General Data Protection Regulation 2018

Introduction

This document lays out what systems and information ICT Solved use to help support an individual and/or company / organisation and how ICT Solved handle your information which can be of a sensitive nature and of commercial confidence.

The services listed below are provided by ICT Solved and the suppliers we use. However if you purchase services such as web hosting, Office365 and anti-virus direct but still would like us to administer or provide support on your behalf, we administer the same procedures and confidentiality with your systems, data, suppliers and customers.

Terms of Reference

ICT Solved - This includes any staff that are employed by ICT Solved directly, by association or on a contractual basis.

Data Controller / Data Protection Officer for ICT Solved - John Crofts.

an individual and/or company / organisation - This includes any staff that are employed by an individual and/or company / organisation directly, by association or on a contractual basis.

Computer System - This can refer to any on premise or cloud based computer system. Although not exhaustive, the term Computer System also includes your Network Infrastructure, Routers, Switches, Desktop Computers, Servers, Laptop Computers, Tablets, Phone System, Mobile Phones, Printers, Databases, Documents, EMails and any other form of Data etc.

256-bit Encryption - 256-bit encryption refers to the length of the encryption key used to encrypt a data stream or file. A hacker or cracker will require 2²⁵⁶ different combinations to break a 256-bit encrypted message, which is virtually impossible to be broken by even the fastest computers. Typically, 256-bit encryption is used for data in transit, or data traveling over a network or Internet connection. However, it is also implemented for sensitive and important data such as financial, military or government owned data. Description provided by Techopedia.

Backups

Should you use our external backup service, all information is handled by Solarwinds MSP.

Data backed up from your computer(s) or server(s) is stored on Solarwinds MSP servers and is password protected along with an additional security code only known to ICT Solved. Your data whether cloud or server based is backed up to Solarwinds MSP servers based in the UK to maintain your GDPR compliance. Whilst data is in transit being backed up from your system to Solarwinds MSP servers, 256-bit encryption is used to help prevent intrusion and loss of data. ICT Solved does not hold any of your backed up data through this process.

If you require more information on this from Solarwinds MSP, please read their privacy policy which can be found at https://www.solarwindsmsp.com/legal/privacy. The only information ICT Solved pass on to Solarwinds is your company name and the type of device that is being backed up.

Solarwinds MSP backup systems will also access your device(s) in order to perform your required backup. Solarwinds have no access to your systems other than backup. The usernames and passwords required are entered securely by ICT Solved and cannot be read by Solarwinds MSP staff.

The data that is backed up is based on your agreement with ICT Solved. By default the last 3 versions of your data will be kept for a maximum of 28 days from the point in time it was backed up. The data is retained for as long as your subscription continues to be paid to ICT Solved.

ICT Solved may access the data from time to time to ensure backups are occurring and to restore data to your computer system when necessary. This is done over the internet via an encrypted website hosted by Solarwinds MSP. When restores are performed a few documents may be accessed at random to ensure the restore has gone as planned and documents can be accessed and read again by an individual and/or company / organisation.

ICT Solved also uses Solarwinds MSP monitoring software to ensure your computer(s) or/and server(s) are being backed up. Monitoring reports that are held with Solarwinds MSP are deleted as soon as items arising have been dealt with.

Where internal backups are performed and we carry out support on your behalf for this service, we will check the backup to ensure it is running correctly from time to time. We will also access the backup and restore files if required. We will then access a few files at random to ensure an individual and/or company / organisation can access and read the files.

Anti-Virus & Firewall Protection

We use both Avast Software (formerly AVG Technologies) and/or BitDefender to help protect your computer network from virus's and intruders. Each of your computer(s) and server(s) where the respective software packages are installed monitor your computer(s) whilst they are switched on. They monitor the network traffic (including internet) that flow to and from your computer to ensure what's being transmitted is safe and to help secure your data from any potential threats or attacks. Existing data that is stored on your computer will only be scanned for viruses through a manual intervention that ICT Solved may instigate should a problem arise with your computer.

Avast and BitDefender monitors your computers so any problems that should arise are reported directly to ICT Solved and to keep your anti-virus and firewall products up to date. Any monitoring reports are deleted on a regular basis as soon as any items arising are dealt with.

