This document discloses the data protection and privacy practices for Intsys UK Ltd.

Who are we?

We are Intsys UK Ltd., a provider of software, support, consultancy and cloud solutions, registered in England with number 3253820. We are the controller of personal data that we use for our own business purposes, including managing enquiries, customer and supplier relationships, bookings, billing and marketing. This means that we decide why and how that personal data is used.

Where we handle personal data in a client’s systems or backups solely on that client’s instructions, for example when providing software support or consultancy, we act as a processor and the client remains the controller. The categories of data depend on the client’s systems and may include information about its employees, customers and suppliers, including special-category information where this is present in the records supplied. This processing is governed by the applicable service and data-processing terms, rather than by a separate right for us to use the client’s data for our own purposes.

This policy refers to the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where applicable, the Privacy and Electronic Communications Regulations 2003 (PECR), as amended, including by the Data (Use and Access) Act 2025. Other applicable data protection laws, including the EU GDPR where it applies to our activities, may also be relevant.

You can contact Intsys UK Ltd. about your personal data or this policy at info@intsysuk.com or through our contact page.

Why do we have a privacy policy

We have developed this policy because we want you to feel confident about the privacy and security of your personal information. It describes how we collect, use and process your personal data, and how, in doing so, we comply with our legal obligations to you. Your privacy is important to us, and we are committed to protecting and safeguarding your data privacy rights.

Please read this privacy policy carefully. It explains how we use personal information; acknowledging it is separate from choosing to receive marketing or allowing optional cookies. Last updated: 21 October 2026.

Why do we need your data?

We need to know your basic personal data in order to provide you with on-going organisational and software updates as well as support services. We will not collect any personal data from you we do not need in order to provide and oversee our products/services to you.

What personal information do we collect about you, and when do we collect it?

Our primary goal in collecting personal information from you is to provide you with a smooth, efficient, and personalised experience while using our services. This allows us to provide services and features that most likely meet your needs, and to customise our service to make your experience easier and quicker.

What do we collect? We may ask you for information to enable us to provide a product or a service to you and we collect this information by telephone, written correspondence or via a website/email. We may collect and use some or all of the following types of personal information: names, email addresses, addresses, telephone numbers, preferences and usage of the services or products (including when used, who used by and how used). We may also ask you for other information that relates to the service you are using or ordering as for example, we may need your bank or credit card details to charge you for certain services.

Where do we collect it from? We may collect the personal information from:

A. Information you give us. This is information about you that you give us by filling in forms on our website or by corresponding with us by phone, e-mail or otherwise. It includes information you provide when you complete the “Contact us” form on our website, participate in seminar/webinars or other social media functions on our website, enter a competition, promotion or survey and/or when you report an issue with software or cloud services. The information you give us may include your name, address, e-mail address and phone number and company name.

B. Information we collect about you from your use of our website. With regard to each of your visits to our website we will automatically collect the following information:

technical information, including the Internet protocol (IP) address used to connect your computer to the Internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform;
information about your visit, including the full Uniform Resource Locators (URL), clickstream to, through and from our website (including date and time), products you viewed or searched for, page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page.

C. We use a web analytics tool to analyse site usage, how our users arrive at our site, what they do on the site, what browser they are using and on what operating system etc. However, this analytics data, collected via a JavaScript tag in the pages of our site, is not tied to personally identifiable information.

D. If you enter into any of our competitions or promotions, we may ask for information about you, which will be made clear at the time you enter. We will also inform you of the purposes for which the information you provide may be used.

E. We may ask you from time to time about what use you make of the services we provide, what other services you would like us to provide in the future, and for other information.

F. Information contained in Annual Maintenance Contracts or Support Agreements, as well as any form filled in to request products/services.

G. Information about your Support Queries entered directly in our Support Portal or via support@intsysuk.com.

H. While providing support or consultancy services on behalf of the client, we may have temporarily access to data backups containing personal information.

I. If you use Ask Intsys, we collect the messages you send, our replies, the requirements or support issue you describe, and any contact details you provide for a follow-up. For access to client support answers, we check your email identity and support eligibility against our Zendesk client directory and verify mailbox access using an emailed code. We also process session, verification and security information to protect the chat service.

Lawfulness of our Processing

The lawful basis we use depends on why we need the personal data and our relationship with you. The following bases apply when we act as a controller. Where we act as a processor for a client, the client is responsible for determining the lawful basis for its processing and we act on its documented instructions.

