Privacy Policy

1. Who we are

Cloud Technologies Ltd is a company registered in England and Wales under company number 12036217. For personal information we collect for our own purposes, we generally act as the data controller. We are registered with the Information Commissioner's Office (ICO) under registration reference ZB671248. Our Data Protection Officer / privacy contact is Karthick Subramanian. You can contact them at karthick.subramanian@cloudtechnologiesltd.co.uk. In some client engagements we may process personal information solely on behalf of a client, for example when supporting a website, application, CRM, marketing platform or testing environment. In those circumstances we may act as a data processor and the client remains responsible for determining the purposes and means of processing.

2. Scope of this policy

This policy applies to personal information processed through our website, enquiries, client relationships, supplier relationships, recruitment activities, marketing activities and normal business operations. It does not replace a client-specific data processing agreement or privacy notice where one applies.

3. Personal information we may collect

Identity and contact information

Enquiry, project and client information

Financial and transaction information

We do not normally store full payment card details. Card payments are generally handled by third- party payment processors under their own security and privacy arrangements.

Technical and usage information

Marketing information

Recruitment information

• Name, job title and organisation
• Business or postal address
• Email address and telephone number
• Contact preferences and correspondence history
• Information provided through contact, quotation or booking forms
• Project requirements, website URLs, briefs, specifications and business objectives
• Meeting notes, approvals, support requests and project communications
• Contracts, proposals, statements of work and account information
• Billing details, invoice information and payment status
• Transaction references and accounting records
• Limited payment-related information supplied by payment processors
• IP address and approximate location derived from it
• Browser, device and operating system information
• Pages visited, referring pages, date and time of visits
• Cookie identifiers, analytics and website interaction information
• Marketing preferences and opt-out records
• Engagement with business communications where legally permitted
• Information about services that may be relevant to a business contact
• CV, work history, education, qualifications and skills
• Interview notes and application correspondence
• Right-to-work and identity information where necessary for recruitment or onboarding
• References and other information provided as part of an application

4. How we collect personal information

• Directly from you, including by email, telephone, WhatsApp, meetings and website forms
• When you enter into or discuss a contract with us
• From our website, cookies and analytics technologies
• From publicly available business sources, professional networks and directories
• From referrals, marketing platforms and legitimate business lead-generation services
• From suppliers, contractors and professional advisers where relevant to our services

5. Why we use personal information and our lawful bases

Enquiries and pre-contract discussions

We use contact and requirement information to respond to enquiries, understand requirements, prepare quotations and arrange meetings. Our lawful basis is usually taking steps at your request before entering into a contract and/or our legitimate interests in developing and operating our business.

Providing services and managing projects

We use client and project information to deliver agreed services, manage projects, provide support, communicate progress, obtain approvals and administer client accounts. Our lawful basis is usually performance of a contract and, for business-to-business contacts who are not personally party to the contract, our legitimate interests.

Billing, accounting and legal compliance

We process financial, invoice and transaction information to bill clients, reconcile payments, keep statutory records, meet tax obligations and establish or defend legal claims. Our lawful bases may include contract, legal obligation and legitimate interests.

Website operation, security and improvement

We use technical information to operate, secure, troubleshoot and improve our website and services. Depending on the activity, our lawful basis may be legitimate interests or consent, particularly where non-essential cookies or tracking technologies are involved.

Business marketing

Where permitted by law, we may contact existing or prospective business customers about relevant services. We rely on consent where consent is required, and otherwise may rely on legitimate interests where the law permits. You can opt out of direct marketing at any time. Recruitment We process recruitment information to assess applications, communicate with candidates and make hiring decisions. Our lawful bases may include steps prior to entering into a contract, legal obligation and legitimate interests.

6. Legitimate interests

Where we rely on legitimate interests, we consider whether our use of information is necessary and proportionate and whether your rights and interests override our business interest. Typical legitimate interests include responding to business enquiries, managing business relationships,

maintaining security, preventing fraud, improving our services, keeping appropriate records and carrying out proportionate B2B marketing.

