Last updated: 1 October 2026
This policy explains how Albion Business Computers Ltd, trading as ABCOM IT Solutions (“ABCOM”, “we”, “us”), collects, uses, shares and protects personal data when you visit our website, use our services, take our Shadow AI Check, speak to us or receive our marketing. It applies under UK data protection law, including the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR) and the Data (Use and Access) Act 2025.
1. Who we are and how to contact us
ABCOM IT Solutions is a trading name of Albion Business Computers Ltd, a company registered in England and Wales under company number 03474597. We are a managed IT, cyber security, telecoms and AI readiness provider based in Burgess Hill, West Sussex. We are registered with the Information Commissioner’s Office (ICO), registration number ZB198761.
- Registered office and address: Albion Business Computers Ltd (trading as ABCOM IT Solutions), Unit 3 Ashwyn Business Centre, Burgess Hill, West Sussex, RH15 8QY
- Email: compliance@abcom.co.uk
- Telephone: 01444 871200
2. Our two roles: controller and processor
We act in two different roles, and your rights and our responsibilities differ in each.
- As a controller, we decide why and how personal data is used. This covers our own website, enquiries, sales and marketing, supplier and customer contacts, billing, the Shadow AI Check and our own staff and business records.
- As a processor, we handle personal data on behalf of our clients when we deliver managed IT, security, telecoms, Microsoft 365, backup, device management and recycling services. In that case our client is the controller, we act only on their documented instructions under our contract and data processing terms, and any request about that data should go to the client first. If you contact us about it, we will pass your request to the client.
3. The personal data we collect
| Category | Examples |
|---|---|
| Identity and contact data | Name, job title, employer, business email address, telephone number, postal address |
| Account and service data | Usernames, licence and subscription details, support tickets, service history, contract and order details |
| Technical and device data | IP addresses, device identifiers, operating system and software inventory, security alerts, logs, telemetry and DNS query data from the filtering and monitoring tools we run for clients |
| Communications data | Emails, messages, form submissions, meeting notes, and call records, recordings or transcripts where call recording or call analytics is enabled |
| Website and usage data | Pages viewed, referring site, browser and device type, approximate location, and interactions with our site, collected using cookies and similar technologies |
| Shadow AI Check data | Your answers, score and recommended controls, plus the name, company, email and telephone number you give if you ask for a review |
| Marketing data | Your marketing preferences, campaign engagement, and prospecting data such as business contact details and job role from business databases |
| Financial data | Billing contacts, invoices and payment records. We do not store full payment card details on our website |
| Client data we may see incidentally | While supporting systems we may have access to files, mailboxes and records held by clients, which can include any kind of personal data. We access this only as needed to deliver the service |
We do not deliberately collect special category data (such as health or biometric data) or criminal offence data for our own purposes. We may incidentally process it as a processor when supporting a client’s systems.
4. How we collect personal data
- Directly from you when you call, email, complete a form, take the Shadow AI Check, book a review, sign a contract or use our support desk.
- From your employer or organisation when they are our client or supplier and give us staff details so we can provide services.
- Automatically through cookies and similar technologies, server logs, DNS filtering, endpoint and device management tools, remote support tools and Microsoft 365 integrations that we operate for clients.
- From third parties such as business contact databases, LinkedIn, advertising platforms (Google, Meta, LinkedIn), referral partners, suppliers and publicly available sources, such as company websites and registers.
5. How we use personal data and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Providing managed IT, security, telecoms, connectivity, Microsoft 365 and IT recycling services, including remote support, device management and security monitoring | Contract. As a processor, the client’s instructions and lawful basis apply |
| Cyber Essentials and IASME support, gap analysis, penetration testing, Microsoft Purview and data governance work, AI readiness reviews and policy drafting | Contract, and legitimate interests in delivering and improving our advisory services |
| Responding to enquiries and booking free reviews | Legitimate interests in answering the people who contact us, and consent where you ask us to contact you about your results |
| Running the Shadow AI Check and showing your results | Legitimate interests in operating the quiz you chose to take |
| Following up on your Shadow AI Check or website form after you tick the consent box | Consent, which you can withdraw at any time |
| Direct marketing, newsletters, events and outbound business prospecting | Consent where the law requires it, otherwise legitimate interests in promoting our services to businesses (see section 6) |
| Website analytics, security and improvement | Consent for non-essential cookies, unless an exemption applies. Legitimate interests in keeping our site secure |
| Billing, accounts, record keeping, tax and audit | Contract and legal obligation |
| Protecting our systems, preventing fraud and misuse, and handling disputes or legal claims | Legitimate interests and legal obligation |
| Complying with law, regulators and scheme requirements | Legal obligation |
Where we rely on legitimate interests, we balance them against your rights and interests. You can ask us for details of that assessment.