If you require more information on this from Avast, please read their privacy policy which can be found at https://www.avast.com/en-gb/privacy-policy.

If you require more information on this from Bitdefender, please read their privacy policy which can be found at https://www.bitdefender.co.uk/site/view/legal-privacy.html.

Virtual Private Networks (VPNs)

Sometimes we may install a VPN solution to connect a computer system at one physical location to another physical location by way of the internet. To provide this secure service we currently use LogMeIn. An email address that resides within your company will be used to register your account, however, you will be notified of this should you have a VPN installed.

Please be aware that once a VPN is active, this provides a secure 256-bit encrypted connection to help protect your data.

From time to time ICT Solved may access your VPN configuration for support purposes.

For more information on LogMeIn's privacy policy please visit https://www.logmeininc.com/legal/privacy.

No data is retained by ICT Solved with regards to VPNs.

Temporary Data Backup and Computer Recovery / Rebuild

Should you ever require a computer repairing, re-building or software re-configuration, we will perform backups to another hard disk drive to prevent data loss in case anything goes wrong! This can take the form of an external hard disk drive, computer or server.

If data is backed up on site, it will be under an individual and/or company / organisation existing security arrangements. If any data is backed up to ICT Solved's computer system, it will be transported over 256-bit encrption to computers with anti-virus protection, firewall protection, password protection and 256-bit hard disk encryption to ensure security at all times. Alternatively it may be backed up to 256-bit encrpyted external hard drives. If backed up to ICT Solved's computer system the data will be kept for up to two months in case any data from the backup is required for recovery purposes.

Any data we have is never left in transport unattended! Any physical equipment left on our premises is stored out of sight and premises are alarmed when unattended.

User Support

One of our primary functions is to provide end user support to an individual and/or company / organisation. We will contact staff directly either by face to face, by phone, text, email or remote access to help provide support.

We are aware that we may be privy to sensitive and confidential information whilst providing support, this will be kept confidential and will not be used in any manner under any circumstances by ICT Solved. On occasion ICT Solved may report findings to the management of an individual and/or company / organisation should we need to raise any concerns through our support work.

Should we access a computer via remote access, our systems are always password protected and use 256-bit encryption when connected.

If data is backed up on site, it will be under an individual and/or company / organisation existing security arrangements. If any data is backed up to ICT Solved's computer system, it will be transported over 256-bit encrption to computers with anti-virus protection, firewall protection, password protection and 256-bit hard disk encryption to ensure security at all times. Alternatively it may be backed up to 256-bit encrpyted external hard drives. If backed up to ICT Solved's computer system the data will be kept for up to two months in case any data from the backup is required for recovery purposes.

Systems Support

When required we may log on to your systems to provide additional support to keep your computer systems running efficiently. This will be done if there is a support agreement in place between an individual and/or company / organisation and ICT Solved. Alternatively, this will be done by a pre-arranged agreement via a request that can take the form of a phone call or email.

To provide appropriate system support we will require access to all areas of your computer systems at an administrator level. This includes on premises and cloud systems. Any credentials we hold for an individual and/or company / organisation are not written down anywhere. Nor are they divulged to any other party without prior written consent from yourself.

On occasion to help with this activity we will use 3rd party software that scans files to ensure computers are clean from Malware and delete any temporary or malicious files. This software is removed once any scans are complete. Unless there is a specific issue with a document or testing software we will not access any email, database or files.

If data is backed up on site, it will be under an individual and/or company / organisation existing security arrangements. If any data is backed up to ICT Solved's computer system, it will be transported over 256-bit encrption to computers with anti-virus protection, firewall protection, password protection amd 256-bit hard disk encryption to ensure security at all times. Alternatively it may be backed up to 256-bit encrpyted external hard drives. If backed up to ICT Solved's computer system the data will be kept for up to two months in case any data from the backup is required for recovery purposes.

Domain Hosting / Website Hosting / Web Development

ICT Solved provide a range of web services including domain registration, domain hostin and website hosting.

The domain registration allows you use of your domain which is your web address and email address ie.
           www.ict-solved.co.uk
           another@ict-solved.co.uk

Domain hosting controls where your website is maintained and accessed and also how your emails are routed to their destination, both incoming and outgoing.

