Who we are
Conquered IT LLP (trading as Conquered IT) is the controller of the personal data described in this policy, except where section 2 explains we act on a client’s behalf. We process personal data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).
Conquered IT LLP is a limited liability partnership registered in England and Wales under number OC438795. Our registered office is [registered office address]. We are registered with the Information Commissioner’s Office (ICO) under registration number ZB289915.
You can contact us about this policy or your personal data:
- By post: Conquered IT LLP, 9 Bridge Street, Buckingham, MK18 1EL
- By email: data.protection@conqueredit.co.uk
- By telephone: 01280 736262
We have not appointed a Data Protection Officer because we are not required to, but the contact details above reach the person responsible for data protection at Conquered IT.
Our role: controller or processor
We are the controller for personal data about our clients’ contacts, our website visitors, prospective clients and our suppliers. This policy explains how we handle that data.
When we manage IT systems for a client, we may have access to personal data held on those systems, such as mailboxes, files, user accounts and device information. For that data we act as a processor: we only process it on our client’s documented instructions, under a written data processing agreement. Our client is the controller, and their own privacy notice explains how they use it. If you are an employee or customer of one of our clients and have a question about that data, please contact the client first; we will help them respond.
Information we collect and where it comes from
We collect the following types of personal data:
- Identity and contact data: name, job title, employer, work email address, telephone number and postal address.
- Account and service data: details of the services you use, support tickets and the correspondence about them, and login details for our client portal.
- Financial data: billing address, company registration number and payment details. Card and Direct Debit payments are handled and stored by Xero; we do not store full card numbers.
- Technical data: IP address, browser type, device and operating system information and approximate location, collected when you visit our website or use our portal.
- Usage data: how you use our website, such as pages viewed, time spent and links clicked. See section 6 on cookies.
- Marketing preferences: whether you have asked to receive or stop receiving marketing from us.
We record telephone calls for quality, training and to keep an accurate record of the work carried out, and we will tell you at the start of a call that it is being recorded. We do not routinely record remote support sessions; if we need to record one, we will tell you before recording starts.
Most of this data comes directly from you. We may also receive it from your employer when they engage us, from public sources such as Companies House and your organisation’s website, and from credit reference agencies when we assess a new account.
We do not intentionally collect special category data (such as health information) or criminal offence data about you.
How we use your information and our lawful basis
We only use personal data where UK GDPR gives us a lawful basis. The table below sets out each purpose and the basis we rely on.
| Purpose | Lawful basis |
| Providing our IT services and support, and managing your account | Contract (or, where the contract is with your employer, our legitimate interest in delivering the services they have engaged us for) |
| Invoicing, taking payment and recovering debts | Contract; legitimate interests (recovering money owed) |
| Keeping accounting and tax records | Legal obligation |
| Assessing creditworthiness for new accounts | Legitimate interests (managing financial risk) |
| Responding to enquiries and quotes | Legitimate interests (responding to people who contact us); steps before entering a contract |
| Telling you about changes to our services, terms or this policy | Contract; legitimate interests |
| Asking for feedback and improving our services | Legitimate interests (improving our services) |
| Keeping our website, portal and systems secure and preventing fraud | Legitimate interests (security and fraud prevention) |
| Sending marketing about our services | Legitimate interests for business contacts; consent where the law requires it (see section 5) |
| Using non-essential cookies on our website | Consent (see section 6) |
| Complying with law enforcement or regulatory requests, and defending legal claims | Legal obligation; legitimate interests (protecting our legal rights) |
Where we rely on legitimate interests, we have weighed our interests against your rights and are satisfied they do not override them. You can ask us for more detail.
We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects.
Marketing
We may send business contacts information about our own services that we think will interest them. Where the law requires it, for example for sole traders and individual consumers, we will only send electronic marketing with your consent or where you have bought similar services from us and did not opt out.
You can stop marketing at any time, free of charge, by using the unsubscribe link in any email or by contacting us using the details in section 1. We will act on your request promptly. We do not sell your personal data or pass it to other organisations for their own marketing.
Cookies
Our website uses cookies and similar technologies. Strictly necessary cookies keep the site working and secure and do not need your consent. We only set other cookies, such as analytics or marketing cookies, with your consent or, where the law allows, with a clear option for you to opt out.
