Privacy Policy

This privacy policy tells you what to expect when 23North Ltd collects and/or processes personal information, as well as how it handles personal information to which it has access.

This information can be categorised as follows:

• Our customers’ personal data (including prospective customers who have made contact with 23North Ltd via phone, email, in person or through the contact form on our website).
• Customer data to which we have access (ie. the information hosted on our customers’ websites).

Customers’ personal data

Because we store and process our own customers’ personal data, we are legally considered a ‘Data Controller’ and as such, have legal obligations to handle this data in a responsible manner.

What personal data we collect

When you make contact with 23North Ltd to enquire about our services (either by phone, email, in person or through the contact form on our website), we will collect the following information in order to provide business services to you (to pursue the legitimate interests of our business):

• Your name
• Job title
• Organisation name
• Email address
• Phone number
• Correspondence address
• Any other personal data you may have submitted as part of your enquiry

How long we hold your personal data for

If you engage our services we’ll keep your details on file for up to three years after completion of your most recent project (in case you choose to work with us again within that time period). After three years we’ll assume that you no longer require our services and your details will be deleted from our records. If you don’t engage our services (ie. you make an enquiry that isn’t taken any further) your details will be deleted within three months of your most recent communication with us.

Who has access to this personal data

To support delivery of our services, 23North Ltd engages third party data processors which in turn also have access to certain customer data. This section provides important information about the identity, location and role of each processor. Prior to engaging any third party processor, 23North Ltd performs diligence to evaluate their privacy, security and confidentiality practices, with the purpose of establishing their compliance with all UK and EU data & privacy law.

Access to your personal information

23North Ltd tries to be as open as it can be in terms of giving people access to their personal information. Individuals can find out if we hold any personal information, as well as request that this information is removed or amended, by making a ‘subject access request’. If we do hold information about you, we will:

• give you a description of it;
• tell you why we are holding it;
• tell you who it could be disclosed to; and
• let you have a copy of the information in an intelligible form.
• Email your request to accounts@23north.co.uk

Customer data to which we have access

For those customers whose websites we manage and/or host, we are legally considered a ‘Data Processor’ (ie. we have access to the data hosted on our customers’ websites) and as such, have legal obligations to handle this data in a responsible manner. In order to provide technical and customer support, 23North Ltd and its employees require access to your website at an ‘administrator’ level. Therefore we have access to any personal data hosted on your website (such as enquiry form responses, etc).

In order to minimise the risk of a data breach we employ the following organisational measures to ensure a high level of security:

• We limit which members of staff have administrative access to customer websites (i.e. access to the data).
• Staff members who do have access to data use strong passwords.
• Where possible, we use two-factor authentication (2FA) to log in to accounts we use to deliver our services (e.g. hosting providers).
• Machines at our offices are all password protected.
• Our wireless network is hidden, as well as being secured with WPA2.
• Our office is locked and alarmed, and never left unattended when not locked and alarmed
• In the event that an employee leaves 23North Ltd, their administrative access to customer websites will be revoked.
• Further to these organisational measures, we also host all our sites in a secure environment that’s highly resilient to exploits and malicious attacks. Our hosting platforms have measures in place including intelligent IP blocking, SSL encryption, limited login attempts and strong password enforcement in order to maximise the security of your website.

Changes to this privacy policy

We keep our privacy policy under regular review.