Privacy policy

Who is responsible for your data

E-Consulting Ltd, Unit 11 Maple Business Park, Birmingham, B7 5ET, is the data controller for the personal data described in the "Website and enquiries" section below, and the data processor for the personal data contained in customer mailboxes.

Contact: sales@myexchangeserver.co.uk or 0121 233 0200.

Website and enquiries

When you contact us through this website, by email or by telephone, we collect:

• Your name, company, email address and telephone number.
• The details of your enquiry, including mailbox counts and your current email provider.
• When you use the website form: which page of our site you came to the form from, and whether you started from the price calculator or the email security checker (including the domain and results you chose to send us).
• Correspondence between us relating to that enquiry.

We use this to respond to you, prepare a quote and, if you become a customer, to deliver and invoice the service. Our lawful basis is legitimate interests (responding to a business enquiry you initiated) and, once you are a customer, performance of a contract.

We do not add enquirers to a marketing mailing list, we do not sell or share enquiry data with third parties for their own purposes, and we do not operate advertising or profiling trackers on this site.

Mailbox content

Where you are a customer, your mailboxes contain personal data for which you are the controller and we are the processor. We process it only to deliver, secure, back up and support the service, in accordance with a written data processing agreement provided on request.

Our staff do not read mailbox content in the ordinary course of business. Access occurs only where you request support that requires it, where it is necessary to investigate a security incident or fault, or where we are legally required to. Such access is logged.

Where your data is held

All mailbox data, its replicas and its backups are stored and processed within the United Kingdom. Support is delivered by our own personnel in the United Kingdom. We do not transfer mailbox content outside the UK.

How long we keep it

• Enquiries that do not become customers: 24 months, then deleted.
• Mailbox content: for the life of the service, then 30 days after termination, with backups purged within a further 30 days.
• Billing and accounting records: 7 years, as required by HMRC.
• Support tickets and correspondence: 6 years from closure.
• Server and access logs: 90 days.

Who we share it with

We use a small number of sub-processors to deliver the service, including UK data centre operators, our email filtering provider and our accounting software provider. A current list is available on request and forms part of the data processing agreement. We will give notice of any material change to that list.

We may disclose data where we are legally obliged to do so, for example in response to a lawful order.

Cookies

This website sets no advertising or profiling cookies. It sets Google Analytics cookies only if you accept them in the cookie banner, and you can change your mind at any time using the Cookie settings link at the foot of every page. See our cookie policy for the full list.

Website analytics

We measure visits with Cloudflare Web Analytics, which counts page views, referring sites and approximate country without setting cookies, without using local storage and without fingerprinting your device. It cannot identify you and we cannot use it to follow you between sites. Cloudflare acts as our processor for this.

If you accept analytics cookies, we also use Google Analytics to understand which pages are useful, how visitors find the site and whether they go on to contact us. Our lawful basis is your consent. Google Analytics records the pages you visit, how you arrived, your approximate location and device type, and identifies your browser with a random cookie ID; it does not store your IP address. We have switched off Google signals and advertising features, so this data is not joined to your Google account or used for adverts. Google may process the data outside the UK, including in the United States, under the UK–US data bridge. Withdrawing consent stops collection and removes the cookies.

Security

Access to production systems is restricted to named engineers, protected by multi-factor authentication and logged. Mailbox data is encrypted in transit using TLS 1.2 or better, and at rest through volume encryption. Our security arrangements are described further on our security page.

Your rights

Under UK GDPR you have the right to:

• Ask what personal data we hold about you and receive a copy.
• Ask us to correct inaccurate data.
• Ask us to delete data where we no longer have grounds to hold it.
• Object to or restrict processing based on legitimate interests.
• Receive data you provided in a portable format.

To exercise any of these, email sales@myexchangeserver.co.uk. We respond within one month. Where you are an employee of a customer and your query concerns mailbox content, we will direct you to your employer, who is the controller for that data.

You may also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113, although we would appreciate the chance to resolve it first.