Privacy Policy

This Privacy Policy explains how LevelUp Networks Ltd (“LevelUp Networks”, “we”, “us”, “our”) collects, uses, shares and protects personal data. It covers personal data we handle as a controller for our own business, and explains how we handle personal data on behalf of our clients when we act as a processor. It reflects the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), the Data (Use and Access) Act 2025 where in force, and current ICO guidance, and is supported by our ISO/IEC 27001-certified Information Security Management System (ISMS).

1. Who we are

LevelUp Networks Ltd is a company registered in England and Wales (company number 07066181), with its registered office at 30b Wilds Rents, London, SE1 4QG, United Kingdom.

If you have any questions about this policy or how we handle your personal data, please contact us at [email protected], call 0203 695 7554, or write to us at the address above, marked for the attention of the Data Protection Lead.

2. Our role: controller and processor

• As a controller, we decide how and why personal data is used. This applies to our website visitors, enquiries, prospective and existing client contacts, suppliers, job applicants and marketing contacts.
• As a processor, we process personal data held within our clients’ systems only on their documented instructions, when providing managed IT, support, monitoring, security, backup, cloud and related services. In that case our client is the controller, and our client’s own privacy notice applies. Our obligations as a processor are set out in our contract with each client, in line with Article 28 of the UK GDPR.

3. The personal data we collect

Depending on how you interact with us, we may collect:

• Identity and contact details: name, job title, organisation, email address, telephone number and postal address.
• Enquiry and correspondence data: information you provide through our contact form, by email, telephone or in meetings.
• Client account and service data: authorised contact lists, support tickets, call records, service desk communications, account and authentication details for our portals, and billing information.
• Technical and security data: logs, audit records, access metadata, device information and remote-support session records generated when we provide our services.
• Website data: IP address, browser type, pages visited and similar information collected through cookies and similar technologies, subject to your cookie choices.
• Marketing preferences: your preferences about receiving updates, news and event invitations from us.
• Recruitment data: CVs, employment history, qualifications and references if you apply to work with us.

We do not intentionally collect special category data about you. If such data is held within a client’s systems, we process it only as a processor and in line with our client’s instructions.

4. How we collect personal data

• Directly from you, for example when you complete our contact form, email or call us, sign a proposal, or raise a support request.
• From your employer or organisation, where it is our client and nominates you as an authorised contact or user.
• Automatically, when you use our website or when our monitoring, security and remote-support tools operate on systems we manage.
• From publicly available sources such as Companies House and professional networking sites, for business-to-business purposes.

5. How we use personal data and our lawful bases

Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms. You can ask us for more information about this assessment.

6. Use of AI and automation

We may use automation and AI tools to help deliver our services, for example for ticket classification, alert enrichment, reporting and documentation. These tools are used under human oversight, within our security controls and confidentiality obligations. We do not use client data to train general-purpose AI models available to unrelated third parties, and we do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.

Website chat assistant

The chat on our website is an AI assistant that answers sales enquiries. It runs on our AI platform supplier, Hatz AI, which processes the messages you type in order to generate replies. If you choose to share your name, company, email address or phone number, we use them to respond to your enquiry or arrange a call, and a copy of the conversation is emailed to our team. Please do not share passwords or other sensitive information in the chat. Our website keeps an active conversation for up to three hours so the assistant can follow it; enquiry emails are kept as described in section 10. Existing clients needing support should contact our helpdesk rather than use the chat. To protect the chat from automated abuse we use Cloudflare Turnstile, which checks that messages come from a real person and may process technical information about your device and browser to do so. See Cloudflare’s Turnstile Privacy Addendum.

