We are responsible for and committed to protecting your privacy and complying with the UK General DataProtection Regulations (UK GDPR), Data Protection Act 2018, the Data (Use and Access) Act 2025 (DUAA 2025) and any subsequent laws or regulations applicable.
In this Privacy Notice, we want to inform you about what information we collect, how we use it and what rightsindividuals have in relation to the collection and processing of their personal data.
Supportkey Ltd
Studio 29, Sir James Clark Building, Abbey Mill Business Centre
Paisley PA1 1TJ
Email: info@supportkey.com
Tel: 0141 552 8505
If you have any questions in respect of this Privacy Notice or how we manage your personal data, please contact using the above details.
We process information about our clients, contractors, suppliers, professional advisors or individuals making anenquiry about our services.
We also process data on behalf of our clients as part of our services to them. This includes managing and monitoring I.T. Systems and usage and CCTV services. Where we do so, we act as a data processor onbehalf of our clients, and they are the data controller. We maintain data processor agreements with all clients to ensure that each party is committed to their obligations under the UK GDPR to protect your personal data.
When we work with you, we can collect the following types of data:
For our clients we also process the following personal data belonging to their customers or employees, ontheir behalf
We do not collect special categories of data; however we may have access to the following special categories of data in the course of delivering our services to our clients in respect of their customers oremployees:
Where we collect such special category information, we do so on behalf of our clients who have theappropriate consent or lawful basis.
In most cases we collect your data directly from you. We collect data and process it when you:
We also receive your data indirectly from the following sources:
Please Remember: Where you provide any of this information relating to or on behalf of another individual such as a nominated contact, you must remember to ensure that you have the consent of the individual and provide them with acopy of or access to this Privacy Notice.
Where we collect and process personal data, we are required to identify both the purpose and our legal basis for doing so. There are 6 possible legal bases which are:
Consent – where we have your consent for processing your personal data for one or more specific purpose
Contract – where the processing is necessary for the performance of a contract or potential contract with you.
Legal Obligation – The processing is necessary for our compliance with a legal obligation
Vital Interests – Where our processing is necessary in order to protect the vital interests of the data subjector another natural person
Public Interest – Where the processing is necessary for the performance of a task carried out in the publicinterest or in the exercise of official authority
Legitimate Interests – Where the processing is necessary for the purposes of our legitimate interests except where such interests are overridden by your interests or fundamental rights and freedoms.
Our various purposes and legal basis for the information we collect, are detailed below:
| Our Purpose | Our Lawful Basis |
| To understand your requirements prior to entering into a contract of service with our clients | The processing is necessary for theperformance of an anticipated Contract |
| To understand all requirements to ensure that any contract of service meets our client’s needs | The processing is necessary for theperformance of a Contract with you |
| To fulfil our contract with you and provide you withthe agreed services therein | The processing is necessary for theperformanceof our Contract with you |
| To manage our business operations and complywithany internal policies and procedures by understanding what needs to be changed | It is in our legitimate interests to use yourpersonal information to ensure that we can provide and adapt our services at all times |
| To notify you about changes to our service | It is in our Legitimate Interests to use yourpersonal information to keep you informed about any changes that may affect you |
| For Marketing of similar services to existing clients | It is in our legitimate interests to use your personal information for marketing purposes where the services being marketed are relevant toyou. |
| For electronic Marketing of services to new clients via personal business email addresses | It is in our Legitimate Interests to use personal business email addresses for marketingpurposeswhere we can support individual’s rights |
| For electronic Marketing of services to new clients | We rely on Consent for direct marketing toindividuals we have not worked with previously |
| To control access to sites and premises and ensurethe security of the buildings, property and safety ofourcontractors, employees and visitors by utilisingCCTV. | It is in our Legitimate Interests to protect the security of sites and premises and the safety ofour contractors, employees and visitors |
| To prevent, deter and if necessary, investigateunauthorised access, including unauthorised access to secure sites and premises and protected areas. | It is in our Legitimate Interests to prevent,deterand investigate any unauthorised access to site premises or information |
| To prevent, detect and investigate a theft of materials, equipment or assets owned by the company, contractors, visitors or employees or threats to thesafety of such individuals. | It is in our Legitimate Interests to prevent, detect and investigate theft of property belonging to our business, our employees orour visitors. |
| To comply with our legal obligations, lawenforcement, court and regulatory bodies requirements | To comply with our Legal Obligations |
| To identify and prevent fraud | It is in our Legitimate Interests to act as aresponsible business |
| To decide whether to initiate a contract ofemployment | The processing is necessary when consideringanemployment Contract |
| To carry out background and reference checks inrelation to recruitment | The processing is necessary when consideringanemployment Contract |
| To communicate with you about a potentialcontract(for service or employment) | The processing is necessary for theperformanceand compliance with any Contract ofemployment |
Where we rely on your consent you have the right to withdraw this consent at any time by contacting us.
Legitimate Interests – Where the processing of personal data is based on our Legitimate Interests, it is todeliver and improve on our service and security and maintain accurate records. It is also in an aim to prevent fraudor illegal activity in favour of the wellbeing of our customers, shareholders and employees.
