Privacy Policy for ITSM Direct Effective Date: 20th October 2025 (date of last website refresh)
Last Updated: 20th October 2025. At ITSM Direct, we respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and protect your information in accordance with UK data protection laws, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. 1. Who We Are ITSM Direct is a UK-based IT Service Management consultancy. We provide strategic guidance, tooling expertise, and transformation support across public and private IT environments. 
Contact: Via our website or e-mail: info@itsmdirect.net

ICO Registration Number: [Insert or "Application in progress"]
2. What Data We Collect We may collect the following personal data:
Identity & Contact Details – name, job title, email, phone number, company
Service Interests – preferences and details about your business needs or project goals
Usage Data – visits to our website, pages viewed, time spent, and clicks
Form Responses – information submitted via scheduling or discovery forms
Transactional Information – bookings, invoices, payments (processed securely via Stripe)
Marketing Preferences – where you opt in or engage with our content
We do not knowingly collect sensitive personal data (e.g. health, ethnicity, religious beliefs). 

3. How We Collect Data Data is collected when you: Contact us via web forms, email, or phone
Book a meeting via TidyCal
Submit service details via FormFlow
Browse or interact with our website
Engage with marketing or social campaigns
Purchase services or digital products

We only collect data necessary for our services, legitimate interests, or legal obligations. 

4. How We Use Your Data We use your data to: Deliver the services you’ve requested or expressed interest in
Schedule and manage consultations or meetings
Send proposals, invoices, or onboarding materials
Comply with legal obligations (e.g., accounting, contracts)
Improve the quality and relevance of our services
Understand how users interact with our site and services (e.g., page views, click-throughs, booking behaviour)
Track service engagement to inform how we shape and offer our products
Analyse demographics such as industry, role, or organisation type to tailor content and offerings
Inform internal marketing strategies, such as email outreach, service updates, or curated content based on interest
These activities are carried out on the basis of: Contract – where data is required to fulfil a service
Consent – where you opt into specific communications
Legitimate Interests – to operate, improve, and grow our business

You can opt out or object at any time by contacting us, or clicking 'unsubscribe' in marketing communications. 

5. Third-Party Tools We Use To deliver services and enhance your experience, we use the following tools: 

TidyCal – for meeting scheduling (collects name and email)
FormFlow – for client intake, discovery, and service alignment
Stripe – for secure payment processing (we do not store card details)
Microsoft 365 – for secure email and document management
Shopify (if used) – for digital or physical product sales
Analytics platforms – such as Google Analytics, to understand visitor behaviour

All tools are GDPR-compliant and only process personal data necessary for the stated purpose. 

6. Data Security 
We apply strict access controls, encryption, and cloud security measures. Data is hosted in the UK or EEA where possible. 
Only authorised personnel have access to your data. 

7. Cookies & Analytics We use cookies to: Analyse site traffic and visitor behaviour
Track conversions and popular content
Enhance your browsing experience
Support service personalisation
For full details, please see our separate Cookie Policy. You can manage cookie settings via your browser or cookie banner preferences.

8. Data Retention We retain data for: Active clients – for the duration of the working relationship
Financial/legal records – for up to 7 years (to comply with UK tax and audit regulations)
Website/marketing data – for up to 24 months (unless earlier deletion is requested)
We regularly review our retention policies and securely dispose of data that is no longer needed. 

9. Your Rights Under the UK GDPR, you have the right to: Access your personal data
Request correction of inaccurate or incomplete data
Request erasure (“the right to be forgotten”)
Object to or restrict certain processing
Withdraw consent where given
Request a copy of your data in a portable format
  
To exercise any rights, please contact: [Insert contact email] You may also lodge a complaint with the Information Commissioner’s Office: www.ico.org.uk 

10. Contact Data Protection Lead – ITSM Direct
Registered Office: 167–169 Great Portland Street, 5th Floor, London, W1W 5PF
Email: info@itsmdirect.net