleted automatically when you close your browser.
- Persistent Cookies: These cookies remain on your device for a set period of time even after your browsing session ends (until they expire or you delete them). Persistent cookies are used to remember your preferences and actions across multiple visits to our site. For instance, a persistent cookie might remember your chosen language, or that you’ve already seen (and dismissed) our cookie consent banner so it doesn’t pop up every time. We set persistent cookies for various durations depending on their purpose (some last a few days, others several months or longer).
- First-Party Cookies: First-party cookies are those set by Purple Computing’s website (our own domain). They are typically used for core functionality of the site. For example, if our site has a client login portal, we might set a first-party cookie to keep you logged in during your session. Another first-party cookie might store your cookie consent preferences (so we remember which cookies you allowed). These cookies are under our direct control.
- Third-Party Cookies: Third-party cookies are set by external service providers integrated into our site. We use a few trusted third-party tools that may set their own cookies when you visit our site. Common examples include analytics services or embedded content providers. For instance, we may use Google Analytics to collect anonymous traffic data – Google will set cookies via our site to facilitate that. Similarly, if we embed a YouTube video on one of our pages, YouTube (Google) might set cookies to track video views. Third-party cookies are readable by those third-party domains, and we do not control their lifespan or content directly. However, we will only enable such cookies on your browser if you have given consent, except for those strictly necessary for site functionality.
Categories of cookies by purpose:
- Strictly Necessary Cookies (Technical): These cookies are essential for the operation of our website and services. They enable core functionality such as security, network management, and accessibility. Without these cookies, the site might not function properly. For example, authentication cookies that keep you logged into a secure area, or cookies that remember your selections in a form as you navigate, are strictly necessary. These cookies do not require consent under applicable law, as they are needed for the service you requested (e.g. navigating the site or using a feature). We only use necessary cookies by default.
- Functional Preferences Cookies: (If applicable) These cookies remember your preferences and settings to enhance your experience. For example, a cookie that remembers your preferred display settings, language selection, or other customisations. While not strictly “essential,” these improve usability. We may treat some of these as necessary (if without them the user experience is significantly degraded), but in general we will ask for consent if they are not strictly required.
- Analytical/Performance Cookies: These cookies help us understand how visitors use our website, so we can improve it. They collect information such as which pages are visited most often, how users navigate through the site, and if they encounter errors. We might use third-party analytics tools (like Google Analytics) for this purpose. The data collected is usually aggregated and anonymised – for example, we see overall visitor numbers, not your individual browsing behavior. We will only set analytical cookies if you have consented to them, as they are not strictly necessary for using the site. If you allow them, these cookies will track your usage during your session (and possibly across repeat visits, if persistent) so we can compile reports on website performance and usage trends.
- Advertising/Targeting Cookies: These cookies track your online activity to help deliver more relevant advertising or content to you. They can remember that you visited our site and share that information with third parties, such as advertising networks. Purple Computing does NOT currently use any advertising or targeting cookies on our website. We do not serve third-party ads on our site, and we do not use retargeting cookies at this time. If this ever changes (for example, if we decide to use re-marketing via Google or LinkedIn to show ads about our services to site visitors), we will update this policy and obtain your consent before enabling such cookies.
Cookie consent and control: When you first visit our website, you will see a cookie notice or banner requesting your consent for non-essential cookies. We do not set analytical or other non-essential cookies until you actively choose to allow them (for example, by clicking “Accept” or selecting your preferences). If you choose to decline cookies, you will still be able to use our site for most purposes, although some features (especially those that rely on remembering settings or embedded third-party content) may not function optimally.
We respect your choices and provide ways for you to manage cookies:
- You can update your cookie preferences on our site at any time (for instance, by using a “cookie settings” link or mechanism on the website, if available, to revisit the consent manager).
- Additionally, most web browsers allow you to control cookies through the browser settings. You can set your browser to refuse all or some cookies, or to prompt you before accepting a cookie. You can also delete cookies that have already been set. Please note that disabling all cookies (especially including essential ones) might impact the usability of our site. For guidance on how to adjust your browser settings for cookies, you can refer to your browser’s help documentation.
- If you have previously given consent and wish to withdraw it, you can do so at any time through the methods above. Withdrawal of consent will prevent new cookies from being set, but it does not automatically delete cookies that were already on your device. However, you can clear those via your browser settings.
For more detailed information about the specific cookies we use and their lifespans, please refer to our separate Cookie Policy or the cookie consent banner details (if provided on our site). And if you have any questions or concerns about our use of cookies, feel free to contact us.
