Home / Policies / Privacy Policy

Legal / Policies

Privacy Policy

How we collect, use, and protect personal information, aligned to UK GDPR and ISO 27001.

Last updated: 22 October 2026

This Privacy Policy sets out how Medhurst Communications Limited uses and protects any information that we collect about you to enable us to provide you with our services.

Medhurst is committed to ensuring that your privacy is protected. Should we ask you to provide certain information by which you can be identified, you can be assured that it will only be used in accordance with this privacy statement. To support our commitment to data protection, we are compliant and certified to the ISO 27001:2022 Information Security Standard.

What information we collect

We only collect your information for the purposes of providing our services to you. We may collect:

Your name and occupation
Your landline and mobile telephone number
Your postal address
Your email address
Other information relevant to customer offers or surveys
Bank details for Direct Debit collection or refund of monies owed to you
If you visit our premises, images of you captured by our CCTV system
Indirectly, within encrypted back-ups, other information such as photos, videos, special category data, personal telephone numbers and dates of birth

Additional information where we provide connectivity or telephony services

Where we provide broadband, connectivity or telephony services, we may also collect and process:

Service and circuit identifiers, telephone numbers and number ranges, and calling line identification (CLI) data
Call records, call traffic data and usage information
Call recordings, voicemail and messaging information, where relevant to the provision, support, management, troubleshooting, security or lawful operation of the service
Number porting, migration and transfer information
Installation, billing and service address information, and emergency services location information required to facilitate access to, or compliance with, emergency services obligations
Directory listing information and information required for directory enquiry services, where applicable

Information we process on behalf of our customers

Where we deliver managed services to an organisation, for example a school, college or academy trust, we may have access to personal data held on that organisation’s systems, including through back-ups. In relation to that data we act as a processor on our customer’s instructions rather than as a controller, and our handling of it is governed by our contract with that customer. This policy describes the personal data for which Medhurst is the controller. If you are an individual whose data is held on a customer’s systems, that organisation’s own privacy information will explain how your data is used, and any request about it should be directed to them in the first instance.

We do not knowingly collect personal information directly from children aged 13 or under as a controller.

How we use the information we collect

We require your information to facilitate, process and maintain the services we provide to you, to inform you of our range of services and to help understand your needs. We may use the information to:

Contact you regarding the services we provide to you
Provide you with any documentation needed for those services, for example quotations, contracts and invoices
Send advisory notices, for example about service maintenance
Improve our services
Send promotional information about new services, products, events or other information which we think you may find interesting
Contact you from time to time for market research purposes
Customise the website according to your interests
Contact you by email, telephone or post
Provision, operate, support, maintain, transfer, port or cease connectivity and telephony services, including facilitating access to emergency services and preventing and detecting fraud

Our lawful bases for processing

We process your personal information on one or more of the following lawful bases under the UK GDPR:

Performance of a contract, where we need your information to provide the services you or your organisation have ordered from us, to manage the account and to take payment.
Legitimate interests, where we use your information to operate and improve our services, to maintain the security and integrity of our systems and networks, to prevent and detect fraud, to manage our supplier and customer relationships and to keep business records. Where we rely on legitimate interests we consider the impact on you, and you have the right to object as set out below.
Compliance with a legal obligation, where we are required to retain or disclose information, for example for tax, regulatory, telecommunications or law enforcement purposes.
Consent, where you have agreed to receive marketing information from us, where you have accepted analytics cookies on our website, or where consent is otherwise required. You may withdraw consent at any time.

Securing your personal information

We are committed to ensuring that your information is secure and have put in place suitable physical, electronic and organisational procedures to safeguard and secure the information we collect.

Appropriate physical security is in place at all locations where information is held.
Electronic information is held securely on our servers, PCs and mobile devices, protected by complex passwords, biometric methods and Multi-Factor Authentication where available.
Electronic information is backed up daily, both on-site and off-site, with a minimum retention period of 30 days. All back-ups are securely encrypted and use immutability technology.
Any paper or manual information is kept in secure record-keeping systems.

Third parties we work with

Processors acting on our behalf

We may use the following third-party processors to collect, store and process personal information on our behalf. Each publishes its own privacy information:

Suppliers who act as independent controllers

To deliver broadband, connectivity and telephony services we rely on carriers, network operators, wholesale providers and infrastructure providers. Where we share your personal data with them, they act as independent controllers in their own right rather than on our behalf, because they process that data for their own regulatory, network and legal purposes. We will share only what is reasonably necessary to provision, operate, support, maintain, transfer, port or cease the services.

