Privacy notice

Who we are

Managed Services is a trading name of Phishermans Ltd (Company No. 15312330, registered in England & Wales), which is the data controller for personal data collected through this website. Registered office: 167-169 Great Portland Street, 5th Floor, London W1W 5PF. Data-protection contact: privacy@managed-services.co.uk. We are registered with the Information Commissioner’s Office (registration number ZC098139).

The personal data we collect

The only personal data this site collects is what you choose to send through the contact form: your first and last name and work email address (required), and — if you provide them — your phone number, company name, the service area you are interested in, and your message. We also record whether you ticked the optional marketing box, the exact wording you were shown, and the date and time. Providing this information is voluntary, but we need your name and a contact address in order to reply.

Separately, for security, our servers and content-delivery network record access logs which include your IP address, the pages you requested, and the date and time. We keep these logs for 90 days and then delete them automatically. We use them only to keep this site secure — to detect, investigate and respond to security incidents and abuse. They are not used to track you, to build a profile of you, or for marketing. We use no analytics, no advertising and no third-party tracking on this site.

Separately from this website, we hold business contact details for staff at UK schools and similar organisations, collected from those organisations’ public websites for our business-to-business marketing service. That service, and the data it uses, is described in the section “Business-to-business marketing on behalf of our clients” below.

Why we collect it, and our lawful basis

• To respond to and manage your enquiry — our lawful basis is legitimate interests (UK GDPR Article 6(1)(f)); our legitimate interest is responding to, and managing our business relationship with, people who contact us. We have carried out a legitimate-interests assessment.
• To send you occasional updates — only if you tick the optional box; our lawful basis is your consent (Article 6(1)(a)), which also satisfies PECR. You can withdraw consent at any time, without affecting anything we sent before.
• To keep this site and your data secure — we record access logs (including your IP address) so that we can detect, investigate and respond to security incidents and abuse. Our lawful basis is legitimate interests (Article 6(1)(f)); our legitimate interest is the security of our network and information systems, which UK data-protection law expressly recognises as a legitimate interest. We have carried out a legitimate-interests assessment.
• Business-to-business marketing on behalf of our clients — our lawful basis is legitimate interests (UK GDPR Article 6(1)(f)). See the dedicated section below.

We do not use automated decision-making or profiling.

How long we keep it

We keep enquiry details for no longer than 24 months, after which they are deleted automatically. Security access logs are kept for 90 days, then deleted automatically. Marketing consents are kept until you withdraw them.

Business marketing contacts: up to 24 months from collection or last verification. Campaign-event data: 12 months, then anonymised. Suppression list: for as long as we operate the marketing service. Complaint and objection records: six years.

Who processes it, and where it is held

We do not sell your data or share it for others’ marketing. Your data is processed on our behalf by our infrastructure providers, acting as our processors:

• Amazon Web Services — hosting and database, in the United Kingdom (London / eu-west-2) region;
• Amazon SES — delivers the notification email of your enquiry to us.
• Stripe — planned for billing our business clients; not yet in use, and will not receive any marketing or enquiry data.

Your data is hosted in the UK. Amazon Web Services is a US-headquartered provider, and in limited support situations its personnel outside the UK may access data. Any such access is a “restricted transfer” governed by the UK-approved data-transfer terms (the International Data Transfer Agreement / UK Addendum to the standard contractual clauses) in our contract with AWS, which provide the safeguards UK data-protection law requires.

Business-to-business marketing on behalf of our clients

What we do. We operate an email-marketing service that sends business-to-business emails to UK schools and similar organisations on behalf of our clients, who are businesses offering services relevant to the education sector. We decide which organisations receive which emails and when. Our clients supply the content of the email, which we review and approve before it is sent. This is separate from the optional updates you can choose to receive by ticking the box on our contact form, which are sent only with your consent as described above.

Whose data and what data. We hold contact details for staff and role-holders at schools and similar organisations: name (where published), role, organisation, work email address, and the campaign-event data described below. We do not hold details of pupils, parents or governors in a personal capacity, personal (non-work) email addresses, or any special category data.

Where the data comes from. We collected the details from the organisations’ own public websites, where they are published as contact details for the organisation. We record the source and date of collection for every record. We do not buy marketing lists.

Why we can use it. Our lawful basis is legitimate interests (Article 6(1)(f) UK GDPR). Direct marketing is recognised in the UK GDPR as a purpose that may be a legitimate interest. We have carried out and documented a legitimate interests assessment, which concluded that sending occasional, relevant, business-to-business emails to published organisational contacts, with an easy way to stop, does not override the interests or rights of the people concerned. You can ask us for a summary of that assessment.

Corporate and individual subscribers. We send marketing emails only to organisations that are corporate subscribers under the Privacy and Electronic Communications Regulations, such as maintained schools, academy trusts and incorporated bodies. We do not send marketing emails to sole traders, unincorporated partnerships or unincorporated associations unless they have given us consent.

Who receives your data. Our clients do not receive your details. They receive anonymous campaign statistics and any reply you choose to send them directly. Our service provider is Amazon Web Services, which hosts and backs up the data in the UK (London region) and sends our emails through Amazon SES; any AWS support access from outside the UK is covered by the International Data Transfer Agreement as described above. We plan to use Stripe for billing our clients; Stripe will not receive any marketing data and is not yet in use.

Tracking. We do not collect information about your device, location or email software. We do not use open-tracking pixels to see whether you have opened an email unless you have expressly agreed to that; we will only ever ask for that agreement separately, record it, and act on it for you alone, and you can withdraw it at any time. If you click a link in one of our emails, we record that a click occurred so that we can report anonymous campaign results; we do not record which link, your IP address or your device details against your record. When you click through to our website, the security access logs described above apply in the same way as for any visitor and are never linked to your marketing record.

How long we keep it. Contact details: up to 24 months from collection or from the date we last checked them against the published source, after which they are deleted. Campaign-event data (sends, bounces, complaints, clicks): 12 months in identifiable form, then anonymised. Suppression list: for as long as we operate the marketing service, so that we never contact you again once you have asked us to stop. Records of complaints, objections and the content of what we sent: six years.

Your rights. You have the right to object to direct marketing at any time, and we will stop: use the Unsubscribe link in any email or write to privacy@managed-services.co.uk. You also have the right to access the data we hold about you, to have it corrected or erased, to restrict its use, and to data portability where it applies. If you ask us to erase your details, we will keep only your email address on our suppression list; this is necessary so that we can comply with your objection, and we rely on our legal obligation to do so. We respond to requests within one month.

Your rights

Under UK data-protection law you have the right to access, rectify, erase or restrict your data, to object to processing, to data portability, and to withdraw consent. To exercise any of these, contact privacy@managed-services.co.uk.

Complaints

If you are unhappy with how we have handled your personal data, please tell us first at privacy@managed-services.co.uk — we will acknowledge your complaint within 30 days and respond as quickly as we can. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk) at any time.

Cookies

This site is designed to work without tracking you and launches without a consent banner, because it sets only storage that is strictly necessary to make the site work and keep it secure — see our Cookies page.

Security

We protect your data with encryption in transit and at rest, access controls and least-privilege administration.

Changes to this notice

We may update this notice; the date at the top shows when it last changed.

Contact

Data-protection contact: privacy@managed-services.co.uk. Postal: Phishermans Ltd, 167-169 Great Portland Street, 5th Floor, London W1W 5PF.