Contract: Article 6(1)(b)

Where you are personally a party to a contract with us, we use the personal data necessary to take steps you request before entering that contract and to perform it. This includes preparing requested quotations, arranging orders and bookings, providing the agreed software, support or consultancy services, and administering payment. Where our contract is with your employer or another organisation rather than with you personally, our use of your business contact details is generally based on the legitimate interests described below.

We rely on consent when you choose to subscribe to our newsletter and for other uses for which we specifically request your consent. Where consent is required for cookies or similar tracking technologies, it must be obtained for the relevant purpose; legitimate interests do not replace that requirement. You can withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

Legal obligation: Article 6(1)(c)

We use personal data where necessary to comply with applicable legal obligations, including keeping accounting and tax records, responding to valid statutory requests and meeting our data protection obligations. This basis applies to the information needed for the particular obligation, rather than to all information we hold about you.

Legitimate interests: Article 6(1)(f)

We use business contact details and relevant correspondence to answer enquiries, manage relationships with customer and supplier organisations, arrange and deliver services to those organisations, and maintain records of those dealings. Our interests are in communicating with the right people, delivering and supporting our services, managing our business and resolving queries or disputes. We also have legitimate interests in protecting our systems and preventing misuse or fraud.

We may rely on this basis only where the processing is necessary for those interests and they are not overridden by your interests, rights and freedoms. Our separate marketing section below describes our use of information for marketing.

What we do with your data

We work in our private cloud environment and store our business data there, including our ERP system, client and supplier records, and business files. This cloud is hosted by Cloudsis Ltd. at a data centre in London, United Kingdom. Cloudsis Ltd. is a separate legal entity within the same group as Intsys UK Ltd.; it is not a division of Intsys UK Ltd. Intsys UK Ltd. remains the controller of the personal data it holds for its own business purposes. Cloudsis provides hosting services and acts as a processor to the extent that it handles that data on our behalf and instructions.

Depending on how you interact with us, personal data may also be received and processed by the external website, communications and service providers described below. Those providers may hold copies of the information needed to deliver their services.

Depending on the service you use, recipients of personal data may include:

Cloudsis Ltd., for hosting our cloud working environment, business systems and data, including our ERP, client and supplier records, and business files, at a data centre in London, United Kingdom.
Mailchimp, for managing our prospects audience, newsletter subscriptions and email updates. Contacts added without a request for marketing updates are recorded as non-subscribed.
Resend, for sending website enquiry notifications and transactional emails such as booking confirmations, reminders, cancellation messages, requested download links, chat verification codes and chat support or enquiry messages.
Cloudflare, for website hosting, delivery, security and storage used by website services such as bookings, document requests, Ask Intsys conversations and our staff-only record of form submissions and contact details. Cloudflare Turnstile checks connections to Ask Intsys to help prevent automated misuse.
Google Analytics, for website usage analysis, and Lead Forensics, for identifying business-level website visits and providing business-visitor information. During a time-limited comparison, we may also use Snitcher for business-level visit identification, with your permission. These activities involve website visit information and technical identifiers, including IP addresses and browser/device information. The Cookie settings panel names the business-identification providers currently enabled.
Our email and IT service providers and relevant software suppliers, where their involvement is needed to communicate with you or fulfil a service or support request.
Professional advisers, regulators, public authorities and other recipients where disclosure is necessary to obtain professional advice, comply with a legal obligation or establish, exercise or defend legal claims.
Google, through the Gemini API, for processing sent chat messages and relevant conversation context to help generate replies and assess support questions.
Zendesk, for our support client directory, eligibility checks and support-ticket handling. Support requests sent by email enter our existing Zendesk support process. Microsoft 365 provides our business email and the shared calendar used for service bookings.

Where a provider processes personal data on our behalf, it must do so under applicable data-processing terms and instructions. Sharing is limited to the information needed for the relevant purpose. Being part of the same group does not give Cloudsis or another group company unrestricted permission to use personal data for its own purposes.

International transfers

Some external providers may process personal data outside the UK, including through overseas hosting, support or sub-processors. These arrangements are separate from our cloud working environment and business data hosted by Cloudsis Ltd. in London.

Any restricted transfer of personal data outside the UK must be covered by a valid mechanism under UK GDPR. This may be UK adequacy regulations covering the recipient and transfer, or appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission’s Standard Contractual Clauses, with the required assessment of the protection provided. A provider’s general statement that it is GDPR compliant is not, by itself, a transfer mechanism.