6. Marketing and business prospecting
We market to businesses, charities and public bodies. For emails and text messages to corporate subscribers (for example a work address at a limited company), PECR allows us to send marketing without prior consent as long as we identify ourselves and give you a clear way to opt out. For individual subscribers such as sole traders and some partnerships, we ask for your consent first, unless you are an existing customer buying something similar.
We use business databases and outreach tools such as Apollo and Instantly to find and contact relevant business contacts, and advertising platforms such as Google Ads, Meta and LinkedIn to reach people with relevant adverts. Every marketing email includes an unsubscribe link. You can also email compliance@abcom.co.uk at any time. We keep a minimal suppression record so that we do not contact you again.
7. The Shadow AI Check and our use of AI
The Shadow AI Check. Your answers are used in your browser to calculate your score and recommendations. We receive your details only if you complete the review request form. We then receive your name, company, email, optional telephone number, your score and the main findings, so that we can follow up. We do not use your answers to train artificial intelligence models.
How we use AI ourselves. Our staff use business-grade AI tools, such as Microsoft Copilot, to help with drafting, summarising and analysis. We do not enter client or prospect personal data into consumer AI tools. We keep a register of the AI tools we use, review their data handling terms, and apply human review before AI-assisted work is shared with anyone.
Automated decisions. We do not make decisions about individuals based solely on automated processing that have a legal or similarly significant effect. Your quiz score is an indication only and does not affect any service you receive from us.
AI work for clients. When we advise clients on AI, Copilot readiness or Microsoft 365 data governance, we act as a processor and follow the client’s instructions.
8. Call recording and call analytics
Where call recording, transcription or call analytics is enabled on our own lines, or on VoIP and Microsoft Teams telephony systems we manage for clients, we may record and analyse calls to deal with disputes, train staff, monitor service quality and improve customer experience. You will be told at the start of a recorded call. For client systems, the client decides whether recording is used and is responsible for telling its own staff and callers. We apply the controls our clients ask for on access and retention.
9. Remote support, monitoring and security tools
To support client systems we use remote access, device management and monitoring tools, including Microsoft Intune, NinjaOne and Autotask, Webroot DNS filtering and endpoint protection. These tools can collect device details, installed software, security alerts, web and DNS activity, and remote session logs. When providing these services we act as a processor for the client, who is responsible for informing its own staff about monitoring and for setting the rules it wants applied. We access user files and screens only when needed to resolve a request or security issue.
10. Cookies and similar technologies
We use cookies and similar technologies on our website. These fall into the following groups:
- Essential: needed to make the site work, remember your cookie choices and keep it secure. These do not need consent.
- Analytics: help us understand how the site is used so we can improve it. Where the law allows low-risk analytics without consent, we rely on that exemption. Otherwise we ask for your consent.
- Marketing and advertising: used by Google, Meta, LinkedIn and similar services to measure adverts and show you relevant ones. These are only set if you consent.
You can change your choices at any time using the “Cookie settings” link in the footer of our website, or through your browser settings. Blocking some cookies may affect how parts of the site work.
11. Who we share personal data with
We do not sell personal data. We share it only where necessary with:
- Service providers and subcontractors who help us deliver services, including Microsoft, Webroot, Vonahi, Gamma, Daisy, Autotask, NinjaOne, and our email, hosting, website, telephony and connectivity providers.
- Marketing and sales platforms including Apollo, Instantly, Google, Meta and LinkedIn.
- Certification and scheme bodies such as IASME and the National Cyber Security Centre where needed for Cyber Essentials work.
- Professional advisers such as accountants, lawyers, auditors and insurers.
