How we look after your personal data

1. Introduction

Go Strategic ("we", "our", or "us") is an independent IT consultancy based in the UK. This Privacy Policy explains how we collect, use, share and protect personal data when you visit our website, use our free tools, contact us or work with us. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data controller

Go Strategic is a trading name of M. Chung and is the data controller responsible for your personal data. If you have any questions about this Privacy Policy or our data practices, please contact us using the details provided at the end of this policy.

3. Information we collect

We may collect information about you in a variety of ways, including:

• Personal data: Name, email address, phone number, job title, company name, and other contact information you provide when contacting us or using our services.
• Usage data: Technical information our hosting and security providers record when you visit, such as your IP address, browser type, device and operating system, referring URL and the pages requested. We also use cookie-free analytics to count visits and measure page speed (see section 6). We don't use advertising tracking.
• Business information: Details about your company, IT infrastructure, and business requirements that you share with us for consultancy purposes.
• Communication data: Records of correspondence, including emails, contact form submissions and any feedback you provide, and, only with your agreement, recordings or transcripts of calls and online meetings.
• Billing information: The name, email address and postal address of your billing contact, and records of the invoices we send and the payments we receive.

Most of this comes from you directly. Some may come from elsewhere: for example, when a client gives us the names and contact details of colleagues we'll work with, or from public sources such as LinkedIn or Companies House.

You don't have to give us personal data, but without it we may not be able to reply to you or provide our services.

4. Legal basis for processing

We process your personal data on the following legal bases:

• Consent: For marketing emails, where we've asked for your consent. You can withdraw it at any time.
• Contractual necessity: To provide the services you've asked for, or to take steps at your request before we agree them, such as preparing a proposal or estimate.
• Legal obligation: To keep financial and tax records, and to meet other legal or regulatory requirements.
• Legitimate interests: To reply to enquiries, keep our website secure and working, understand how it's used so we can improve it, run our business, recover unpaid invoices, and establish or defend legal claims, provided your rights and interests don't override ours.

5. How we use your information

We use the information we collect to:

• Provide, operate, and maintain our IT consultancy services
• Respond to your enquiries and provide customer support
• Improve our website and services based on your feedback
• Communicate with you about projects, services, and updates
• Send you marketing communications (with your consent)
• Detect, prevent, and address technical issues or security threats
• Register and renew domain names on your behalf, where you've asked us to
• Keep financial records and comply with our legal obligations
• Enforce our Terms of Use and client agreements

When we work in your systems, such as your Microsoft 365 environment, we may be able to see personal data about your staff or customers. We only use it to carry out the work you've asked for, following your instructions and our written agreement with you. Your organisation remains responsible for that data, and we act as its processor.

6. Cookies and tracking technologies

Our website uses a small number of cookies and similar browser storage. We don't use analytics or advertising cookies. The types we use are:

• Essential cookies: Necessary for the website to work securely and cannot be disabled.
• Functional storage: Remembers choices you make, such as your cookie preference, and makes features like the message form work.

Because these are needed for the website to work, the law doesn't require your consent for them. When you first visit, a short notice tells you about them, and closing it simply stops it appearing again. You can block or delete cookies in your browser settings at any time, but parts of the website, such as the message form, may then not work.

7. Data sharing and third parties

We may share your information with:

• Service providers: Companies that help us run our business and website, such as our email, invoicing and accounting, website hosting, security and analytics, message form and client portal providers. They handle your data only on our instructions and must keep it secure and confidential.
• Subcontractors: Trusted subcontractors who help us carry out work for clients. They handle your data only on our instructions and must keep it secure and confidential.
• Domain registrars and registries: When we register or renew a domain name for you, we pass the registrant's details to the registrar and the registry for that domain ending, as their rules require. Some details may appear in public domain records, depending on the domain and the privacy options available.
• Professional advisers: Lawyers, accountants, insurers, debt recovery agents and other professional advisers as required.
• Legal requirements: When required by law, regulation, or legal process.
• Business transfers: In connection with a merger, acquisition, or sale of assets.

Our message form is provided by a third-party form provider. When you send a message through it, your name, email address and message are passed to that provider so they can be delivered to us. The provider may store information in your browser to make the form work.

Our free tools run in your browser. To read a domain's public DNS records, the email security check sends the domain name from your browser to a public DNS service. Where the domain publishes them, your browser also contacts the domain's own servers, to check its MTA-STS policy host and show its BIMI logo. The Cyber Essentials readiness check doesn't send your answers anywhere. If you download a PDF report from either tool, it's made in your browser and saved straight to your device. We don't receive or store the domains you check, the answers you give or your reports, unless you choose to email us your results, in which case we handle them like any other message.

We do not sell, trade, or otherwise transfer your personal information to outside parties for marketing purposes without your explicit consent.

8. International data transfers

Some of our service providers store or process data outside the UK. Where they do, we make sure it's protected to UK standards: either the country is recognised by the UK as having adequate data protection, or the transfer is covered by approved safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

9. Data retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements. The retention period may vary depending on the context of the processing and our legal obligations. When personal data is no longer required, we will securely delete or anonymise it.

10. Data security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These include encryption, multi-factor authentication and access controls. However, no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

11. Your rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete personal data.
• Right to erasure: Request deletion of your personal data in certain circumstances.
• Right to restrict processing: Request limitation of processing of your personal data.
• Right to data portability: Request transfer of your data to another organisation in a structured, commonly used format.
• Right to object: Object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: Withdraw consent at any time where processing is based on consent.

We don't make decisions about you based solely on automated processing.

To exercise any of these rights, please contact us using the details below. We will respond to your request within one month.

12. Third-party links

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of these external sites. We encourage you to review the privacy policies of any third-party websites you visit.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will notify you of any material changes by posting the updated policy on this page with a revised "Last updated" date. We encourage you to review this Privacy Policy periodically.

14. Complaints

If you are unhappy with how we have handled your personal data, please tell us first using the details in section 15. We will acknowledge your complaint within 30 days, look into it without undue delay and tell you the outcome.

If you are still not satisfied, you have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection. You can contact the ICO at ico.org.uk or through their helpline.

15. Contact us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Email: hello@gostrategic.co.uk