To help administer your domain and website, ICT Solved have full access to your domain and if hosted with ICT Solved, your website.

If ICT Solved have developed your website we will keep a copy of your website on our secure encrypted drives as a backup and to assist with any future developments to your website. On occasion a database may be incorporated into your website. We will access the structure and information within the database to ensure continued integrity, to assist with any end user problems and for testing when developing or fixing bugs.

To provide this range of services we primarily use Names.co.uk. If you require further details on how Names.co.uk handle your data, their privacy policy can be found at https://www.names.co.uk/info/terms/privacy-policy.

We will keep your website files for as long as you have your website hosted or/and developed with ICT Solved. Should you decide to use another provider to host your website we will send a copy of all website files to yourself and delete the backup copy 2 months thereafter.

Cloud Services (Microsoft 365)

Our preferred solution provider for cloud services is Microsoft. This covers services such as Email, SharePoint and OneDrive for communications and file storage. It also includes the supply of software applications such as Word, Excel, PowerPoint, Access, Publisher, OneNote, Outlook and Skype for Business. ICT Solved partner with another organisation who provide all the Microsoft services on our behalf including support. It is also the same organisation ICT Solved partner with in order for you to get these services at below retail prices.

ICT Solved along with the partner organisation have Administrator access to your cloud portal to help support your cloud experience. As administrators we do not have access to emails, SharePoint or OneDrive files. As administrators we do have access to individual's names and email addresses who have a user account as a minimum. If users/staff add more information about themselves we will be able to view this information too.

Due to commercial confidence the partner organisation or Microsoft will never access your account unless instructed by ICT solved due to an issue with your services.

ICT Solved never divulge any information regarding an individual and/or company / organisation to any 3rd party other than our partner organisation and only then in relation to a current support issue.

ICT Solved will access the cloud portal from time to time to administer cloud services and provide support on behalf of an individual and/or company / organisation.

If ICT Solved need to sort specific user problems we may ask for your users/staff password so we can access emails and/or files in order to resolve your issues. Your users/staff passwords are never divulged to any 3rd party including our partner organisation and Microsoft.

The data contained and the retention and archive policies setup within your portal does not come under the jurisdiction of ICT Solved, this is solely a business matter for an individual and/or company / organisation.

ICT Solved will only have access to the portal for as long as you continue to pay your subscriptions for this service or require us to provide support on your behalf if you pay the subscriptions to another provider.

3rd Party Information

Your IT infrastructure will involve other companies besides ICT Solved. In order to help support an individual and/or company / organisation there may be times when we need to communicate with other companies on your behalf. Communications with 3rd parties will involve discussing your business to help provide support. These companies can include telecoms / broadband providers, software providers, database providers, website and email providers and warranty companies.

An example of this would be our partner company who provides the licensing for Microsoft Office 365 on our behalf.

Limitation of Liability

As ICT Solved procure Computer Systems on your behalf in good faith, ICT Solved will not be held liable for a loss, compromise, corruption of computer system/data or negligence caused by a 3rd party supplier or directly by an individual and/or company / organisation or degradation/performance of systems due to age. Examples of this is Microsoft 365 who provide software and cloud file storage, Avast who access your computer systems to help prevent viruses and intrutions and hardware failure such as faulty disk drives.

Administration

We hold your company name, employee / associate / contractor names along with associated phone numbers and email address to assist with our accounts and providing a business service to an individual and/or company / organisation. We will use this information to contact an individual and/or company / organisation by landline/mobile phone, text, email or post. This information is stored on our internal database and in the cloud. Our computers are secured by physical and software firewalls, anti-virus, password protection, 256-bit encryption in transit and at rest. Our cloud services are provided by Microsoft 365 and these are also protected using firewalls, anti-virus, passwords, 256-bit encryption both at rest and in transit and physically stored in secure data centres. We also have your contact details duplicated on our mobile phone(s), these are pin code protected. From time to time we will send out information with regards to offers, news and products that will help support or enhance your business. We will not divulge any information to any 3rd party. Where you have provided a testimonial to ICT Solved, your organisation and name may be displayed on our Website for marketing purposes only.

We retain records as described in the above paragraph for 6 years as required for tax and accounting purposes by HMRC.

Last reviewed April 2020.

End of GDPR Statement