You can contact info@intsysuk.com for information about the countries and recipients relevant to your personal data and to request details or a copy of any applicable transfer safeguards.

B. Marketing

We retain a record of website form submissions, including contact details, the requested service or resource, and the update preference supplied with the form. Choosing email updates is optional on enquiry, download and booking forms. Newsletter subscriptions request email updates explicitly. Our staff can see these records and whether Mailchimp has confirmed audience membership. An existing Mailchimp unsubscribe or undeliverable status is preserved.

We use both explicit consent (32, 42, 43; Art.6(1)(a)) and Legitimate Interest (Rec.47, 48; Art.6(1)(f)), as methods for contacting businesses and individuals who we feel would benefit from our products and services, as specified under GDPR. In a situation where explicit consent is not available, we will carry out a Legitimate Interest Assessment to ensure that we balance the interests of our organisation against the individual’s interest.

We may use any data we hold to contact people we believe will have an interest in our solutions via email, phone and direct mail.

However, we absolutely respect an individual’s desire to remove their consent from our marketing activities or their personal data from our records entirely. If you feel we have misunderstood your consent or your potential interest and would like to exercise your rights, then please do not hesitate to contact us via http://www.intsysuk.com/contact-us

C. Software Backups

Software data backups may be needed to investigate a support issue or carry out a consultancy project. When we handle a backup on a client’s behalf, we act on the client’s documented instructions and use its contents for the agreed support or project purpose. The client remains responsible for the lawful basis for the personal data in that backup, including any special-category information. Access must be limited to those who need it for the work, and the data must be returned or deleted in accordance with the applicable data-processing terms and instructions when it is no longer required, unless the law requires retention.

D. Ask Intsys chat

Ask Intsys uses Google Gemini to help answer questions about our products and services and, for verified eligible clients, relevant support questions. Sent messages and relevant conversation context may be processed by Google alongside selected reference material. Our support service uses the issue described to search approved support knowledge. AI replies can be mistaken; you can contact our team for assistance.

The dedicated email-verification form, verification codes and answers collected during the chat’s contact-details steps are kept out of AI prompts. Information you include in an ordinary chat message may still be sent to Google, so please do not enter passwords, verification codes, payroll records or other confidential personal records into the conversation.

Authorised Intsys chat staff can review sent conversations and, when live handover is available, join the conversation. Staff can also see draft text as you type, before you send it; this is not limited to messages sent after a handover. Drafts are temporary, expire within six seconds without further updates, and are not saved in conversation records or sent to the AI provider.

If you ask us to follow up and complete the requested contact details, we send your enquiry, quotation or training requirements to info@intsysuk.com. Support requests are sent to support@intsysuk.com and may include your issue summary, diagnostic discussion, relevant advice and contact details. Where a transcript option is offered, only sent messages are eligible for inclusion. These emails use Resend and our normal email or Zendesk support systems. They create separate business records whose retention is distinct from the chat conversation.

Client support verification uses your email identity and the support-access status on your Zendesk record, followed by a one-time email code. A matching company email domain alone does not grant access. Verification is checked again during support use. You can use our usual contact and support routes without using the AI chat.

For how long does Intsys keep your personal information?

The time period for which we keep information varies according to what the information is used for. In some cases, there are legal requirements to keep data for a minimum period. Unless there is a specific legal requirement for us to keep the information, we will retain it for no longer than is necessary for the purposes for which the data was collected or for which it is to be further processed.

Our routine website retention review points are:

Enquiries: 24 months after the individual enquiry is resolved. Open enquiries remain available for follow-up and staff review.
Document requests and download history: 24 months from the request date. An unrelated later request does not extend an older record.
Completed or cancelled bookings: 24 months after the later of the appointment end or recorded cancellation, once email, calendar and support-ticket delivery work is settled. Older cancellations without a reliable date are held for review.
Duplicate email bodies in website delivery queues: 30 days after successful delivery or a final decision to skip sending. We retain the job reference, outcome, timestamps and available provider receipt with the booking to prevent duplicate sends. Unfinished or uncertain deliveries are protected until resolved.
Website contact directory: retained while related requests, bookings, subscription or necessary suppression records remain. Orphaned contacts without a separate marketing purpose are flagged for review and removal when no longer needed.

