Last updated: June 2026 | Compliant with UK GDPR, Data Protection Act 2018 & Data (Use and Access) Act 2025
This policy explains how IAP UK Ltd collects, uses, stores and protects your personal data. IAP UK Ltd is the data controller for personal data processed in connection with our services.
What personal data do we collect?
We collect personal data necessary to provide our services, including: company name, contact names and job titles, postal address, telephone numbers, email addresses, IP addresses, and financial information where required for credit assessment or invoicing. We may also process personal data generated over networks we manage, including IP addresses and email addresses, for security and service delivery purposes.
How do we obtain personal data?
We obtain personal data from orders and enquiries placed by customers; from information gathered at marketing events or via our website; from third-party sources such as resellers; and directly from networks and systems we manage on your behalf.
Lawful basis for processing
We process personal data on the following lawful bases under Article 6 UK GDPR:
- Contract — processing is necessary to deliver services you have engaged us to provide.
- Legal obligation — where we are required to process data by law (e.g. HMRC reporting, payroll).
- Legitimate interests — where we have a genuine business reason that does not override your rights (e.g. security monitoring, service improvement, direct marketing to existing customers).
- Consent — where you have freely and clearly agreed to specific processing (e.g. marketing to prospective customers).
How do we use your personal data?
We use personal data to: deliver and support our services; process orders and invoices; manage your account; improve our services; comply with legal obligations; and, where you have not opted out, to inform you about IAP products and services we believe may be of interest.
Do we transfer personal data outside the UK?
We do not routinely transfer personal data outside the UK. Some third-party service providers (for example, Microsoft Azure, Xcitium/iTarian) may process data on servers outside the UK. Where this occurs, we ensure appropriate safeguards are in place, including Data Processing Agreements and, where applicable, the UK International Data Transfer Agreement (IDTA). We will not transfer your personal data internationally without appropriate protection in place.
Who do we share personal data with?
We share personal data only where necessary: within our internal teams to fulfil our obligations; with trusted sub-processors (such as Microsoft, Xcitium, Avast, 20i, and Xero) who are contractually bound to protect your data; with law enforcement or regulators where legally required; and, with your consent, with other third parties.
How long do we keep your data?
We retain personal data for as long as necessary to fulfil the purposes for which it was collected. As a general rule: client data is retained for the duration of the contract and for 13 months following termination; financial and invoicing records are retained for 7 years in accordance with HMRC requirements; employee records are retained for the duration of employment plus 6 years. We do not retain personal data for longer than necessary.
How do we protect your data?
We take the security of your personal data seriously. We implement appropriate technical and organisational measures including access controls, encrypted communications, multi-factor authentication on key systems, and regular security reviews. Where third parties process data on our behalf, we require them to maintain equivalent security standards under Data Processing Agreements.
Your rights
Under UK GDPR you have the following rights in relation to your personal data:
- Right of access — request a copy of the personal data we hold about you (Subject Access Request).
- Right to rectification — ask us to correct inaccurate or incomplete data.
- Right to erasure — ask us to delete your data in certain circumstances.
- Right to restrict processing — ask us to pause processing your data.
- Right to data portability — receive your data in a structured, machine-readable format.
- Right to object — object to processing based on legitimate interests or for direct marketing (marketing objections will always be honoured immediately).
To exercise any of these rights, please contact our Data Protection Officer at [email protected]. We will respond within one month.
Data Protection Officer
Our Data Protection Officer is Marcus Hurley. You can contact the DPO at [email protected] or by post to IAP UK Ltd, 33 Hopps Road, Kingswood, Bristol, BS15 9QQ.
Complaints
If you have a complaint about how we have handled your personal data, please contact us in the first instance at [email protected]. We will acknowledge your complaint within 5 working days and respond in full within 30 calendar days. Full details of our complaints procedure are available on request.
If you remain dissatisfied, you have the right to complain to the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint | Tel: 0303 123 1113 | ICO, Wycliffe House, Water Lane, Wilmslow, SK9 5AF.
Cookies
Our website only uses essential cookies, so there is nothing you need to accept. See our Cookie Policy for details.
Policy updates
We may update this policy from time to time to reflect changes in our practices or legal requirements. The current version will always be published at https://www.iapuk.biz/tob/. This policy was last updated in June 2026.