You can change your choices at any time using the cookie settings through your browser settings.
Who we share your information with
We share personal data only where needed for the purposes in section 4, and our suppliers may only use it on our instructions under a written contract.
| Recipient | Why | Examples [confirm] |
| IT, cloud and software providers | Hosting our email, files, ticketing and business systems | Microsoft (Microsoft 365), HaloPSA, HubSpot |
| Distributors and vendors | Ordering and provisioning licences and products for you | Pax8, Microsoft |
| Accounting and payment providers | Invoicing, payments and bookkeeping | Xero, HaloPSA |
| Professional advisers | Accounting, legal and insurance advice | Our accountants, solicitors and insurers |
| Regulators, law enforcement and courts | Where the law requires it or to protect our legal rights | HMRC, the ICO, the police |
| A buyer of our business | If we sell or transfer all or part of our business or assets, subject to confidentiality | Prospective buyer and its advisers |
International transfers
Some of our suppliers store or access personal data outside the UK, including in the European Economic Area and the United States. Where this happens, we make sure the data is protected by one of the following safeguards:
- the destination country is covered by UK adequacy regulations;
- for US recipients, the recipient is certified under the UK Extension to the EU-US Data Privacy Framework; or
- we have the ICO’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses in place.
You can contact us for more information about the safeguards for a particular transfer.
How we keep your information secure
We use technical and organisational measures appropriate to the risk, including encryption, multi-factor authentication, role-based access controls, endpoint protection, regular patching and staff training. We hold Cyber Essentials certification.
If a personal data breach is likely to result in a risk to your rights, we will report it to the ICO within 72 hours where required and tell you directly if the risk is high.
How long we keep your information
We keep personal data only as long as we need it for the purposes in section 4, then securely delete or anonymise it.
| Type of data | How long we keep it |
| Client contract and account records, support tickets | Duration of the contract plus 6 years |
| Invoices, payment and accounting records | 6 years from the end of the financial year they relate to |
| Enquiries that do not lead to a contract | 1 year from last contact |
| Marketing contact details | Until you opt out or 1 years without engagement; we keep a suppression record so we do not contact you again |
| Call recordings and any remote session recordings | 30 days unless needed for a dispute |
| Website analytics data | Up to 24 months |
We may keep data longer if it is needed for a dispute, legal claim or regulatory investigation.
Your rights
You have the following rights over your personal data, subject to some legal limits:
- Access: to receive a copy of the personal data we hold about you.
- Rectification: to have inaccurate or incomplete data corrected.
- Erasure: to ask us to delete your data in certain circumstances.
- Restriction: to ask us to limit how we use your data in certain circumstances.
- Objection: to object to processing based on legitimate interests, and an absolute right to object to direct marketing.
- Portability: to receive data you gave us in a structured, machine-readable format, or have it sent to another organisation, where processing is based on consent or contract.
- Withdraw consent: at any time, where we rely on consent. This does not affect processing already carried out.
To exercise any of these rights, contact us using the details in section 1. There is normally no fee. We will respond within one month, which may be extended by up to two further months for complex requests; we will tell you if so. We may need to verify your identity first.
If you ask us to erase or restrict data we need to provide a service, we will explain whether this affects our ability to continue providing it.
Complaints
If you are unhappy with how we have handled your personal data, you have the right to complain to us. Please email data.protection@conqueredit.co.uk, write to us or call us using the details in section 1. You do not need to use any particular form or wording.
We will acknowledge your complaint within 30 days, look into it without undue delay, keep you updated and tell you the outcome.
You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection, at ico.org.uk/make-a-complaint or on 0303 123 1113. We would appreciate the chance to resolve your concern first.
Other information
Third-party websites. Our website may link to other websites. We are not responsible for their privacy practices, so please read their privacy policies before giving them personal data.
Children. Our services are for businesses and are not aimed at children. We do not knowingly collect personal data from anyone under 18.
Changes to this policy. We review this policy regularly and will publish any changes on this page. Where changes are significant, we will tell our clients directly.
This policy was last updated October 2026.
