Privacy Policy

Our Privacy Policy

Effective date: 08/10/2026

Whether you visit our website, speak to one of our team or use our services more widely, you are trusting us with your information. This privacy policy sets out how we collect, use and respect such information, and how the law protects you and your information.

Why this policy exists

This privacy policy explains how we collect and process your information. All references to information in this privacy policy, means any data which identifies a natural person, or which allows that person to be identified when combined with other data.

This privacy policy is provided in accordance with our obligations under applicable privacy and data protection law, including the UK retained version of Regulation (EU) 2016/679 (GDPR) and the Data Protection Act 2018.

We keep our privacy policy under regular review. The version of the policy became effective on the date shown above.

What information we have & how it was collected

We collect and use information to deliver our services and to operate our website, as well as to provide useful updates and other information about our services. In this context, we are a data controller.

If we are a data controller in respect of your information, the statements in this privacy policy apply.

If we are a data processor of a client's information (pursuant to KEL's Hosted Software Subscription Agreement) - as well as this privacy policy, our data processing agreement will apply, as set out under the Data Processing Schedule at end of this privacy policy.

What information we have

We have set out below the information we may collect, use and store:

Contact data including billing address, delivery address, email address and telephone numbers.
Financial data including bank account, billing address and payment card details.
Identity data including your name and username.
Transaction data including details about payments made and other details of services supplied.
Technical data including information about use of a website, internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, screen resolution and other technical characteristics of your device, your use of our services and applications and connection to our website.
Profile data including usernames and passwords, preferences and feedback.
Usage Data including information about your visit, the path that you take through and from our website (including date and time); pages that you viewed or searched for; page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page.
Employment data includes current and past employment, experience, qualifications, skills, interests (i.e. as part of a CV) and any other information disclosed by you.
Marketing and communications data including preferences in receiving marketing from us and communication preferences (see below for details on our limited marketing activities).
Aggregated data such as statistical or demographic data. Aggregated data may be derived from your information but is not considered 'personal data' in law as it does not reveal your identity. However, if we combine or connect such data with your information so that it can directly or indirectly identify you, we will apply this privacy policy to such combined data.

Please note that we do not collect, use or store any special categories of data (i.e. such as health, genetic, biometric or other sensitive personal data).

How we collect your information

We use different methods to collect data including through:

Information you provide to us directly. You may give us details such as a name, email address and other contact details in person, or by filling in forms on our website or by corresponding with us by post, phone, email, and/or otherwise. This includes information provided when you:
- contact us via our website;
- request our services;
- meet with, contact or engage with our staff;
- request any other information to be sent to you;
- contact us about a role with us;
- make a complaint or give us some feedback.
Automated technologies or interactions. When you interact with our website, we may automatically collect technical data about your equipment, IP address, browsing actions and patterns. We collect this data by using cookies and other similar technologies.
Third parties and publicly available sources. We may receive personal data from various third parties as set out below:
- identity and contact data from other individuals at your organisation
- information given to us by our clients and businesses that we work with
- technical data from analytics providers and/or search information providers; and
- employment, identity and contact data from recruitment agencies, previous employers, etc.

How we use cookies

Our website uses cookies and similar technologies to distinguish you from other users of our website. This helps us to provide you with a good experience when you browse our website and allows us to improve our website. You can set your browser to refuse all or some browser cookies. For more information about the cookies we use, see our Cookies Policy.

Why we collect and use your information

We will only collect and use information when the law allows us to. Most commonly, we will use your information so we can provide our services, for limited marketing purposes, and if required by law.

The table below set out the ways we use information and our legal basis for doing so. Most commonly, we will use your information:

where we need to perform the contract we are about to enter into or have entered into with you;
where it is in our legitimate interest to do so (or those of a third party) and it is proportionate to do so;
where we need to comply with a legal obligation.

Generally, we do not rely on consent as a legal basis for processing information but exceptionally may rely on consent to send marketing communications to you via email. You have the right to withdraw your consent at any time by contacting us.

Purpose/Activity	Type of data	Lawful basis for processing (including basis of legitimate interest)
To register you as a new or prospective customer	(a) Identity (b) Contact	(a) Performance of a contract with you (b) Necessary for our legitimate interest (for running our business and to provide our services)
To deliver services and content to you including: (a) Contacting you and taking instructions (b) Managing payments, fees and charges (c) Collecting and recovering money owed to us	(a) Identity (b) Contact (c) Financial (d) Transaction (e) Marketing and Communications	(a) Performance of a contract with you (b) Necessary for our legitimate interests (to recover any debt due to us)
To manage our relationship with you, which may include: (a) Notifying you about changes to our terms of business or privacy policy (b) Asking you for a testimonial or feedback	(a) Identity (b) Contact (c) Profile (d) Technical (e) Marketing and Communications	(a) Performance of a contract with you (b) Necessary to comply with a legal obligation (c) Necessary for our legitimate interests (to study how clients use our services and content, to develop them and grow our business)
To administer and protect our business and website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)	(a) Identity (b) Contact (c) Technical	(a) Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise) (b) Necessary to comply with a legal obligation
To deliver relevant content and measure or understand the effectiveness of such content	(a) Identity (b) Contact (c) Profile (d) Technical (e) Marketing and Communications	(a) Performance of a contract with you (b) Necessary for our legitimate interests (to study how clients use our services, to develop them and to grow our business)
To use data analytics to improve our website, services and customer relationships and experiences	(a) Technical	Necessary for our legitimate interests (to define types of customers for our services, to keep our website updated and relevant, to develop our business)
To make suggestions and recommendations to you about services or content that may be of interest to you	(a) Identity (b) Contact (c) Technical (d) Profile	Necessary for our legitimate interests (to develop our products/services and grow our business)
To process a job application and keep you informed of employment opportunities	(a) Identity (b) Contact (c) Financial (d) Profile	(a) Performance of a contract with you (b) Necessary to comply with a legal obligation (c) Necessary for our legitimate interests (to recruit good candidates for our business)
To send out information about our services which you have specifically requested	(a) Identity (b) Contact	(a) Necessary for our legitimate interests (to develop our services and content and grow our business)
To send our marketing communications	(a) Identity (b) Contact (c) Marketing and Communications	(a) Necessary for our legitimate interests (to develop our services and content and grow our business) (b) If you have consented (exceptional cases, per above statement)

Where we need to collect information by law, or under the terms of a contract and you do not provide that information when requested, we may not be able to perform the contract or provide you with our services.

Change of purpose

We will only use your information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, contact us.

If we need to use your information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

Who we share your information with & why

We may share your information with others, particularly those that help us provide our services or run our business effectively. Most commonly, this includes our staff, our IT service providers, those who manage our data, and our advisers.

We require others to respect the information we share with them, and to only use it in ways the law allows. We only allow others to use such information for the specific purposes we set out, and not for any other purposes.

When we engage processors to process information on our behalf, we ensure a contract is in place with the processor that sets out the details of the processing.

We may have to share information with third parties (including those below) for the purposes and activities explained above:

Our staff and who provide services or are involved in the running of our business.
Service providers who perform services and functions on our behalf in connection with the operation of our business such as software and application service providers and third parties who host, store and manage data or provide programming or technical support, etc.
Professional advisers including our accountants, solicitors, insurers and brokers, etc.
Analytics partners to analyse website traffic and understand customer needs and trends.
If we are required to do so by law, or if we believe that such action is necessary to: (a) fulfil a government, or regulatory authority request; (b) conform with the requirements of the law or legal process; (c) protect or defend our legal rights or property, our websites or customers.

We will share information, without notice, only if we are required to do so by law or we, in the good faith, believe that such action is necessary to:

comply with legislation or any legal process served on us;
protect and defend our rights and/or property; and
to protect personal safety.

We do not sell or give your information to third parties for them to contact or market their goods or services to you without your consent.

International transfers

Your information is never transferred outside of the United Kingdom. All your information is stored and processed within the United Kingdom only.

Analytics providers

Our website may include links to third-party websites and/or plug-ins. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites or services and are not responsible for their privacy practices or privacy statements. When you leave our website, we encourage you to read the privacy policy of any new website you visit if this a concern for you.