- Regulators, law enforcement and public authorities where we are legally required to or it is necessary to protect rights, safety or security.
- A buyer or successor if our business or assets are sold or restructured, under suitable confidentiality terms.
Our suppliers act on our instructions under written contracts, unless they are independent controllers in their own right.
12. International transfers
Some of our suppliers are based outside the UK, or use servers or support staff outside the UK. Where personal data is transferred abroad, we make sure it has appropriate protection, such as UK adequacy regulations (including the UK–US data bridge for certified US companies), the ICO’s International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, or binding corporate rules. You can ask us for more information about the safeguards we use.
13. How long we keep personal data
| Data | How long we keep it |
|---|---|
| Client IT, device and account data | For the duration of the contract, then returned or deleted under the client’s instructions and our contract terms |
| Contracts, invoices and financial records | 6 years after the end of the relevant financial year (HMRC and company law) |
| Enquiries, quiz follow-ups and prospect records | Up to 24 months after our last contact with you if you do not become a client, unless you ask us to delete them sooner |
| Marketing data | Until you opt out, after which we keep a minimal suppression record |
| Call recordings and transcripts | Only as long as needed for the purpose, then deleted. Client systems follow the client’s chosen retention |
| Security logs and monitoring data | For the period needed for security, support and the client’s requirements |
| Data on devices we recycle | Securely erased on disposal. We keep the erasure or destruction certificate as a business record |
| Complaints about data protection | 6 years after the complaint is closed |
14. How we keep personal data secure
We use appropriate technical and organisational measures, including encryption, multi-factor authentication, endpoint detection and response, vulnerability scanning, penetration testing, access controls based on least privilege, secure backup, supplier due diligence and regular staff training. We are an NCSC Assured Service Provider (Cyber Advisor for Cyber Essentials). If a personal data breach puts people at risk, we will report it to the ICO within 72 hours where the law requires, and tell the people affected without undue delay when there is a high risk to them. Where we are a processor, we will notify the client without undue delay.
15. IT recycling and asset disposal
When we collect and dispose of IT equipment, we use certified secure data erasure or physical destruction, provide certificates of erasure or destruction, and comply with UK GDPR and the WEEE and environmental regulations that apply to electrical waste.
16. Your rights
Under UK data protection law you have the right to:
- be informed about how we use your data (this policy);
- access a copy of the personal data we hold about you;
- correct data that is inaccurate or incomplete;
- erasure, in certain circumstances;
- restrict how we use your data, in certain circumstances;
- data portability, for data you gave us that we process by automated means under contract or consent;
- object to processing based on legitimate interests and to direct marketing at any time;
- withdraw consent at any time, without affecting earlier lawful processing; and
- not be subject to solely automated decisions that have legal or similarly significant effects.
To use any of these rights, email compliance@abcom.co.uk. We will normally respond within one month, and we may extend this by up to two further months for complex or numerous requests, in which case we will tell you why. For access requests we carry out reasonable and proportionate searches. We may ask you to confirm your identity or to clarify what you are asking for, and the time limit pauses while we wait for your reply. There is normally no charge, but we may charge a reasonable fee or refuse a request that is manifestly unfounded or excessive. If we hold your data as a processor for one of our clients, we will pass the request to the client.
17. Complaints
If you are unhappy with how we have handled your personal data, please tell us first so we can put it right. You can complain by emailing compliance@abcom.co.uk, by telephoning 01444 871200, or by writing to us at the address in section 1. We will acknowledge your complaint within 30 days, investigate it without undue delay, keep you informed of progress, and tell you the outcome. We keep a record of complaints and how they were resolved.
You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or by telephone on 0303 123 1113. You do not have to complain to us first, and you may also seek a judicial remedy through the courts.
18. Children
Our website and services are aimed at businesses and organisations and are not directed at children. We do not knowingly collect personal data from anyone under 18 for our own purposes. Where we support schools and other organisations that handle children’s data, we act as their processor.
19. Links to other websites
Our site may link to other websites, such as social media, partner and supplier sites. We are not responsible for their privacy practices, so please read their policies.
20. Changes to this policy
We review this policy regularly and will update it when our practices or the law change. We will always show the date it was last updated at the top. If we make significant changes, we will make this clear on our website and, where appropriate, tell you directly.