Privacy Notice
What personal data we collect, why, and the control you have over it.
Last updated: 6 October 2026
This notice explains how NorthMSP collects, uses and protects personal data when you visit our website, get in touch, or become a client. Privacy and security are the core of what we do, so we’ve tried to write this plainly rather than hide behind legalese.
1. Who we are
NorthMSP is a trading name of North Technology Group Ltd (“we”, “us”, “our”), a company registered in England & Wales under company number 17047533. Our registered office is Aizlewoods Mill, Nursery Street, Sheffield, England, S3 8GG.
For the personal data described in this notice, we are the data controller — we decide how and why it is processed. We are registered with the Information Commissioner’s Office (ICO) under registration number ZC187113.
If you have any questions about this notice or your data, contact us at privacy@northmsp.co.uk.
2. The personal data we collect
Information you give us
When you complete our contact form, email us or call us, we collect the details you provide — typically your name, work email address, company, phone number, the number of users at your organisation, the nature of your enquiry, and anything you choose to write in your message.
Client information
If you become a client, we hold contact details for the people we work with at your organisation, along with the information we need to deliver, manage and bill for our services.
Files you send us
If we ask you for files and you send them through our secure upload page, we record your name, the files’ names and sizes, and when you sent them. To protect the service from misuse, we also keep a security record of each visit to the upload page and each upload: your IP address, the approximate location and network provider associated with it, and your browser and device type. The files themselves go straight into our Microsoft 365 document storage; they are not kept on the website. Anything inside those files that belongs to your organisation is handled as described in section 4.
Technical information
When you visit the site, our hosting and security provider automatically logs limited technical data — such as your IP address, browser type and the pages you request — to keep the site running and protect it from abuse.
Game leaderboard
If you submit a score to one of our game leaderboards, the display name you type and your score are stored and shown publicly on the site. Please don’t enter your real name or any personal information — a nickname is ideal. We don’t store your IP address against leaderboard entries.
We don’t collect special category data (such as health or biometric data) through our website, and we ask that you don’t send sensitive personal information via the contact form.
3. How we use your data & our lawful bases
We only use your personal data for clear purposes, each with a lawful basis under UK GDPR:
| What we do | Lawful basis |
|---|---|
| Respond to your enquiry and provide the information you’ve asked for | Legitimate interests; or taking steps to enter into a contract |
| Provide, manage and bill for our services | Performance of a contract |
| Keep our website and systems secure and working | Legitimate interests |
| Meet our legal, tax and regulatory obligations | Legal obligation |
| Send marketing about our services, where relevant | Consent, or the “soft opt-in” for existing clients |
Where we rely on legitimate interests, we’ve considered your rights and don’t use your data in ways you wouldn’t reasonably expect.
4. When we handle data inside your systems
This is an important distinction for a managed IT provider. When we deliver IT services, we may access personal data held within your systems — for example, your staff’s or your own customers’ data.
For that data, you remain the data controller and we act as your data processor. How we handle it is governed by the data processing terms in our service agreement with you — not by this website notice. This notice covers data for which we are the controller: principally our website visitors, enquirers and our own client contacts.
5. Marketing
We do not currently send marketing emails or a newsletter. If that changes, we will only send marketing where you have given us consent, or where you are an existing client and the law permits it under the “soft opt-in” — and always about our own relevant services.
Every marketing message will include a simple way to unsubscribe, and you can opt out at any time by emailing privacy@northmsp.co.uk. Opting out of marketing won’t affect the service-related messages we need to send you as a client.
6. Who we share your data with
We don’t sell your personal data. We share it only with trusted providers who help us run our business, under contract and only as far as needed:
| Provider | What they do for us |
|---|---|
| Cloudflare | Website hosting, content delivery, security and cookieless visit statistics |
| Resend | Delivers our contact-form and notification emails |
| Microsoft | Email, productivity, document storage and workflow tools (Microsoft 365, Power Automate, Teams) used to receive and manage your enquiry and to store files you send us |
We may also share data with our professional advisers (such as accountants or lawyers), or with authorities and regulators where we’re required to by law.
7. International data transfers
Most of our processing takes place in the UK and the European Economic Area. Some of our providers (for example Resend and Cloudflare) may process data outside the UK, including in the United States. Where they do, we rely on appropriate safeguards — such as the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework — so your data continues to receive an equivalent level of protection.
8. How long we keep your data
We keep personal data only for as long as we need it, then delete or anonymise it:
| Type of data | How long we keep it |
|---|---|
| Website enquiries | Up to 24 months after our last contact, unless you become a client |
| Client records | For the length of our relationship and up to 6 years afterwards, to meet tax and legal requirements |
| Server and security logs | Up to 30 days |
| Upload page security records (IP address, location, browser) | 12 months |
| Marketing data | Until you unsubscribe or withdraw consent |
9. How we protect your data
Security is our trade, and we hold our own house to the standard we set for clients. We apply appropriate technical and organisational measures — including access controls, least-privilege access, multi-factor authentication, encryption of data in transit, and monitoring. No system is ever perfectly secure, but we work to recognised standards and review our controls regularly.
10. Your rights
Under UK data protection law you have the right to:
- Access — ask for a copy of the personal data we hold about you.
- Rectification — have inaccurate or incomplete data corrected.
- Erasure — ask us to delete your data in certain circumstances.
- Restriction — ask us to limit how we use your data.
- Object — object to processing based on legitimate interests, or to direct marketing.
- Portability — receive certain data in a portable, machine-readable format.
- Withdraw consent — where we rely on consent, withdraw it at any time.
To exercise any of these, email privacy@northmsp.co.uk. We’ll respond within one month, and there’s usually no charge.
11. Cookies
Our website uses only strictly necessary cookies, and sets no analytics, advertising or tracking cookies. We count visits with Cloudflare Web Analytics, which is cookieless and stores nothing on your device. Because of that, no cookie consent banner is needed. You can read the detail in our Cookie Policy.
12. Changes to this notice
We may update this notice from time to time as our services or the law change. The “last updated” date at the top shows when we last revised it, and we’ll highlight any material changes on this page.
13. Contact & complaints
For any privacy question or to exercise your rights, contact privacy@northmsp.co.uk, or write to: North Technology Group Ltd, Aizlewoods Mill, Nursery Street, Sheffield, England, S3 8GG.
If you’re unhappy with how we’ve handled your data, you have the right to complain to the Information Commissioner’s Office at ico.org.uk. We’d appreciate the chance to put things right first, so please do come to us.