Email Marketing
Marketing communications: Purple Computing may send out occasional marketing or informational emails to our clients to keep you informed about our services. This might include newsletters, announcements about new IT services or features, security alerts, invitations to events or webinars, or tips on best practices in IT management. We strive to ensure that any marketing content we send is relevant and useful to our clients’ professional interests.
Our basis for sending you marketing emails as an existing client is our legitimate interest in growing our business and keeping you up-to-date (this is often called the “soft opt-in” – because you have an existing relationship with us, we can lawfully send you marketing about similar services, as long as you haven’t opted out). We will not bombard you with emails, and you will always have control over whether to receive them.
Your choices: You have the absolute right to opt out of marketing emails from us at any time. We include an “Unsubscribe” link at the bottom of every marketing email we send. By clicking that link and confirming, you will be removed from our mailing list. You can also unsubscribe or change your preferences by contacting us directly (for example, email us at [email protected] and let us know you prefer not to receive marketing). There is no charge or hassle to opt out – we will honour your request promptly. Opting out of marketing emails will not affect any operational or service-related communications; we may still email or call you regarding active support issues, billing matters, or other non-marketing purposes as part of our contract.
No third-party marketing: Purple Computing will never sell or share your personal data with third-party companies for their own marketing purposes. If we ever consider a joint marketing event or promotion with a partner, we would only share your details with your prior consent. Generally, any marketing communication you receive from us will come directly from Purple Computing.
Prospective clients: If you are not yet a client but have signed up on our website to receive newsletters or updates, we will have collected your email based on consent (for example, you filled a form and agreed to receive news). In such cases, we rely on your consent to send you marketing emails. You have the same ability to withdraw that consent at any time by unsubscribing. If we don’t have an existing relationship with you, we won’t send you marketing unless you’ve opted in.
We respect your inbox and time. Our aim is to send only meaningful communications that provide value. If you choose to stay subscribed, we hope you find our updates beneficial. If not, you can opt out with no hard feelings, and we will refrain from contacting you for marketing purposes.
Third-Party Links and Embedded Content
Our website and some of our communications may contain links to third-party websites, as well as embedded content provided by third parties. Examples might include: an article on our site linking to an external resource, a YouTube or Vimeo video embedded on one of our pages, a Google Map showing our office location, or social media “share” buttons. We want to clarify how personal data works in these situations:
- External website links: If you follow a hyperlink from our website to any third-party website, please be aware that those external sites have their own privacy policies and data practices, which may differ from ours. We do not have control over and are not responsible for the content, security, or privacy practices of other companies’ websites. We provide these links solely for your convenience or reference. We encourage you to review the privacy policy of any website you visit after leaving our site, especially before providing them with any personal information.
- Embedded content and third-party features: When we include content from third parties on our site (such as videos, audio players, social media feeds, or code snippets), this embedded content can act similarly to if you visited the third-party’s own website. For example, if we embed a YouTube video, Google (YouTube) may collect data about your interaction (like recording that the video was played) and might set its own cookies on your device. Similarly, clicking a “Tweet” or “Share” button might let the social network you’ve chosen know that you visited our site. These third parties may collect your IP address, which page you are visiting on our site, and may set cookies or utilize other trackers. They do this under their own privacy terms. Purple Computing does not send them your personal details, but because your browser is fetching their content, they may automatically receive certain technical data.
- No endorsement or control: The presence of a third-party link or content on our site does not mean we endorse that third party’s products, services, or their privacy/security standards. We provide those links/content for informational or functional purposes, but we cannot be responsible for how those third parties handle personal data. If you have any concerns about an external link on our site, please let us know.
In summary: Whenever you leave Purple Computing’s website – whether by clicking an external link or interacting with embedded third-party content – any personal data you provide or that is collected is governed by that third party’s privacy policy. We advise you to exercise caution and look at the privacy statement applicable to each website or service in question. If you prefer not to have any data shared with third-party content providers via our site, you can choose not to click on those features, or use browser extensions that block such content. We strive to make it clear when you’re interacting with external content, but feel free to contact us if you have any questions.