Third-party links and services

How we protect your information

We take steps to keep your information secure and we delete it when we no longer need it.

Security of your information

We have put in place appropriate security measures to prevent information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to information to those of our staff and other third parties who have a business need to know. They will only process information on our instructions and they are subject to a duty of confidentiality.

Data retention

We will retain information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for information, we consider the amount, nature, and sensitivity of the information, the potential risk of harm from unauthorised use or disclosure of the information, the purposes for which we process the information and whether we can achieve those purposes through other means, and the applicable legal requirements.

For example, if you are a customer, we will generally keep your information for the longer of: (a) six years from the date of our last interaction with you; or (b) until the relevant statutory limitations period has expired.

We regularly review the information we hold, taking into account the lawful purpose for which we hold it, and any data that is deemed no-longer relevant or required is deleted where it is practicable to do so.

Your rights

Privacy laws give you certain rights. For example, you can choose whether to receive marketing from us and you can ask us what information we have about you.

Opt Out Rights

We carry out limited marketing activities, specifically sending an annual newsletter to our existing clients. You have the right to opt-out of receiving marketing communications from us at any time by responding to the newsletter email with the word ‘unsubscribe' or using the unsubscribe option set out in any e-mail from us, or by contacting us directly.

Other Legal Rights

You have the right to:

Request access. This means you can ask us to give you a copy of the information we hold about you.
Request correction. This means if we have incomplete or inaccurate information, you can ask us to correct it. It is important that the information we hold about you is accurate and current. Please keep us informed if the information you provide us changes as our relationship evolves. Note, we may need to verify the accuracy of the new data you provide to us.
Request erasure. This means you can ask us to delete or remove any information we have if there is no good reason for us continuing to have it. You also have the right to ask us to delete or remove information where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your information to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
Object to processing. This means you can contact us if you feel our use of your information impacts on your rights and freedoms. This applies if we are: (a) relying on our legitimate interest (or those of a third party) to use your information; (b) if we are using your information for direct marketing purposes (c) if you believe we are using your information unlawfully; or (d) where we need to erase you information to comply with local laws. It is unlikely, but in some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
Request restriction. This means you can ask us to suspend using your information in the following scenarios: (a) if you want us to establish the data's accuracy; (b) where our use of the information is unlawful but you do not want us to erase it; (c) where you need us to hold the information even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your information but we need to verify whether we have overriding legitimate grounds to use it.
Request transfer. This means you can ask us to transfer the information we hold on you to you, or to a third party. We will provide to you, or the third party you have chosen, your information in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use, or where we used the information to perform a contract with you.
Withdraw consent. . This means you can tell us that you no longer consent to our use of your information at any time where we are relying on consent to process your information. If you withdraw your consent, we may not be able to provide certain services or content to you. We will advise you if this is the case at the time you withdraw your consent. Note that this will only apply to any information where we were previously relying on consent as the legal basis to use your information. This action will also not affect the lawfulness of any processing carried out before you withdraw your consent.

What we may need from you

We may need to request specific information from you to help us confirm your identity and your rights in relation to your request. This is a security measure to ensure that information is not disclosed to any person who does not have a right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

No fee usually required

You will not have to pay a fee to exercise the rights listed above. However, we may charge a reasonable fee if your request is unfounded, repetitive, or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

Time limit to respond

We try to respond to all legitimate requests as soon as reasonably practicable and at least within one month. Occasionally it may take us longer if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Right to complain to the Information Commissioner's Office

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

How to contact us

If you have any questions or would like to contact us about this policy, you can contact us by email at support@kel.co.uk.

We are KEL Computing Limited. Our business is registered in England with business number 01972366 and our registered office is C/O Crowe UK LLP St George's House, 56 Peter Street, Manchester, United Kingdom, M2 3NQ

Data Processing Schedule

This Schedule sets out the terms on which KEL, acting as the data processor processes information on behalf of the client, acting as the data controller, in accordance with the UK retained version of Regulation (EU) 2016/679 (UK GDPR) and the Data Protection Act 2018.

