UK GDPR & Data Protection

Star IT Systems is committed to protecting personal data and to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page explains our approach, both as a business that collects personal data and as a managed IT provider that handles data on behalf of our clients. It should be read alongside our Privacy Policy.

Our Role: Controller and Processor

As a controller: we decide how and why personal data is used when you contact us, request a quote, use our chat assistant, place a Technology Store order request, or become a client (for example, contact details, correspondence and billing records).

As a processor: when we manage, support or migrate your IT systems, we may have access to personal data held within your environment (such as mailboxes, files, user accounts and devices). In these cases you remain the controller, and we process that data only on your documented instructions under a data processing agreement, which forms part of our services agreement.

Lawful Bases We Rely On

• Contract: to provide quotes, deliver services and fulfil orders you have requested.
• Legitimate interests: to respond to enquiries, run and secure our business, and keep in touch with existing clients about relevant services, where this does not override your rights.
• Legal obligation: to keep financial records and meet regulatory requirements.
• Consent: where we ask for it, for example for optional marketing. You can withdraw consent at any time.

Your Rights

Under UK GDPR you have the right to:

• be informed about how your personal data is used;
• access the personal data we hold about you (a subject access request);
• have inaccurate data rectified;
• have your data erased in certain circumstances;
• restrict how we use your data;
• data portability, where processing is based on consent or contract and carried out by automated means;
• object to processing based on legitimate interests, and to direct marketing at any time;
• not be subject to decisions based solely on automated processing that have legal or similarly significant effects.

How to Make a Request

Email info@staritsystems.com or write to us at GHL House, Albion Place, Maidstone ME14 5DZ, United Kingdom. We may need to verify your identity before acting on a request. We aim to respond within one month, which may be extended where requests are complex or numerous, as permitted by law. There is normally no fee.

If your request concerns data held within a client's systems that we manage (where the client is the controller), we will pass it to that organisation and support them in responding.

How We Protect Data

Security is central to the services we provide. Measures we apply include multi-factor authentication, least-privilege and role-based access, encryption of data in transit and at rest where supported, device management and endpoint protection, logging and monitoring, and regular review of access. Our staff are bound by confidentiality obligations.

Sub-processors and International Transfers

We use carefully selected third-party providers to run our business and deliver services, such as Microsoft cloud services, email delivery and hosting providers, and, where AI chat answers are enabled, Anthropic. Where personal data is transferred outside the UK, we rely on appropriate safeguards recognised under UK law, such as adequacy regulations or the International Data Transfer Agreement / UK Addendum. A list of sub-processors used for client services is available on request.

Data Breaches

We maintain procedures to detect, investigate and respond to personal data breaches. Where a breach is likely to result in a risk to individuals, it will be reported to the Information Commissioner's Office (ICO) within 72 hours of becoming aware of it and, where required, to the individuals affected. Where we act as a processor, we will notify the relevant client without undue delay.

Retention

We keep personal data only for as long as needed for the purposes it was collected for, including to meet legal, accounting and contractual requirements, and then securely delete or anonymise it. Enquiries that do not lead to an engagement are typically reviewed and deleted periodically.

Complaints

If you have concerns about how we handle your data, please contact us first at info@staritsystems.com so we can put things right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

This page is a general statement of our approach and should be reviewed by a qualified data protection professional to confirm it reflects Star IT Systems's actual processing activities, sub-processors and retention periods before it is relied upon.