Social Media Use
Purple Computing maintains a presence on various social media platforms to engage with clients and the community (for example, we may have official accounts on Facebook, LinkedIn, Twitter, etc.). If you interact with us on those platforms, it’s important to understand how your data might be used, both by us and the social media provider:
- Interaction on social platforms: If you choose to follow us, comment on our posts, send us direct messages, or otherwise engage via social media, we may receive personal information about you from your social media profile. This could include your name, username/handle, basic profile information (like your photo or the organization you list as your employer), and of course any information you voluntarily provide in your interactions with us. We will use any information obtained via social media in line with this Privacy Policy. For example, if you send us a customer support query via Twitter or LinkedIn, we might respond to you on that platform and then possibly log the query in our internal systems just as we would if you had emailed us.
- Social media as data controllers: Please note that any content you post on social media platforms (including comments about us or direct messages to us) is also subject to the privacy policy of the company providing that social network. We do not have control over how Facebook/Meta, LinkedIn/Microsoft, Twitter, or any other platform uses your data that they collect. For instance, if you reveal personal information in a comment or a public message, that information is on the platform and could be visible to others depending on your privacy settings. We recommend you review the privacy settings and policies of the social networks you use to make sure you’re comfortable with how they handle your data.
- Social media plugins on our site: Our website may include social media features or plugins, such as Facebook’s “Like” button, LinkedIn’s “Share” button, or Twitter’s “Tweet” button. These features may collect your IP address and certain information about the page you’re visiting on our site, and they may set a cookie to enable the feature to function properly. Social media plugins are hosted by the third party (e.g., the code comes from Facebook’s servers), so interactions with these plugins are governed by the privacy policy of that third-party company. If you are logged into your social media account while browsing our site, the plugin may link your visit to our site with your profile on that platform. For example, if you are logged into Facebook and you click the “Like” button on our site, Facebook will record that action.
- Use of information: Purple Computing will not use personal data collected from social media for any purpose other than engaging with you and the general public on those platforms, responding to queries, and improving our services/brand presence. We might analyse overall engagement metrics (like how many people clicked on our posts) but this is usually aggregate information provided by the platform. If we want to share a specific user’s comment or endorsement outside the platform (for example, as a testimonial), we would seek permission from that user first.
Remember that any information you voluntarily make public on social media (such as posting a recommendation or a problem) might be seen by others, and we cannot prevent further use of it by others once you’ve posted it. We will, however, treat private messages or information you deliberately share with us in a private manner as confidential, just as if you had emailed us.
If you have any questions about our social media presence or how we handle data obtained from social networks, you can contact us via the details provided in this policy.
Your Rights Under UK GDPR
As an individual (data subject) whose personal data we hold, you have a number of important rights under the UK GDPR. We respect and uphold these rights. Your key rights are:
- Right of Access: You have the right to request access to the personal data we hold about you and to obtain information about how we process it. This is commonly known as a “Subject Access Request.” Upon request, we will provide you with a copy of your personal data that we are processing, along with details on the purposes of processing, the categories of data, any recipients of the data, the retention period, and the safeguards in place if data has been transferred outside the UK. This enables you to be aware of and verify the lawfulness of our processing.
- Right to Rectification: You have the right to have inaccurate personal data corrected, and to have incomplete data completed (taking into account the purposes of processing). If you become aware that any information we hold about you is incorrect or outdated (for example, your contact details have changed), please let us know and we will rectify it promptly. We want to ensure that the data we have is accurate and up-to-date.
- Right to Erasure: This is sometimes called the “right to be forgotten.” You can request that we delete your personal data in certain circumstances – for example, if the data is no longer necessary for the purposes it was collected for, if you withdraw consent (and we have no other legal basis to keep processing the data), or if you object to processing and we have no overriding legitimate grounds to continue. Please note that this right is not absolute; sometimes we may have legal obligations or compelling legitimate grounds to retain data (for instance, we cannot delete information that is required to be kept for financial auditing, or we might retain minimal contact information on an opt-out list to ensure we don’t contact you again if that’s your wish). However, we will assess and respond to erasure requests on a case-by-case basis and inform you of the outcome.
- Right to Restrict Processing: You have the right to request that we limit the processing of your personal data in certain circumstances. This means we can store the data but temporarily not use or process it further until the issue is resolved. You might exercise this right if, for example, you contest the accuracy of the data (for the period while we are verifying or correcting it), or if you have objected to processing (and we’re determining whether our legitimate grounds override yours), or if processing is unlawful and you prefer restriction over erasure. When processing is restricted, we will make note of it and only process it with your consent or for specific reasons allowed by law (such as protecting legal rights). We will also inform you before lifting a restriction.
