Privacy Policy.

1 Who We Are

CloudSec AI is a trading name of Instant Digital Limited, a private limited company registered in England and Wales under company number 15905839.

Our registered office is: Flat 24 Well Court, 25 Adit Road, Erith, England, DA8 1FS.

For the purposes of UK data protection law, Instant Digital Limited will generally act as the data controller for personal information collected through the CloudSec AI website, enquiries, sales activity and our own business administration. In some client engagements we may instead process information on behalf of a client, in which case we may act as a data processor and the client remains responsible for determining how and why that information is used.

We handle personal information in accordance with applicable UK data protection law, including the UK General Data Protection Regulation, the Data Protection Act 2018 and other applicable privacy and electronic communications requirements.

2 Scope of This Policy

This policy applies when you:

• visit or interact with cloudsecai.co.uk or related CloudSec AI web pages;
• submit a contact form, pricing enquiry, AI Readiness Assessment or Get Started form;
• contact us by email, phone, Microsoft Teams, social media or another communication channel;
• request a quote, consultation, assessment, proposal or service;
• become a client, client contact, supplier, partner or prospective client;
• participate in an AI Strategy & Advisory, Secure AI Implementation, AI Governance & Security or Microsoft Cloud engagement;
• receive communications from us where permitted by law; or
• otherwise provide personal information to CloudSec AI in connection with our business.

This policy does not replace a client organisation's own privacy notice where CloudSec AI is acting solely as a processor on that organisation's behalf.

3 Information We Collect

The information we collect depends on how you interact with us. We may collect the following categories of personal information:

Special category data

Our services are not designed to routinely collect special category personal information such as health information, biometric data, religious beliefs or information about sexual orientation. Please avoid sending sensitive personal information unless it is genuinely necessary for the service and has been agreed with us. Where special category information must be processed, we will identify an appropriate lawful basis and additional legal condition where required.

Criminal offence data

We do not normally need criminal offence data. If a security or incident-related engagement requires access to information of this type, it will be handled only where there is a lawful basis and appropriate safeguards.

4 How We Collect Personal Information

We may collect information:

• directly from you, for example when you complete a website form, book a consultation, send us an email or provide project information;
• from your employer or organisation, where they nominate you as a project, technical, billing or administrative contact;
• through our website and systems, including server logs, security tools and permitted analytics or cookie technologies;
• from publicly available business sources, such as company websites, Companies House or professional networking platforms, where appropriate for legitimate B2B activity;
• from service providers or partners where necessary to administer a legitimate referral, engagement or business relationship; and
• during delivery of our services, where information is generated through assessments, meetings, workshops, support activity, configuration work or project documentation.

5 How We Use Your Data

We may use personal information to:

• respond to enquiries and requests for information;
• prepare quotes, proposals, statements of work and service recommendations;
• display and process your selected pricing configuration when you use our pricing and Get Started pages;
• deliver AI Strategy & Advisory services;
• deliver Secure AI Implementation and AI workflow or automation projects;
• deliver AI Governance & Security assessments, policy work and security reviews;
• deliver Microsoft 365, Entra ID, SharePoint and Microsoft Cloud security or optimisation services;
• perform AI readiness, opportunity, risk, security or governance assessments;
• manage client onboarding, project delivery, support, training and handover;
• maintain business, accounting, tax and contractual records;
• administer invoices and payments;
• operate, maintain, troubleshoot and secure our website, email, forms and business systems;
• prevent fraud, misuse, unauthorised access and cyber security incidents;
• improve our services, processes, website and customer experience;
• communicate service updates or information relevant to an existing relationship;
• carry out proportionate B2B marketing where permitted; and
• comply with legal, regulatory, tax, accounting or law-enforcement obligations.

6 Lawful Bases for Processing

We identify an appropriate lawful basis for each purpose for which we use personal information. Depending on the circumstances, we may rely on:

7 Data Used During CloudSec AI Services

The amount and type of information we access during a client engagement will depend on the agreed scope. Our services can include:

• AI Strategy & Advisory, including AI Opportunity Workshops, AI Tool & Platform Reviews and ongoing AI Advisory;
• Secure AI Implementation, including AI Training & Enablement, AI Workflow Automation and Custom AI Implementation;
• AI Governance & Security, including AI Policy & Governance Packs, AI Risk & Security Assessments and Enterprise AI Governance Reviews;
• Microsoft Cloud, including SharePoint Security Reviews, Entra ID Security Reviews and Microsoft 365 Security Baselines; and
• AI Readiness Assessments and related discovery, security, governance and implementation planning.

Where possible, we apply data minimisation and seek to work with configuration information, metadata, test data, anonymised data or limited-access environments rather than unnecessary copies of production personal data.

Access to client systems is limited to what is reasonably required for the agreed work. Additional confidentiality, security, processing and deletion requirements may be set out in a proposal, statement of work, data processing agreement or other client contract.

8 AI Systems, Prompts and Client Information

Because CloudSec AI provides AI-related advisory and implementation services, some engagements may involve reviewing prompts, workflows, AI outputs, use cases, policies, data flows or integrations.

We do not intentionally place confidential client information, personal data or sensitive business information into third-party generative AI services unless this is required for the agreed work, the relevant platform and configuration are considered appropriate, and the use is authorised or otherwise permitted.

When designing or implementing AI solutions, we aim to consider:

• data minimisation and purpose limitation;
• identity and access controls;
• appropriate permissions and least-privilege access;
• retention and logging settings;
• vendor data handling and contractual controls;
• human review where appropriate;
• security and governance requirements; and
• whether personal or confidential information is actually necessary for the use case.

Where CloudSec AI is acting as a processor for client-provided personal data, we will process that information only in accordance with the client's documented instructions and the applicable contractual arrangements, subject to legal requirements.