Those providers may process the data to provide electronic communications services, to route and carry communications traffic, to maintain and secure their networks, to comply with legal and regulatory obligations, to facilitate number allocation and number portability processes, to detect and prevent fraud, to handle emergency services requirements, to resolve faults, and to establish, exercise or defend legal claims. Each provider is responsible for its own processing and publishes its own privacy information.

We may also share your personal information with finance companies, where equipment or services you take from us are financed by a third-party funder.

Sharing your personal information

We may share your personal information with our professional advisors or insurers where reasonable and necessary for managing disputes or risks, obtaining professional advice, or implementing or maintaining insurance.
We may share your personal information with suppliers where it is reasonable for them to need it to provide and deliver goods or services.
We may share your personal information with any organisation in our group of companies where reasonably necessary for the purposes set out in this policy.
We will share your personal information with regulatory or legal entities where required by UK law.

Transfers of your personal information outside the UK

Some of the third parties we work with may process personal information outside the United Kingdom. Where personal information is transferred outside the UK, we take steps to ensure that it receives an equivalent level of protection, by transferring only to a country which the UK Government has determined provides adequate protection, or by putting in place an appropriate transfer mechanism such as the International Data Transfer Agreement or the UK Addendum to the European Commission standard contractual clauses, together with any additional safeguards required. Further information about the transfers relevant to your information is available on request.

Retaining your personal information

We will retain your personal information for as long as is reasonably necessary for the processing, delivery and legality of any services or products provided to you.
We may retain your personal information for an extended period where such retention is needed to comply with legal requirements or to manage any dispute that may be ongoing after a service has ended.

Reference: QD03 Records Register (available on request).

Controlling your personal information

You may choose to restrict the collection or use of your personal information in the following ways:

If you have previously agreed to us using your personal information for direct marketing purposes, you may change your mind at any time by writing to us or emailing us at optin@medhurst-it.com.
We may use your personal information to send you promotional information about third parties which we think you may find interesting if you tell us that you wish this to happen.
We will not sell, distribute or lease your personal information to third parties unless we have your permission or are required by law to do so.
You may request details of the personal information which we hold about you, or request removal of such data, under the UK GDPR. There is no charge for making such a request. We may charge a reasonable fee only where a request is manifestly unfounded or excessive, or where you ask for further copies of the same information. If you would like a copy of the personal information held on you, please email us at privacy@medhurst-it.com. We will respond within one month, which may be extended by up to two further months for complex requests, in which case we will tell you.
If you believe that any information we are holding on you is incorrect or incomplete, please write to us or email us as soon as possible at the address above. We will promptly correct any information found to be incorrect.
Any data held on our back-up systems, including CCTV images, will not be removed manually on request. Data will cease to be held on the back-ups when the data deletion date exceeds the retention periods set for back-ups. All back-ups are encrypted for security.

Your rights

The UK General Data Protection Regulation sets out your individual rights in relation to your personal information. They are:

Right to be informed. You have the right to be informed about the collection and use of your personal data.
Right of access. You have the right to access your personal data and to be aware of and verify the lawfulness of our processing of it.
Right to rectification. You have the right to have inaccurate personal information rectified, or completed if it is incomplete.
Right to erasure. Also known as the right to be forgotten, you can request that personal information be erased. This right is not absolute and exclusions may apply for compliance or legal reasons.
Right to restrict processing. You have the right to request restriction of the use of your personal information, for example where you contest its accuracy, where processing is unlawful but you oppose erasure, or where we no longer need the data for the delivery of services but it is required for the establishment, exercise or defence of legal claims.
Right to data portability. You have the right to obtain and reuse your personal data, and to receive it in a structured, commonly used and machine-readable format.
Right to object. You have the right to object to the processing of your data on grounds relating to your particular situation where processing is based on legitimate interests or the performance of a task in the public interest or exercise of official authority (including profiling), to direct marketing (including profiling), and to processing for purposes of scientific or historical research and statistics. If you make such an objection we will stop processing your personal information unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is for the establishment, exercise or defence of legal claims.

Your right to complain

If you are unhappy with how we have handled your personal information, please contact us in the first instance using the details below and we will do our best to resolve the matter. You also have the right to lodge a complaint with the Information Commissioner’s Office (Information Commissioner's Office (ICO)), which is the UK supervisory authority for data protection. The ICO can be contacted at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, by telephone on 0303 123 1113, or at ico.org.uk. Making a complaint to us does not affect your right to complain to the ICO.

Our website, cookies and similar technologies

Our website uses cookies and similar technologies. A cookie is a small file placed on your device when you visit a website. Similar technologies include local and session storage, pixels and tags, which work in comparable ways. In this section we refer to all of them as cookies.

Cookies may collect information such as your IP address, device and browser type, the pages you visit, how long you spend on them, the links you follow and the site you arrived from. Where that information identifies you, directly or indirectly, it is personal data and the rest of this policy applies to it.

How we use cookies

We use cookies for two purposes only:

Strictly necessary. A record of the cookie choice you have made is stored so that we can honour it and avoid asking you again on every page. Our contact form also uses a security check provided by Cloudflare, which may set a cookie on Cloudflare’s own domain for the purpose of that check. These are required for the website to work as intended, so they do not need your consent, but we tell you about them here.
Performance and analytics. We use Google Analytics to count visits and show us how the website is used, which pages are helpful and where people encounter difficulty, so that we can improve it. Analytics cookies are set only if you accept them. Google acts as our processor for this information, and we have configured the service so that IP addresses are not stored in full.

We do not use cookies for advertising, and we do not use them to profile you, to follow you across other websites or to make automated decisions about you. We do not sell information collected through cookies.

Your choices

When you first visit our website you will be asked which cookies you accept. Until you make that choice, no analytics cookies are set. The only thing stored on your device beforehand is the record of the choice itself, held in your browser’s local storage, which is treated as strictly necessary because without it we could not honour your preference.

You can accept analytics cookies or reject them, and you can change your mind at any time using the Cookie settings control in the footer of every page. Withdrawing consent is as straightforward as giving it. Withdrawal does not affect any processing that took place while your consent was in force. We will ask you to confirm your choice again after twelve months so that it stays current.

If you reject analytics cookies the website works normally. You can also block or delete cookies through your browser settings, but that is a general control over every website you visit rather than the way to change your choice here. The Cookie settings control in the footer is the route for that.

What is stored

What is stored	Stored by	Purpose	Category	Duration
Record of your cookie choice	Our website, in your browser’s local storage	Records which cookies you have chosen to accept, so that we can honour your choice and do not ask you again on every page	Strictly necessary	12 months
Cloudflare security cookie (contact page only, where set)	Cloudflare, on its own domain	Supports the security check on our contact form that tells genuine enquiries apart from automated abuse	Strictly necessary	Short-lived, set by Cloudflare for the duration of the check
_ga	Google Analytics, as a cookie on our website	Distinguishes one visitor from another so that visits can be counted	Performance and analytics, set only if you accept	2 years
_ga_ followed by our Google Analytics identifier	Google Analytics, as a cookie on our website	Keeps the pages you view in one visit together as a single session	Performance and analytics, set only if you accept	2 years

Where a cookie is set by a third party, that party may act as a controller of the information it collects for its own purposes, and its own privacy information will explain how it uses that information. Some providers process information outside the United Kingdom; where that happens the transfer is covered by the section on transfers above.

Other third-party services on our website

Two further services operate on our website. Neither sets analytics or tracking cookies and neither triggers the cookie banner, but both involve some processing of your information, so we describe them here.

Cloudflare. Our contact page uses Cloudflare Turnstile to tell genuine enquiries apart from automated abuse. When the page loads, your browser makes a request to Cloudflare, which receives your IP address and basic technical information about your browser and device in order to assess whether the request is automated. Turnstile is not used to profile you or to follow you across other websites.

Microsoft. When you submit an enquiry, it is delivered into our own Microsoft 365 tenant, which also sends your acknowledgement. Microsoft acts as our processor for this and the information remains within our tenant.

Changes to our use of cookies

If we change the cookies we use, we will update this policy and, where the change requires it, ask for your consent again.

Links to other websites

Our website may contain links to other websites of interest. Once you have used these links to leave our site, we do not have any control over that other website. We cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites, and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question.

Changes to this policy

We may update this policy from time to time. The current version is always published on this page, with the date it was last updated shown at the top. This version is GDPR01.13, published on 22 October 2026.

How to contact us

Information Security Manager, Medhurst Communications Limited (company number 03868503), 17 Brunel Way, Segensworth, Fareham, Hampshire, PO15 5TX. Email: privacy@medhurst-it.com.

Data protection registration

Medhurst Communications Limited is registered with the Information Commissioner’s Office (ICO). Registration reference: ZA327006.

Speak with our experts

Tell us about your school, trust, or programme. We will route you to the right team and respond promptly.

Speak with our experts