Last updated: 14 November 2026
This privacy policy explains how AshbyIT collects, uses and protects personal information when you visit our website, get in touch with us, or work with us as a client or supplier. We’ve tried to keep it short and in plain English.
Who we are
AshbyIT is run by Elliot Doughty, a sole trader based in Hertfordshire, England. For the personal information described in this policy, we are the data controller. You can contact us about anything in this policy at [email protected] or on 07762 677626.
The information we collect
- Contact details, such as your name, job title, business name, email address and phone number, when you contact us, book a chat or become a client.
- What you tell us, such as details of your enquiry or the IT issue you need help with.
- Client and billing information, such as account contacts, quotes, invoices and payment records.
- Support information, such as notes and records of the work we carry out, and details of the devices and systems we support.
- Website information, such as the technical details our web host records when you visit (for example your IP address and browser type), which are used to keep the website running and secure.
How we use it, and our lawful basis
- To reply to your enquiry and arrange a chat or health check. Lawful basis: our legitimate interest in responding to people who contact us, or taking steps at your request before entering into a contract.
- To provide our services, including support, projects and account management. Lawful basis: performance of our contract with you or your organisation, and our legitimate interest in supporting our clients’ staff.
- To invoice and keep financial records. Lawful basis: our legal obligations, including tax and accounting rules.
- To keep our website and systems secure. Lawful basis: our legitimate interest in protecting our business and our clients.
- To send occasional updates about our services. We’ll only do this where the law allows, and you can opt out at any time.
We don’t sell your information, and we don’t use it for automated decision-making.
When we handle data on our clients’ behalf
When we support a client’s IT, we may be able to see personal information stored in their systems, such as emails, files or staff accounts. In that case our client is the data controller, and we act as their data processor: we only access it to provide the service, we follow their instructions, and we keep it confidential and secure. If you have a question about how one of our clients uses your information, please contact that organisation directly.
Who we share it with
We only share personal information when we need to, with:
- service providers who help us run our business, such as our email and file storage, website hosting, and accounting and invoicing software providers
- suppliers we deal with on your behalf, such as internet, phone or software providers, when this is needed to resolve an issue for you
- professional advisers, such as our accountant, insurers and legal advisers
- the police, regulators or other authorities, where the law requires it
Some of our service providers may store information outside the UK. Where they do, we make sure appropriate safeguards are in place, such as transfers to countries the UK recognises as providing adequate protection, or approved contract terms.
How long we keep it
- Enquiries that don’t lead to any work: up to 12 months.
- Client records and support history: for as long as we work together, and for up to six years afterwards in case of questions or claims.
- Financial records: for as long as the law requires, which is normally six years.
After that, we securely delete or anonymise the information.
How we keep it safe
We use the same security measures we recommend to our clients, including strong passwords, multi-factor authentication, encryption, up-to-date security software, and access restricted to the people who need it.
Your rights
You have the right to:
- ask for a copy of the personal information we hold about you
- ask us to correct information that’s wrong or incomplete
- ask us to delete your information, or to restrict how we use it
- object to us using your information on the basis of our legitimate interests, or for marketing
- ask us to transfer your information to another organisation, where this applies
- withdraw your consent at any time, where we rely on consent
To use any of these rights, email [email protected]. We’ll respond within one month. There’s normally no charge.
Cookies
Our website only uses cookies that are strictly necessary for it to work and stay secure. We don’t use advertising or tracking cookies. If that changes, we’ll update this policy and ask for your consent where the law requires it.
We use Cloudflare Web Analytics to count visits and see which pages are popular. It doesn’t use cookies, doesn’t track you across other websites and doesn’t collect information that identifies you. It only gives us overall figures, such as the number of visits and the type of device used.
Complaints
If you’re unhappy with how we’ve handled your personal information, please tell us first at [email protected] so we can put it right. We’ll acknowledge your complaint within 30 days, look into it promptly, keep you updated and let you know the outcome.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.
Changes to this policy
We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated.
Client portal
We provide a secure client portal at portal.ashbyit.co.uk where people at our client businesses can view documents we share with them and their business’s IT hub.
What we collect. If your business gives you access to the portal, we hold your name, work email address, the business you work for and your access level. When you use the portal, we and our hosting provider also record technical information, such as when you logged in, your IP address and failed login attempts. This helps keep accounts secure.
Why we use it. To set up and run your portal account, to show you the right information, and to keep the portal secure. Our lawful basis is our legitimate interests in providing our services to your business and keeping them secure, and, where you are our client, carrying out our contract with you.
Where it’s kept. On the portal’s servers, run by our hosting provider [Krystal Hosting Ltd], in [the UK].
How long we keep it. For as long as you have a portal account. When your access ends, we delete your account within 90 days. Security logs are kept for up to 12 months.
Cookies. The portal only uses cookies that are strictly necessary to log you in and keep you logged in. It doesn’t use analytics or advertising cookies.
Your rights. You have the same rights over this information as described elsewhere in this policy. To use them, email [email protected].