9 Marketing and Business Communications

We may contact existing clients and relevant business contacts about CloudSec AI services, updates or related offerings where this is permitted under applicable law and where our interests are not overridden by your privacy rights.

Where consent is legally required for a particular type of electronic marketing, we will seek consent before sending it.

You can ask us to stop direct marketing at any time. We may retain a minimal suppression record so that we can respect your request and avoid contacting you again for marketing purposes.

10 Cookies, Analytics and Similar Technologies

Our website may use cookies or similar technologies to operate essential functionality, maintain security, remember settings and understand how the website is used.

Strictly necessary cookies may be used where required for the website or service to function. Where we use non-essential cookies, such as certain analytics, advertising or tracking technologies, we will use an appropriate consent mechanism where required by UK law.

You can also control cookies through your browser settings. Disabling certain cookies may affect how some website features operate.

11 When We Share Personal Information

We do not sell or rent personal information.

We may share information with trusted third parties where reasonably necessary for the purposes described in this policy, including:

• website hosting and infrastructure providers;
• email and website form delivery providers, including services used to transmit enquiries submitted through our website;
• Microsoft and other cloud, productivity or security platforms used to run our business or deliver an agreed service;
• professional advisers such as accountants, insurers, legal advisers or auditors;
• payment, invoicing or accounting providers where used;
• specialist contractors or delivery partners where they are required for an agreed client engagement and subject to appropriate obligations;
• regulators, courts, law-enforcement bodies or public authorities where disclosure is required or permitted by law; and
• a buyer, investor or professional adviser in connection with a genuine corporate transaction, restructuring or sale, subject to appropriate confidentiality and data protection safeguards.

Where a service provider processes personal information on our behalf, we take reasonable steps to ensure that appropriate contractual, confidentiality and security requirements apply.

12 International Data Transfers

Some technology and cloud service providers may process or store information outside the United Kingdom.

Where personal information is transferred internationally and UK data protection transfer rules apply, we seek to use a lawful transfer mechanism. Depending on the destination and provider, this may include UK adequacy regulations, an applicable UK-approved transfer framework, contractual safeguards such as the International Data Transfer Agreement or UK Addendum, or another mechanism permitted by UK law.

We may also assess whether additional technical or organisational safeguards are appropriate based on the nature of the information and the service being used.

13 How We Protect Personal Information

We use technical and organisational measures designed to protect personal information against accidental loss, misuse, unauthorised access, alteration or disclosure.

Depending on the system and engagement, these measures may include:

• identity and access controls;
• multi-factor authentication;
• least-privilege permissions;
• secure Microsoft 365 and cloud configuration;
• endpoint and account security controls;
• restricted administrative access;
• secure communication and file-sharing methods;
• logging, monitoring and security review;
• appropriate backups and recovery controls; and
• confidentiality and contractual controls for people with authorised access.

No website, cloud platform or transmission method can be guaranteed to be completely secure. We therefore continually assess security proportionately to the information and services involved.

Personal data breaches

If we become aware of a personal data breach, we will assess the risk and take appropriate containment, investigation and remediation steps. Where required by applicable law, we will notify the Information Commissioner's Office and/or affected individuals within the relevant legal timescales.

14 How Long We Keep Your Data

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including to provide services, maintain appropriate business records, respond to disputes and meet legal, tax, accounting or regulatory requirements.

Retention can vary depending on the nature of the information and the relationship. Our general approach is:

Specific client agreements may contain more precise retention and deletion requirements, which will apply to that engagement.

15 Your Data Protection Rights

Depending on the circumstances and subject to applicable legal conditions or exemptions, you may have rights including:

Exercising your rights

You can contact us using the details in section 21. We may need to verify your identity before acting on a request. We will not normally charge a fee, although UK data protection law allows a reasonable fee or refusal in limited circumstances, such as where a request is manifestly unfounded or excessive.

We aim to respond within the timeframe required by applicable data protection law. In certain circumstances, that period may be extended where the law permits it.

16 Automated Decision-Making and Profiling

CloudSec AI does not currently use personal information collected through our website to make solely automated decisions that produce legal effects or similarly significant effects on individuals.

We may use automation to support ordinary business processes, website functionality, workflow routing, security monitoring or service delivery. Where an engagement involves designing automated or AI-assisted decision-making for a client, the client's role, legal obligations and governance requirements will depend on that specific solution and will be addressed separately.

17 Children's Personal Data

CloudSec AI provides business-to-business technology services and our website is not directed at children. We do not knowingly seek to collect personal information from children through our sales or enquiry processes.

If you believe a child has provided personal information to us inappropriately, please contact us so that we can review and, where appropriate, delete it.

18 Third-Party Websites and Services

Our website may contain links to third-party websites, platforms or services. Those organisations operate independently and their own privacy notices apply to information they collect.

Following a third-party link does not mean that CloudSec AI controls or accepts responsibility for that organisation's privacy practices. We recommend reviewing the relevant privacy information before providing personal information to a third party.

19 Changes to This Privacy Policy

We may update this policy from time to time to reflect changes to our services, systems, service providers, business practices or legal requirements.

The latest version will be published on this page and the "Last updated" date at the top of the policy will be changed. Where a change is significant and it is appropriate to do so, we may provide additional notice.

20 Questions and Complaints

If you have a concern about how we have handled your personal information, please contact us first so that we have an opportunity to investigate and resolve the issue.

You also have the right to raise a complaint with the UK's data protection regulator, the Information Commissioner's Office (ICO). Information about making a complaint is available at ico.org.uk.

21 Contact Us

For privacy questions, requests to exercise your data protection rights, or concerns about how we use your information, contact: