1. Who we are

SoftExponent is a UK based IT support, cybersecurity, cloud, consulting and digital transformation provider.

For this privacy policy, “SoftExponent”, “we”, “our” and “us” refer to the organisation operating this website and providing SoftExponent services.

2. Information we collect

We may collect and use the following types of personal information, depending on how you interact with us:

• Contact details, such as name, business email address, phone number, company name and job role.
• Enquiry information, such as messages submitted through forms, consultation requests, service interests and project details.
• Client service information, such as account contact details, support requests, onboarding information, service notes and operational communications.
• Billing and transaction information, such as invoice details, plan selections, payment status and subscription information. Payment card information is handled by the relevant payment provider where applicable.
• Website and technical information, such as IP address, browser type, device information, pages visited, referral source and cookie preferences.
• Security and fraud prevention information, such as log data, access records, suspicious activity indicators and information needed to protect our website, systems and services.

3. How we use your information

We use personal information for legitimate business, service and compliance purposes, including to:

• Respond to enquiries, consultation requests and support requests.
• Provide IT support, cybersecurity, cloud, consulting and related services.
• Create and manage client accounts, onboarding steps, plans, service records and communications.
• Prepare proposals, quotes, contracts, invoices and service updates.
• Operate, maintain and improve our website, forms, client portal and digital services.
• Protect our website, systems, clients and services from security threats, misuse and fraud.
• Meet legal, accounting, regulatory, tax and record keeping obligations.
• Send relevant service, administrative or business communications.

4. Lawful basis for processing

Where UK data protection law applies, we rely on one or more lawful bases depending on the purpose of processing.

• Contract: where processing is needed to provide a service, respond to pre-contract enquiries, manage a client relationship, or take steps requested before entering into a contract.
• Legitimate interests: where processing supports normal business operations, service improvement, client communication, website security, fraud prevention, business development or administration, provided those interests are not overridden by your rights and interests.
• Legal obligation: where processing is required for tax, accounting, regulatory, legal or compliance reasons.
• Consent: where we ask for permission, such as for certain cookies or optional marketing communications. Where consent is used, you can withdraw it at any time.

We do not intend to collect special category data through general website forms. Please avoid sending sensitive personal information unless it is necessary for the service or support request.

5. Who we share information with

We may share personal information with trusted third parties where necessary for the purposes described in this policy. This may include:

• Hosting, website, email, security, analytics, form and client portal providers.
• Payment processors, accounting tools, banks and professional advisers.
• Technology vendors, subcontractors or service partners involved in delivering client services.
• Regulators, public authorities, courts, insurers or legal advisers where required or appropriate.

We do not sell personal information.

6. How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose it was collected, including service delivery, enquiry handling, legal, accounting, tax, security and dispute management purposes.

Where a precise retention period is not stated, we decide how long to keep information based on the type of information, the reason it was collected, the sensitivity of the information, legal requirements, contractual needs, and whether it may be needed to establish, exercise or defend legal claims.

7. How we protect information

We use appropriate technical and organisational measures to help protect personal information against unauthorised access, loss, misuse, disclosure or alteration.

• Access controls and account protection.
• Security monitoring and system hardening where appropriate.
• Supplier selection and service management controls.
• Secure handling of support, enquiry and client information.

No online service can be guaranteed completely secure, but we work to protect information in a proportionate and commercially responsible way.

8. Your data protection rights

Depending on the circumstances, you may have rights under UK data protection law, including the right to:

• Request access to your personal information.
• Ask for inaccurate information to be corrected.
• Ask for information to be erased in certain circumstances.
• Ask us to restrict or object to certain processing.
• Request data portability in certain circumstances.
• Withdraw consent where processing is based on consent.
• Complain to the Information Commissioner’s Office if you are unhappy with how your information is handled.

To exercise your rights, contact us at info@softexponent.com. We may need to verify your identity before responding.

9. Cookies and website analytics

Our website may use cookies and similar technologies to operate the site, improve performance, remember preferences, understand how visitors use the site, and support relevant website functionality.

Essential cookies may be needed for the website to work. Non-essential cookies, such as analytics or marketing cookies, should only be used where permitted and where the appropriate consent or preference mechanism is in place.

10. International transfers

Some technology, hosting, payment, analytics, support or cloud providers may process information outside the UK. Where this happens, we expect appropriate safeguards to be used where required by data protection law.

11. Changes to this policy

We may update this privacy policy from time to time to reflect changes to our services, website, legal requirements, suppliers or business operations. The latest version will be published on this page.