7. Cookies and similar technologies

Our website may use cookies, pixels, tags and similar technologies. Strictly necessary technologies may be used without consent where permitted. Where UK law requires consent for analytics, advertising or other non-essential technologies, we will seek consent before setting or accessing them. More information is available in our Cookie Policy and cookie preference controls.

8. Sharing personal information

We do not sell personal information. We may share information where reasonably necessary with trusted recipients such as:

• Website, hosting and cloud infrastructure providers
• Email, communications, CRM and project-management providers
• Payment processors, accounting providers and bookkeeping services
• Analytics, advertising and marketing platforms where lawfully enabled
• IT support, security, backup and software providers
• Developers, designers, testers, marketing specialists and other contractors supporting delivery
• Professional advisers such as accountants, insurers and solicitors
• Regulators, courts, law-enforcement bodies or public authorities where disclosure is required or lawful Where a supplier processes personal information for us, we seek to use appropriate contractual and security safeguards proportionate to the processing involved.

9. International transfers

Some of our personnel, contractors, suppliers or technology providers may be located outside the United Kingdom. Where personal information is transferred to a country that is not covered by a UK adequacy regulation, we will use an appropriate lawful transfer mechanism where required, such as the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another valid safeguard. We may also rely on an applicable exception where the law permits.

10. Data security

We use appropriate technical and organisational measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures may include access controls, authentication, secure hosting, backups, malware protection, confidentiality obligations and role-based permissions. No internet or electronic storage method is completely risk-free.

11. Data retention

We keep personal information only for as long as reasonably necessary for the purposes for which it was collected, including legal, contractual, tax and accounting requirements. Indicative periods include:

• General enquiries that do not become clients: normally up to 24 months
• Client/project records and commercial correspondence: normally up to 6 years after the relationship ends, subject to legal requirements
• Invoices, accounting and tax records: retained for the period required by applicable law
• Recruitment applications: normally up to 12 months after the recruitment process unless a longer period is justified or agreed
• Marketing records: until you opt out, object or the information is no longer reasonably required, while retaining a minimal suppression record where necessary to respect an opt-out We may keep information longer where required to establish, exercise or defend legal claims or comply with a legal obligation.

12. Your data protection rights

Depending on the circumstances, you may have the right to:

To exercise a right, contact karthick.subramanian@cloudtechnologiesltd.co.uk. We may need to verify your identity before acting on a request. Rights are subject to statutory conditions and exemptions.

• Ask for access to your personal information
• Ask us to correct inaccurate or incomplete information
• Ask us to erase personal information in certain circumstances
• Ask us to restrict processing in certain circumstances
• Object to processing based on legitimate interests
• Object at any time to direct marketing
• Receive certain information in a portable format where the right to data portability applies
• Withdraw consent at any time where processing is based on consent
• Complain to the Information Commissioner's Office

13. Automated decision-making

We do not ordinarily make decisions about individuals solely through automated processing that produce legal or similarly significant effects. If this changes, we will provide the information and safeguards required by law.

14. Children

Our website and commercial services are primarily directed at businesses and adults. We do not knowingly use our website to collect personal information directly from children for marketing. If you believe a child has provided personal information to us inappropriately, please contact us.

15. Third-party websites

Our website may contain links to third-party websites or services. We are not responsible for the privacy practices or content of third parties. We recommend reviewing their privacy notices before providing personal information.

16. Complaints

Please contact our privacy contact first at karthick.subramanian@cloudtechnologiesltd.co.uk if you have a concern. You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection. The ICO website is www.ico.org.uk.

17. Changes to this Privacy Policy

We may update this policy from time to time to reflect changes in our business, services, technology or legal obligations. The latest version will be published on our website with its revision date.

18. Contact us

Privacy contact / Data Protection Officer: Karthick Subramanian

Email: karthick.subramanian@cloudtechnologiesltd.co.uk

General email: contact@cloudtechnologiesltd.co.uk

Address: 174, 1st Floor, The Type Building, Sugar House Island, Spaces London, England, E15 2TP

ICO registration reference: ZB671248