- Right to Data Portability: You have the right, in certain cases, to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, and to have that data transmitted to another data controller at your request. This typically applies to data processed by automated means under the legal basis of consent or performance of a contract. In practice, this right might apply if you provided us data directly (e.g. through an online form or uploaded files) and we process it by automated systems. If you request it, we will provide you with your data in a format like CSV, JSON or similar, or if technically feasible, we may directly transfer the data to another company per your instructions. Note that portability complements your access right, but it specifically focuses on moving data to other services in a usable format.
- Right to Object: You have the right to object to certain types of processing of your personal data when that processing is based on legitimate interests or public interest, and you feel it impacts your rights and freedoms. You also have an absolute right to object to the use of your personal data for direct marketing purposes at any time. This means, for example, if we were processing your data because we deemed it necessary for our legitimate interest, you can object and we must stop unless we have compelling legitimate grounds that override your interests or it’s needed for legal claims. In practice: you can object to our marketing emails (and we will immediately stop sending them – as noted in Email Marketing above). If you object to other processing (say, you object to us using an AI tool with your data, or keeping certain documentation), we will consider your objection and comply unless we have a strong justification not to (we will explain our decision in such case).
- Right to Withdraw Consent: In cases where we are processing your personal data based on your consent, you have the right to withdraw that consent at any time. If at any point you have given consent for a specific purpose (for instance, if you consented to receive our newsletter, or consented to non-essential cookies), you can change your mind and withdraw it. Withdrawing consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, but once consent is withdrawn, we will cease the related processing going forward. For example, if you withdraw consent for marketing emails, we will stop sending you those emails; if you withdraw consent for analytics cookies, we will stop collecting analytics data from your device. Withdrawal is as easy as the original consent – simply contact us or use the provided opt-out mechanisms, and we will take care of it.
- Right not to be subject to Automated Decision-Making (including profiling): You have the right to not be subject to a decision based solely on automated processing, including profiling, if that decision produces legal effects or similarly significant effects on you. In plain terms, this means you can expect that important decisions about you are made by humans, not just algorithms. Currently, Purple Computing does not carry out any fully automated decision-making or profiling on client data that would fall under this right. We do not, for example, algorithmically approve or reject services in a way that affects your rights. Any use of automated tools (such as AI assistance, or the risk scoring referred to above) in our processes is always with human review and intervention, and does not replace human judgment for any consequential decision. If that ever changes, we will ensure the proper safeguards are in place and inform you. In any case, you would have the right to request human intervention, to express your point of view, and to contest the decision.
These rights are provided free of charge and we are committed to facilitating the exercise of your rights. Some rights may be subject to certain conditions or legal exemptions – for example, if fulfilling your request would infringe on another person’s privacy rights or if you request deletion of data that we are legally required to keep, we may not be able to comply fully, but we will explain the reasoning to you in such cases.
Exercising Your Rights and Making Enquiries
How to make a request: If you wish to exercise any of your rights listed above, or if you have any questions or concerns about how we handle your personal data, you can contact us at any time. The best way is to email our Data Protection Lead at [email protected]. You may also write to us at the postal address provided in the Data Controller section of this policy, or call our office and ask for data protection/privacy assistance (we may still ask you to put the request in writing for clarity and record-keeping).
To help us process your request efficiently, please provide enough information for us to identify you and the information you are referring to. For example, if you are requesting access, specifying the context (e.g. “all support ticket data from the past year under my name”) can be helpful. We may need to verify your identity as a security measure – especially for access, deletion, or update requests – to ensure we don’t disclose or alter data to the wrong person. Verification might involve confirming some information we have on file or asking for proof of identity if appropriate.
Timeframe for response: We will respond to your valid request as soon as possible, generally within one month of receiving it. Under the UK GDPR, we are allowed to extend this timeframe by an additional two months if a request is particularly complex or if we have received a number of requests from you. Should an extension be necessary, we will inform you within the first month and explain the reasons for the delay. Rest assured, we take your rights seriously and will keep you updated on the progress.
In most cases, we will provide the information or action you request. If we cannot (for legitimate reasons under data protection law), we will give you a clear explanation. For example, if you request data erasure and we have to retain certain information for legal reasons, we will let you know what we cannot erase and why. If you request data that involves others’ personal data, we might redact those parts to protect others’ privacy.
We also note that, per law, we generally cannot charge a fee for handling your request. It’s free for you to exercise your rights. Only if a request is manifestly unfounded or excessive (particularly if repetitive) could we charge a reasonable fee or refuse to act, but it’s very unlikely we would resort to this, and we have never done so to date. Our goal is to be helpful and transparent.