7. Who we share personal data with

We never sell personal data. We share it only where necessary with:

• Service providers and sub-processors who help us deliver our services, such as cloud hosting, remote monitoring and management, security, backup, service desk, communications, accounting and payment providers.
• Technology vendors and suppliers where needed to resolve an issue or provide a licence or service you have requested.
• Professional advisers such as lawyers, accountants, auditors, certification bodies and insurers.
• Regulators, law enforcement and courts where required by law.
• A buyer or successor in the event of a merger, acquisition or reorganisation, subject to appropriate confidentiality protections.

All sub-processors are assessed under our ISO/IEC 27001 supplier-management controls and are bound by written data-protection obligations. A current sub-processor register is available on request.

8. International access and transfers

Personal data we control, and client data we process, is hosted on UK or EU-based systems wherever possible. Some of our authorised support personnel may access systems remotely from the European Economic Area, South Africa and Serbia, strictly for support and maintenance purposes. Some service providers may also process data outside the UK.

Where personal data is accessed or transferred outside the UK, we make sure it is protected by an appropriate safeguard, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with supporting technical controls, including:

• named, individually authorised user accounts;
• mandatory multi-factor authentication;
• encrypted connections for all remote sessions;
• no routine local storage or bulk transfer of data;
• logging and monitoring of access activity; and
• contractual confidentiality and data-protection obligations.

9. How we protect personal data

We hold ISO/IEC 27001 certification for information security, ISO 9001 certification for quality management, and Cyber Essentials certification. Our technical and organisational measures, in line with Article 32 of the UK GDPR, include:

• role-based access control and least-privilege principles;
• multi-factor authentication on our systems and tools;
• encryption of data in transit and, where appropriate, at rest;
• centralised logging, endpoint protection and security monitoring;
• vulnerability and patch management;
• staff confidentiality agreements, vetting and regular security awareness training;
• documented incident response and business continuity procedures; and
• regular internal and independent external audits.

If a personal data breach occurs, we will act promptly to contain it and, where required, notify the ICO and affected individuals, or our clients where we act as a processor, without undue delay.

10. How long we keep personal data

We keep personal data only for as long as necessary for the purposes described above. As a guide:

• enquiries that do not lead to a contract: up to 2 years from our last contact;
• client contracts, account, billing and service records: for the duration of our relationship and up to 6 years afterwards, to meet legal, tax and limitation requirements;
• security and audit logs: in line with our ISMS retention schedule, typically up to 12 months unless needed to investigate an incident;
• marketing preferences: until you opt out, after which we keep a suppression record so we respect your choice; and
• unsuccessful job applications: up to 6 months after the role is filled.

Client data we process as a processor is returned or deleted in accordance with our contract with the client. Backup copies may persist until overwritten in the normal course and remain protected.

11. Your rights

Under UK data protection law you have the right to:

• be informed about how we use your personal data;
• access a copy of your personal data;
• have inaccurate data corrected;
• have your data erased in certain circumstances;
• restrict how we use your data in certain circumstances;
• object to processing based on legitimate interests, and to direct marketing at any time;
• data portability, where processing is based on consent or contract and carried out by automated means; and
• withdraw consent at any time, where we rely on consent.

To exercise any of these rights, contact us using the details in section 1. We will respond within one month, which may be extended where the law allows. We may need to verify your identity before acting on a request. Where we act as a processor, we will pass your request to the relevant client and help them respond.

12. Cookies

Our website uses cookies and similar technologies. Strictly necessary cookies are always active. Analytics and other non-essential cookies are only used with your consent, which you can change at any time through the cookie settings on our website. Please see our Cookies Policy for details.

13. Third-party websites

Our website may link to third-party websites, including our technology partners. We are not responsible for their privacy practices, and we encourage you to read their privacy notices.

14. Complaints

If you have concerns about how we handle your personal data, please contact us first so we can try to resolve them. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection, at ico.org.uk or on 0303 123 1113.

15. Changes to this policy

We review this policy regularly as part of our ISMS and may update it from time to time. The latest version will always be published on this page, with the date it was last updated. Where changes are significant, we will take reasonable steps to let affected clients know.