Where KEL is acting as a data processor of a client's personal data pursuant to KEL's Hosted Software Subscription Agreement, the following provisions shall apply:

1. Processing Instructions

KEL shall process information only:

In accordance with documented instructions from the client, KEL's Hosted Software Subscription Agreement and this Schedule.
For the purposes specified by the client in writing.
For the duration KEL's Hosted Software Subscription Agreement is in place between the parties.

The client shall ensure it has a lawful basis for processing and shall be responsible for the lawfulness of its instructions to KEL.

2. Confidentiality

KEL shall ensure that any person authorised to process information is under an obligation of confidentiality. KEL shall not disclose information except as instructed by the client or as required by law.

3. Security

KEL shall implement appropriate technical and organisational measures to protect information against unauthorised access, loss, destruction or damage, in accordance with Article 32 of the UK GDPR.

These measures shall be proportionate to the risk and may include, as appropriate: encryption and pseudonymisation of personal data; measures to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services; the ability to restore access to personal data in a timely manner in the event of a physical or technical incident; and a process for regularly testing, assessing and evaluating the effectiveness of such measures. KEL may also demonstrate compliance with this obligation by adherence to an approved code of conduct or certification mechanism.

4. Sub-processors

KEL has the client's general authorisation for the engagement of sub-processors from an agreed list (see Annex B). KEL shall not engage any other sub-processor to process information on behalf of the client without the client's prior written authorisation, which may be given as a general written authorisation in respect of a class of sub-processors or as specific written authorisation in respect of a named sub-processor.

KEL shall provide the client with a list of current sub-processors upon request and shall notify the client of any intended changes to that list (whether by way of addition or replacement of a sub-processor) at least fourteen (14) days prior to such change taking effect, thereby giving the client the opportunity to object to such changes in writing before the change takes effect. Where the client does object, client and KEL shall discuss in good faith what alternative options are available. Where KEL engages a sub-processor in connection with services provided to the client, KEL shall do so only on the basis of a written contract which imposes on such sub-processor terms equivalent to those imposed on KEL in this Schedule, and KEL shall remain fully liable to the client for the performance of such sub-processor's obligations.

5. Data Subject Rights

KEL will assist the client, at the client's cost, in responding to any request from a data subject and in ensuring compliance with its obligations under the applicable data protection legislation with respect to security, breach notifications, impact assessments, demonstrating compliance with the applicable data protection legislation and consultations with supervisory authorities or regulators. KEL shall provide the client with information and assistance as reasonably required to fulfil such requests.

6. Breach

KEL shall notify the client of any information breach (meaning breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, information) without undue delay and in any case within 72 hours of becoming aware of it, and shall include in the notification details pertaining to the nature of breach, categories/approximate number of data subjects affected, likely consequences, and measures taken to address and rectify the breach). KEL shall provide sufficient information to enable the client to meet its own notification obligations.

7. Deletion or Return of information

Within thirty (30) days of termination or expiry of KEL's Hosted Software Subscription Agreement, KEL will, at the client's election (to be notified to KEL in writing prior to or within fourteen (14) days of termination), either: (a) securely delete or destroy all information and copies thereof; or (b) return all information to the client in a commonly used machine-readable format; unless KEL is required by applicable law to retain the information, in which case KEL shall notify the client of such requirement and shall not process the retained information for any other purpose. KEL shall provide written confirmation to the client upon completion of deletion or return.

8. Audit Rights

KEL will maintain complete and accurate records and information to demonstrate its compliance with these provisions. KEL shall allow the client and its respective auditors, at the client's own cost and expense and upon reasonable prior written notice (and no more than once per calendar year unless a specific breach has been identified), to conduct audits or inspections and shall provide assistance to the client in exercising such audits or inspections, as reasonably required. The purposes of any such audit or inspection shall be to verify that KEL and its sub-processors (if applicable) are processing the client's information in accordance with the obligations under this Schedule.