We may send you details of similar services to those you have enquired about or purchased from us previously.You can opt out of receiving this information from us at any time by contacting us at the above address or clicking ‘unsubscribe’ on any messages you may receive.
We will never share or sell your information to any other party for marketing purposes.
From time to time and in the general course of our business, we may share your personal information withsome of the following:
Although we don’t transfer your information outside of the UK, with today’s modern technology including Cloud Storage and software, some recipients of your personal data can be located outside your country or have offices in countries where data protection laws may provide a different level of protection than the laws in your country.
Where data is transferred outside the UK, we ensure compliance by applying the statutory ‘Data Protection Test’under Article 44A of the UK GDPR to confirm protection is not materially lower than UK standards, using the UK International Data Transfer Agreement (IDTA) or UK Addendum where required.
We do not process personal data for automated decision making or profiling
We will retain personal data in accordance with legal and regulatory requirements and for no longer than is necessaryto fulfil the purposes set out in this privacy policy. We maintain and review a detailed retention policy which documentshow long we will hold different types of data. The time period will depend on the purpose for which we collected the
information and is never on an indefinite basis. Subsequently, we will delete your personal data in accordance withour data retention and deletion policy or take steps to properly render the data anonymous, unless we are legally obliged to keep your personal data longer (eg. for tax, accounting or auditing purposes)
The following details the criteria used to establish the retention period set out within our policy.
This includes the duration of any contract for services we have with you and for a period of 5 Years after the end ofany contract with a view to maintaining and improving the performance of our products, keeping our systems secure,and maintaining appropriate business and financial records. Most of our retention periods are determined with regard to this general rule.
Corresponding storage obligations may arise, for example, from laws or regulation. It may also be necessary to store personal data regarding pending or future legal disputes. Personal data contained in contracts, notifications andbusiness letters may be subject to statutory storage obligations depending on national law.
We will retain personal data in accordance with legal and regulatory requirements and for no longer than isnecessary. We maintain and review a detailed retention policy which documents how long we will hold different typesof data. The time period will depend on the purpose for which we collected the information. This is generally 5 yearsfor most types of data unless we have a legal obligation to retain it for longer and regardless it is never held onan indefinite basis.
As a data subject, you have rights in relation to your personal data. These are:
Access – You have the right to request details of personal information held or processed and to copies of thisdata. We do not usually charge for this service.
Rectification – You have the right to request that any information be corrected that you believe is inaccurate or to complete any information that you believe is incomplete.
Erasure – You have the right to request that we erase your personal information with some exceptions.
Restrict Processing – You have the right to request that we restrict the processing of your personal data under certain circumstances
Object to Processing – You have the right to object to our processing of your data, under certain conditions.
Data Portability – In some circumstances, you have the right to request that we transfer the data that we havecollected to another organisation or directly to you.
You also always have the Right to Withdraw Consent where you have previously provided this.
In accordance with Section 164A of the Data Protection Act 2018 (as inserted by the Data (Use and Access) Act 2025), individuals are generally expected to exhaust our internal complaints procedure before escalating any matter to the supervisory authority.
You can submit your data protection complaint to our Data Protection Lead through any of the following channels:
We will formally acknowledge receipt of your complaint within 30 calendar days of receiving it. We will independentlyinvestigate your concerns without undue delay, ensuring you receive timely updates regarding our progress. Onceour enquiries are concluded, we will issue a formal final response explaining our findings and any corrective actions taken.
If you remain unsatisfied with our final decision or the way your complaint was handled, you have the right to escalate your complaint directly to the Information Commissioner (IC). The IC can be contacted via their official website(www.ico.org.uk), by telephone on 0303 123 1113, or by writing to: Information Commissioner, Wycliffe House, WaterLane, Wilmslow, Cheshire, SK9 5AF.
In some circumstances, the provision of personal data is partly required by law (for example, tax regulations,employment and legal obligations) or can also result from contractual provisions. This means that sometimes we cannot complete our agreed service without that information and so if you aren’t able to provide it or ask that wedelete it, there is a possible consequence that our contract would need to be cancelled.
Our Website uses only one security cookie. This is strictly necessary and so is enabled automatically. We do not useother cookies on our site, however we do review this regularly and update this detail.
What are cookies?
Cookies are small text files which are stored on your browser when you visit a website. They can often serve crucial functions and help to keep a website secure which helps to provide you with a better experience. They can also to analyse how awebsite performs, what works and where improvements can be made.
Different browsers provide different methods to block and delete cookies used by websites. You can do this by changingthe settings in your browser. To find our more, visit www.allaboutcookies.org
External Sites and Links: When you find us via other websites or platforms or when you are clicking on external links viaour own website, we have no control over those domains or their privacy settings. Please remember to review the privacy and cookie information on those sites and set your preferences accordingly.
We aim to protect your personal data through technical and organisational security measures to minimise risks associated with data loss, misuse, unauthorised access and unauthorised disclosure and alteration.
We store customer records in cloud-based services and data centres which have controlled and restrictedaccess. We operate records management and Information security policies which detail physical security, cloudstorage security monitoring, access control and password security measures. We also maintain and use anti-virus and malware software and firewalls.
Supportkey Ltd keep our Privacy Notice under regular review. This Privacy Notice was last updated on 14/07/2026.