Right to complain: If you are ever dissatisfied with our response or believe we are not processing your personal data lawfully, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO), which is the supervisory authority for data protection in the UK. You can contact the ICO at 0303 123 1113 or via their website (ico.org.uk) for more information on how to report a concern. We would, however, appreciate the chance to deal with your concerns first, so please do consider reaching out to us to see if we can resolve the issue before contacting the ICO. We are committed to resolving any privacy issues in a fair and prompt manner.
International Data Transfers
Purple Computing is a UK-based company and, wherever possible, we keep our clients’ personal data within the United Kingdom or the European Economic Area (EEA). The majority of our subprocessors and subcontractors store and process data in the UK/EEA, and we choose providers that can accommodate UK/EU data residency wherever practical.
However, some of the tools and providers we rely on are based outside the UK/EEA, or may process data outside these regions. For example, our CRM platform (monday.com), our accounting platform (Xero), our network management provider (Ubiquiti Inc.), and certain AI tools (such as OpenAI and Anthropic’s Claude) are based in, or may process data in, countries outside the UK/EEA. Where this is the case, your personal data may be transferred to and processed in a country that does not have the same data protection laws as the UK.
Whenever we transfer personal data outside the UK/EEA, we ensure that appropriate safeguards are in place as required by law. Depending on the provider and destination, this may include: relying on a UK “adequacy” decision (where the destination country is officially recognised as providing an adequate level of protection); using the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the European Commission’s Standard Contractual Clauses (SCCs); and applying additional technical and organisational measures (such as encryption and data minimisation) to protect your information. We also minimise the personal data shared with such providers to only what is necessary for the relevant service.
To summarise: while we prefer to keep data within the UK/EEA and do so for most processing, certain services necessarily involve transfers outside these regions. In all such cases we ensure your data receives a level of protection essentially equivalent to that guaranteed within the UK. If you would like more detail about where a specific category of your personal data is stored or transferred, or about the safeguards applied to a particular provider, please contact us and we will be happy to explain.
Data Security
We understand that the security of personal data is paramount. Purple Computing has implemented a range of technical and organisational security measures to protect the personal data we hold against unauthorised access, alteration, disclosure, or destruction. These measures include, but are not limited to:
- Access Controls: We restrict access to client data strictly to those employees, subcontractors and contractors who need it to perform their job duties. Access to our systems (such as ITGlue, Zendesk, etc.) is protected with strong passwords and, where available, multi-factor authentication. Permissions are set on a role-based, least-privilege principle, meaning staff only access the minimum data necessary.
- Encryption: We utilize encryption to protect data in transit and at rest. For example, our websites and portals use HTTPS (SSL/TLS) to encrypt data between your browser and our servers. Sensitive information (like passwords or credentials you share with us) is stored in encrypted form in our documentation vault. Laptop drives and portable devices used by our team are encrypted to prevent data exposure if lost or stolen.
- Network and System Security: Our internal networks and systems are firewall-protected and regularly updated with security patches. We employ anti-malware and intrusion detection measures to guard against cyber threats. We monitor for any suspicious activity and have procedures in place to respond to potential security incidents.
- Training and Policies: All Purple Computing staff are trained on data protection and information security practices. We have internal policies governing how to handle personal data, including requirements to use strong passwords, lock screens, avoid phishing, and report any potential security issues immediately. Team members understand the importance of client confidentiality and privacy.
- Vendor and Subcontractor Due Diligence: As noted, we use reputable third-party providers and subcontractors. We vet these parties for their security credentials (many have certifications like ISO 27001, SOC 2, or comply with GDPR themselves). We also ensure they commit to protecting data via our contracts.
- Regular Backups: We perform regular backups of critical data to ensure we can recover information in case of any data loss event. Backups are encrypted and stored securely. They are periodically tested for restorability.
- Secure Disposal: When we retire hardware or delete data, we do so securely. For example, old drives are wiped or physically destroyed, and digital records are permanently deleted or anonymised in a way that they cannot be restored.
Despite all these precautions, it’s important to understand that no method of transmitting or storing data is 100% secure. We cannot guarantee absolute security of information, especially in transit over the internet. However, we continuously evaluate and update our security measures to mitigate risks from new threats and to follow industry best practices.
Data Breach Procedures: In the unlikely event of a data breach (for example, a security incident where personal data may have been accessed by an unauthorised party), we have a response plan in place. We will promptly investigate the scope and cause of the breach. If the breach is likely to result in a risk to your rights and freedoms (e.g. could lead to financial loss, identity theft, confidentiality breach, etc.), we will notify the UK ICO within 72 hours of becoming aware, as required by law. If the risk to you is high, we will also inform you without undue delay in clear terms about what happened and what actions you may need to take to protect yourself. We will provide guidance and support as appropriate. Our goal is transparency and swift action to prevent or minimize any harm.