The website flags records reaching these review points; it does not automatically delete them. An authorised administrator checks whether each record is still needed and confirms any deletion. Records remain available pending that review. We review due records monthly and record a justification and next review date where continued retention is necessary. Anonymous totals may remain after deletion. Where a service issue, dispute, investigation or legal obligation requires longer retention, we record a reason, owner and review date. A review date does not automatically release a hold. We can remove information earlier where it is no longer needed or where an applicable erasure request requires this.

We retain active newsletter subscriptions and review continued need after 24 months without meaningful engagement. An email open alone is not reliable evidence of engagement. You can unsubscribe at any time; we keep the minimum consent and suppression information needed to respect your choice and demonstrate the basis for marketing.

Required accounting and contractual evidence is kept separately under its applicable requirements. For example, company accounting records normally need to be kept for six years from the end of the relevant financial year, with exceptions requiring longer. This is not a blanket six-year requirement for every website enquiry or chat.

Private operational exports and backups we create are reviewed for manual disposal after 30 days unless a documented incident or recovery need requires a hold. A restricted recovery journal of opaque record identifiers prevents deleted records being reintroduced from a backup; it is reviewed after 35 days and kept while a related backup is still held. Deletion audit history records the staff member, counts and outcomes without deleted messages; we review its continued need after one year. These reviews do not trigger automatic deletion.

Ask Intsys conversation records, including sent messages and contact details collected in that conversation, are flagged for staff retention review seven days after the conversation starts. They remain in the protected staff history until an authorised staff member decides they are no longer needed and explicitly confirms deletion. Closing or archiving a chat does not delete it. Visitor access lasts up to 24 hours; support-verification codes expire after ten minutes and verified support sessions after 30 minutes.

The seven-day chat review point does not apply to copies already sent to email, Zendesk or an AI provider. Google currently documents a separate 55-day retention period for Gemini prompts, context and outputs used for abuse monitoring. Our integration disables stored Gemini interaction objects, but this does not disable that separate processing. See Google’s Gemini abuse-monitoring information.

Requested document links expire after 24 hours. Expired access-token records are flagged for administrator review after a further seven days; keeping a record does not reactivate its link. The separate request and download history follows the 24-month period above. Short authentication and abuse-prevention lifetimes remain separate.

Removing a website record does not automatically remove a copy already transferred to Microsoft 365 email or calendars, Zendesk, Mailchimp, Lead Forensics or another provider. Those copies follow their service, business and legal retention requirements, including applicable holds and provider backup limits. Contact us about the copies relevant to your request.

What are your rights

If you believe the personal information we hold about you is inaccurate, you can ask us to correct it. You also have the rights described below, subject to the conditions and exemptions in applicable data protection law.

Complaints about your personal data

If you wish to complain about how we have handled your personal data, please email info@intsysuk.com. You can also raise a complaint through our contact page or by calling 020 8605 9700. Please explain your concern and how you would like us to contact you; you do not need to use a particular form or legal wording.

We will acknowledge your complaint within 30 days of receiving it, take appropriate steps to investigate it without undue delay, and keep you informed about its progress. We will tell you the outcome and any action we will take without undue delay.

You also have the right to complain to the ICO, the UK’s data protection regulator. You can find its complaints process and contact details at ico.org.uk/make-a-complaint, or call its helpline on 0303 123 1113.

How can you access, amend or take back the personal data that you have given to us?

Even if we already hold your personal data, you still have various rights in relation to it. To get in touch about these, please contact us at http://www.intsysuk.com/contact-us. We will seek to deal with your request without undue delay, and in any event in accordance with the requirements of any applicable laws. Please note that we may keep a record of your communications to help us resolve any issues which you raise.