9. International Transfers

KEL shall not transfer information outside the United Kingdom without the client's prior written authorisation. Where any such transfer is authorised, KEL shall ensure that appropriate safeguards are in place in accordance with Chapter V of the UK GDPR, which may include: (a) a transfer to a country subject to UK adequacy regulations; (b) use of the International Data Transfer Agreement (IDTA) issued by the ICO; or (c) use of the International Data Transfer Addendum (UK Addendum) to the EU Standard Contractual Clauses. KEL shall promptly notify the client if it considers that any instruction to transfer information outside the United Kingdom would infringe applicable data protection legislation.

10. Liability

KEL's liability for breach of this Schedule shall be limited as set out under and subject to the Limitation of Liability Clause 10 of KEL's Hosted Software Subscription Agreement.

11. Termination

Upon termination of the KEL's Hosted Software Subscription Agreement, KEL shall cease processing and shall delete or return information as set out in Section 7.

12. Client Obligations

The client shall:

ensure that it has, and maintains throughout the term, a valid lawful basis under applicable data protection legislation for each category of processing it instructs KEL to carry out;
ensure that all personal data provided to KEL is accurate, adequate, relevant and not excessive in relation to the purposes for which it is processed;
ensure that all necessary privacy notices have been provided to, and any required consents obtained from, data subjects prior to submitting their personal data to KEL for processing;
notify KEL promptly if it becomes aware of any security vulnerability, data breach or other incident relating to the information processed by KEL under this Schedule;
notify KEL promptly of any data subject request received by the client that requires KEL's assistance, and cooperate with KEL in responding to such requests within the applicable statutory timeframes;
be responsible for carrying out any data protection impact assessment required in connection with the processing, and shall engage KEL's reasonable assistance in a timely manner where KEL's input is required (and KEL shall have an obligation to provide such reasonable assistance, where KEL's input is required);
pay KEL's reasonable costs for any assistance provided by KEL pursuant to sections 5, 6 and 8 of this Schedule - save where such assistance is required as a direct result of KEL's breach of this Schedule.

13. Governing law and Jurisdiction

This Schedule is governed by and will be construed in accordance with English law. Each Party irrevocably submits to the exclusive jurisdiction of the English Courts for all purposes relating to this Schedule.

Annex A — Processing Details

This Annex forms part of the Data Processing Schedule and sets out the details of the processing carried out by KEL as data processor on behalf of the client as data controller, as required by Article 28(3) of the UK GDPR.

A. Subject Matter of Processing

The processing of personal data by KEL in connection with the provision of hosted software services to the client pursuant to KEL's Hosted Software Subscription Agreement.

B. Duration of Processing

For the duration the hosted software services are provided to the client pursuant to KEL's Hosted Software Subscription Agreement, and following termination or expiry thereof, for the period required to complete the deletion or return of information in accordance with Section 7 of this Schedule.

C. Nature of Processing

Collection, storage, organisation, structuring, retrieval, use, disclosure, transmission and deletion of personal data, as necessary for the provision of the hosted software services pursuant to KEL's Hosted Software Subscription Agreement.

D. Purpose of Processing

To enable KEL to provide the hosted software services to the client as set out in KEL's Hosted Software Subscription Agreement, and for such ancillary purposes as the client may instruct in writing from time to time.

E. Types of Personal Data

Includes names, email addresses, telephone numbers, user account data, usage data, and such other personal data as the client submits to the hosted software platform from time to time.

F. Categories of Data Subjects

Includes the client's employees, contractors, customers, end users, and such other individuals whose personal data the client submits to the hosted software platform from time to time.

G. Controller's Obligations and Rights

The client, as data controller, retains overall control of the personal data processed under this Schedule. The client's obligations and rights are as set out in this Schedule, including the right to issue documented instructions to KEL, to authorise or object to sub-processors, to request deletion or return of information, and to conduct or commission audits and inspections in accordance with Section 8 of this Schedule.

Annex B - Sub-processors

Sub-processor	Purpose	Location
Microsoft Azure (Microsoft Operations Ireland Ltd)	Hosts the Services in the Cloud (IaaS and PaaS)	Microsoft Azure default data centres for UK customers: United Kingdom