We appreciate your cooperation in keeping data safe as well. This includes practices like using strong passwords for any client portals we provide, not sharing your account access with unauthorised people, and alerting us if you suspect any security weaknesses or incidents. Together, we can ensure that your data remains secure.
Disclaimers and Other Notices
- No Sale of Personal Data: We want to reassure you that we do not sell personal data to third parties. Your information is used only for the purposes outlined in this Privacy Policy and shared only with service providers and subcontractors as described. We also do not share your data with third parties for them to advertise to you. Any information sharing is strictly to serve you as our client, under our instructions and control.
- Services for Businesses, Not Children: Our services and website are intended for use by businesses and adult representatives of those businesses. We do not target or offer services to minors (under 18 years of age). We do not knowingly collect personal data from children. If you are under 18, please do not provide any personal information to us. In the unlikely event that we receive personal data relating to a child (e.g., if an underage individual is an end-user of a client’s IT system we service), we will only process that data as necessary for the service and in line with applicable law (and we would expect the client, as the data controller in such a case, to have obtained any necessary permissions). If you believe we might have any information from or about a minor, please inform us so we can address it.
- Accuracy of Information: It is important that the personal data we hold about you is accurate and current. We kindly ask that you keep us informed if any of your personal data changes during the course of our relationship (for example, if you change jobs, or update your email address). We cannot be responsible for any issues that may arise from outdated information if you do not notify us of the changes. We will gladly update our records when you reach out.
- Changes to this Policy: This Privacy Policy may be updated from time to time (see below for more details on changes). We disclaim any obligation to individually notify every client of minor changes, so we encourage you to review this page periodically. However, if we make significant changes, we will take additional steps to inform you (such as sending an email notification or highlighting the update on our website). Your continued use of our services after any changes signifies acceptance of the updated terms.
- Third-Party Liability: As noted in earlier sections, we cannot accept responsibility or liability for the privacy practices of third-party websites, applications, or services that you may access through links we provide or through our services. Any use of such third-party sites is at your own risk. We encourage you to read their terms and privacy notices.
- No Contractual Rights: While this Privacy Policy provides detailed information on how we handle personal data, it is not a contract in itself. In certain cases, the terms of our contract with you (such as a Master Services Agreement or Data Processing Agreement) may also govern how we handle data, especially where we act as a data processor for you. We aim for consistency, and this Policy is intended to reflect our practices, but if there is ever a conflict, we will honour our legal obligations and contract terms. This Policy does not grant you rights beyond those provided by law, nor does it impose additional obligations on us beyond applicable law and our contracts.
- Questions and Support: We stand by our commitment to privacy. If anything in this Policy is unclear, or if you have questions about aspects of our service not covered here, please reach out to us. We view privacy as a partnership with our clients, and we are happy to explain or discuss any concerns you might have.
Updates to this Privacy Policy
We may revise or update this Privacy Policy from time to time to reflect changes in our services, feedback from clients, or updates in legal requirements. Whenever we make changes, we will update the “last updated” date at the bottom of the policy. Any changes will be effective when posted on this page (unless a later effective date is indicated). If we make any material changes – for example, if we begin processing data for new purposes that were not originally outlined, or if we change how we use cookies or engage new significant subprocessors or subcontractors – we will take steps to inform you. This could be in the form of an email to our clients, a notification on our website, or an in-application alert, as appropriate.
We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information. Your continued use of Purple Computing’s services or website after any modifications to this Policy will be deemed as acceptance of those changes, provided that any required consents under law are obtained (if, for instance, a change required fresh consent, we would seek that from you).
If we have an ongoing contract with you, and the changes are substantial, we may also reflect those in our contractual documentation or via an addendum if needed, to ensure transparency and compliance.
Contact Us
Your privacy is important to us, and we welcome any questions or concerns you might have about this Privacy Policy or our data practices. If you would like to contact us to inquire about this Policy, exercise your rights, or for any other privacy-related matter, please reach out using the following contact details:
We will do our best to assist you and address your concerns promptly and professionally. Thank you for taking the time to read our Client Privacy Policy. We value the trust you place in Purple Computing to handle your IT needs and your personal data, and we are committed to maintaining that trust through our actions.
Last Updated: June 2026
