Privacy notice
How we collect, use and protect personal data, and the rights you have.
Last updated 12 October 2026.
Who we are
Halsworth Data Services Ltd, Marchbank House, Halsworth Park, Halsworth, HW4 7QT, United Kingdom (company number 19407263) is the controller of the personal data described in this notice, except where we say that we act as a processor for our customers.
You can contact us about data protection at privacy@halsworth.uk or by post to the address above, marked for the attention of the company secretary. We are not required to appoint a data protection officer; the company secretary is responsible for data protection.
The data we collect
We collect personal data in the following ways:
- Enquiries. If you contact us by telephone, email or the form on this website, we keep your name, organisation, contact details and what you tell us.
- Customers and their contacts. For each customer we keep the names, job titles and contact details of the people we deal with, and the people nominated to approve work at each site.
- Engineers. To give an engineer an account on our access gateways we keep their name, employer, email address, telephone number and second-factor details, and a record of the sites they may access.
- Service records. Our service desk keeps tickets, work orders, approvals, call notes and the times and outcomes of sessions.
- Session recordings. Sessions through our gateways are recorded. A recording may show anything the engineer saw or typed during the session.
- Suppliers. We keep the contact details of the people we deal with at our suppliers, and the details of contractors who attend sites for us.
- Visitors to our office. We keep a visitors’ book.
This website
This website does not use cookies, analytics, advertising or tracking of any kind, and it does not load anything from other websites. Our hosting provider keeps records of requests to the website (including your IP address and browser type) for up to 30 days, for security and to keep the site running. We do not use them to identify visitors.
Pages of our service desk for staff and contractors keep one value in your browser’s session storage after you sign in. See our cookies page.
How we use it, and our lawful basis
- To reply to enquiries and prepare proposals: our legitimate interest in running our business.
- To provide our services, issue accounts, approve and record sessions, and handle faults: performance of our contract with our customer, and our and our customer’s legitimate interest in keeping equipment and networks secure.
- To keep accounting records and comply with the law: legal obligation.
- To screen staff and contractors with access to customer systems: legal obligation and legitimate interest, as explained to the people concerned before screening.
We do not use personal data for marketing to individuals, we do not sell it, and we do not make decisions about people by automated means.
When we act as a processor
When our customers ask us to record sessions, keep logs of who accessed their equipment or monitor devices on their behalf, we process that data for them under the data processing terms in our terms of business. The customer is the controller, and questions about it should go to them in the first instance.
Who we share it with
We share personal data only where we need to:
- with our customers, about the engineers who access their equipment and the sessions they hold;
- with the operators of sites where equipment is installed, about sessions affecting their site;
- with suppliers who provide services to us, such as data centres, telecommunications providers, field engineers and our professional advisers, under contracts that require them to protect it;
- where the law requires it, or to establish or defend legal claims.
International transfers
We operate in the United Kingdom and North America. Personal data about sessions on our North American gateways is held in the United States, and our staff in the United Kingdom have access to it. Where personal data is transferred out of the United Kingdom we rely on adequacy regulations or on standard contractual protections approved for the purpose. Contact us for a copy of the protections that apply.
How long we keep it
- Enquiries that do not lead to a contract: two years.
- Customer and contract records: the length of the contract and six years afterwards.
- Engineer accounts: until the account is closed, then one year.
- Session recordings: 90 days, or the longer period agreed with the customer, up to seven years.
- Service desk tickets and logs: six years.
- Accounting records: six years from the end of the financial year they relate to.
Security
We protect personal data with the controls described on our security page, including encryption in transit and at rest, named accounts, second-factor sign-in and limited access for staff.
Your rights
Under the UK GDPR and the Data Protection Act 2018 you have the right to ask for a copy of your personal data, to have it corrected, to have it erased or its use restricted in some circumstances, to object to our use of it where we rely on legitimate interests, and to have data you gave us transferred to another organisation. We will reply within one month.
To exercise any of these rights, email privacy@halsworth.uk. If you are not happy with our reply, you have the right to complain to your local data protection authority.
Changes to this notice
We will update this notice when the way we use personal data changes. The date at the top of the page shows when it was last changed.