Right to object: If we are using your data because we deem it necessary for our legitimate interests to do so, and you do not agree, you have the right to object. We will respond to your request within 30 days (although we may be allowed to extend this period in certain cases). Generally, we will only disagree with you if certain limited conditions apply.
Right to withdraw consent: Where we have obtained your consent to process your personal data for certain activities or consent to market to you, you may withdraw your consent at any time.
Right of access (Data Subject Access Requests or DSARs): You have the right to obtain confirmation of whether we process personal data about you, a copy of that personal data, and supplementary information about how we use it. This includes information about the purposes of processing, the categories of personal data, recipients, retention periods or criteria, and your rights. We may request information reasonably needed to verify your identity or, where permitted by law, clarify your request. We will provide the information required by law, subject to applicable exemptions and the rights of others, and explain any lawful refusal or restriction. Requests to correct or delete information are separate rights and can be made alongside an access request.
Right to erasure: In certain situations, you have the right to request us to delete your personal data. We will respond to your request within 30 days (although we may be allowed to extend this period in certain cases) and will only disagree with you if certain limited conditions apply. If we do agree to your request, we will delete your data but will generally assume that you would prefer us to keep a note of your name on our register of individuals who would prefer not to be contacted. If you would prefer us not to do this, you are free to say so.
Right of data portability: If you wish, you have the right to transfer your data from us to another data controller. We will help with this – either by directly transferring your data for you, or by providing you with a copy in a commonly used machine-readable format.
Right to lodge a complaint with a supervisory authority: You also have the right to lodge a complaint with your local supervisory authority.
If your interests or requirements change, you can unsubscribe from our marketing content by clicking the unsubscribe link in the email.
Right to restrict processing: You can ask us to restrict the use of your personal data in certain circumstances, including while we check its accuracy after you dispute it, while we assess an objection, where processing is unlawful but you prefer restriction to deletion, or where we no longer need the information but you need it for a legal claim. During a restriction, we may retain the information, but generally cannot otherwise use it unless you consent or another legal exception applies. We will inform you before lifting a restriction.

How can I find out what personal information Intsys holds about me?

If you want specific information please tell us and give us any relevant information to enable us to locate the information about you because this will speed up our reply.

You can make a formal request if you want to know what personal information Intsys holds about you. In this case, please put your request in writing and send it to us via /contact-us

Data breach notification

We use appropriate technical and organisational measures to protect personal data. If we become aware of a personal data breach, we will assess its likely impact and take appropriate steps to contain and address it.

Where a breach must be reported to the ICO, we will notify it without undue delay and, where feasible, within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you without undue delay, unless a legal exception applies. The 72-hour reporting period relates to notifying the regulator; it is not a general deadline for notifying individuals.

If a breach affects personal data we process on a client’s behalf, we will notify that client without undue delay so that it can meet its own responsibilities as controller.

Do we use cookies?

We use essential storage for functions such as staff sign-in and remembering your privacy choices. Staff sign-in uses a secure session cookie that expires after seven days. Your tracking preferences are stored in your browser for up to 180 days, after which we ask again. A browser used for staff administration is excluded from our optional website tracking.

Ask Intsys uses browser session storage to reconnect your conversation in the same tab, with server access expiring after 24 hours. Verified client support uses a secure cookie lasting up to 30 minutes. Chat staff sign-in uses a separate secure cookie lasting up to seven days. Cloudflare Turnstile loads when you open the chat to check the connection; it is separate from the optional analytics and business-identification choices.

Where enabled, Google Analytics measures website use and Lead Forensics identifies business-level visits. These are separate optional purposes. We load their tracking scripts only after you accept the corresponding purpose. You can reject both, choose them separately, or change your choices using Cookie settings in the website footer. Rejecting these options does not stop you sending an enquiry, requesting a document or booking a service.

If we enable Snitcher alongside Lead Forensics for a comparison trial, the panel will name both providers. A previous acceptance that named only Lead Forensics will not authorise Snitcher: we will ask for a fresh business-identification choice. A previous rejection remains in place. The comparison concerns companies visiting the site; a company match or a suggested company contact does not establish which individual visited. Turning tracking off prevents further collection through our site, but does not erase information already received by a provider.

During the Snitcher comparison, with your business-identification permission, Snitcher receives visit information such as your IP address, pages viewed, visit timing and browser/device identifiers. Its script can also read email address fields and use the domain part (the text after the @ sign) to help identify a company, including when a form is not submitted. This domain collection remains active with Snitcher’s optional form-tracking feature switched off. We do not configure Snitcher to identify individual visitors by name or full email address. You can decline or withdraw business visitor identification through Cookie settings.

Analytics events use page paths and fixed event labels, rather than the contents of your forms. We exclude staff areas, private download and sign-in links, and our development/preview website from optional tracking. Advertising personalisation and Google signals are disabled in this website integration.

Embedded YouTube videos connect to YouTube only when you choose to load a video. YouTube then processes information about the video request under its own privacy information. You can instead use the link to watch directly on YouTube.

Your browser also lets you clear stored information or block cookies. If browser storage is unavailable, your choices may not be remembered on your next visit.

Changes to this Privacy Policy

We may amend this Privacy Policy from time to time. Any amended Privacy Policy will be posted on our website T&C’s section and in our Support Portal. Each time you enter or use the website or Support Portal, you agree that the Privacy Policy current at that time shall apply to all information which we hold about you.