First Technology
Privacy Notice
Last updated:
1. Who we are
First Technology Holdings Ltd (company number 13712088), trading as First Technology, is the data controller for the personal data described in this notice. Our registered office is 23D Horseshoe Park, Pangbourne, Reading, RG8 7JW. We are registered with the Information Commissioner's Office (ICO).
This notice explains how we collect and use personal data about our customers, prospective customers, suppliers, website visitors and people who contact us. It does not cover personal data about our own staff, job applicants and contractors, which is explained to them separately, or personal data we process on behalf of our customers when delivering managed IT services. In that case our customer is the controller, and we process the data only on their documented instructions under a data processing agreement.
Our data protection lead is the Head of Group Risk and Compliance. You can contact them at privacy@first-technology.co.uk or by post at the address above.
2. Personal data we collect
We collect personal data you give us, and data generated when you use our services or website.
- Contact data: name, job title, employer, business email, phone number and address
- Account and order data: products and services ordered, contracts, invoices and payment records
- Communication data: emails, calls, support tickets and chat messages between us
- Technical data: IP address, device and browser details, and website usage collected through cookies
- Marketing data: marketing preferences, opt-out records, event attendance and survey responses
- Supplier data: contact details of people at our suppliers and partners
We mainly get this data from you directly. We may also receive business contact details from your employer, our distributors and partners, event organisers, lead-generation providers and public sources such as Companies House and LinkedIn.
We do not intentionally collect special category data (such as health data) about customers or contacts.
3. Why we use your data and our lawful basis
We only use personal data where we have a lawful basis under Article 6 of the UK GDPR.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Providing, supporting and billing for our products and services | Contact, account and order, communication | Performance of a contract |
| Responding to enquiries and preparing quotes | Contact, communication | Steps prior to a contract; legitimate interests |
| Bookkeeping, tax and regulatory records | Account and order | Legal obligation |
| Managing our suppliers and partners | Supplier, communication | Performance of a contract; legitimate interests |
| Handling complaints, disputes and claims | Contact, account and order, communication | Legitimate interests; legal obligation |
| Keeping our systems and website secure | Technical | Legitimate interests |
| Improving our services and analysing usage | Technical, account and order (aggregated where possible) | Legitimate interests |
| Marketing to business contacts, including existing and prospective customers | Contact, marketing | Legitimate interests |
| Website cookies that are not strictly necessary | Technical | Consent (our updated cookie banner is being introduced) |
Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights. You can ask us for details of that assessment.
4. Marketing
We send marketing by email, and by telephone to business contacts, about products, services and events that we think are relevant to your organisation.
- Legitimate interests. We rely on legitimate interests for all of our marketing, and we do not rely on consent for it. Our marketing is directed at business contacts, including existing and prospective customers. You can object at any time.
- Sole traders and some partnerships. Under the Privacy and Electronic Communications Regulations (PECR) these are treated as individuals for email marketing, so we do not email them unless they are existing customers buying similar products or services.
- Telephone. The law requires us to check marketing call lists against the Telephone Preference Service (TPS) and Corporate TPS, and not to call registered numbers unless the person has consented.
- Lead-generation providers. We may use a lead-generation provider, acting on our instructions, to run campaigns using contact details held in our CRM system. The provider may use that data only for our campaigns.
- Opting out. Every marketing email includes a way to opt out. You can also email privacy@first-technology.co.uk. We record your objection on your contact record and do not contact you again for marketing.
We may use business contact details in hashed form to show adverts on platforms such as LinkedIn. You can object to this at any time.
5. Who we share your data with
We do not sell personal data. We share it only where needed for the purposes above, with:
- Other companies within the First Technology Group that help deliver or support our services
- Service providers acting on our instructions, such as Microsoft (Microsoft 365 and Azure), our CRM and accounting provider, payroll provider, website host and analytics provider, and lead-generation and campaign providers
- Distributors and vendors such as Westcoast and Ingram Micro, where needed to fulfil your order or register licences
- Professional advisers such as our auditors, lawyers and insurers
- Authorities such as HMRC, the ICO or the police, where the law requires it
We require service providers who handle personal data on our behalf to protect it and to use it only on our instructions.
International transfers
Some group companies and service providers are based outside the UK, including in South Africa, Ireland and the EU and, for some providers such as Microsoft, the United States. Where we transfer personal data to a country without UK adequacy regulations, we use the safeguards that UK law requires, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment. Transfers to the EEA rely on UK adequacy regulations. Transfers to US providers certified under the UK Extension to the EU-US Data Privacy Framework rely on that framework. You can ask us for a copy of the relevant safeguards.
6. How long we keep your data
We keep personal data only as long as we need it for the purposes above. Where we cannot give a fixed period, the table explains how we decide how long to keep it. We are introducing a regular review of our CRM data so that we delete or anonymise data we no longer need. We may keep data longer where we need it for a legal claim or to meet a legal obligation.
| Data | How long we keep it |
|---|---|
| Customer contracts, orders, invoices and payment records | 6 years after the end of the financial year they relate to |
| Complaints, disputes and claims | 6 years after the matter closes |
| Contact data for customers, prospects and suppliers, including CRM and marketing contacts | While it remains relevant to our dealings with you or your organisation. We are introducing a regular review so that contacts with no recent activity are removed |
| Support tickets and service communications | For as long as needed to support the service and deal with any follow-up |
| Marketing opt-out record | Kept on your contact record so we can honour your opt-out |
Where data is anonymised so it can no longer identify you, we may keep it for statistics and service improvement.
7. How we protect your data
We apply the First Technology Group Information Security Standards across all our systems. Measures include multi-factor authentication for all users, encryption of data at rest and in transit, managed and encrypted devices, endpoint detection and response, next-generation firewalls, email filtering, immutable offsite backups and 24/7 monitoring by a security operations centre.
Access to personal data is limited to staff who need it for their role.
If a personal data breach is likely to put your rights at risk, we will report it to the ICO within 72 hours and tell you without undue delay where required.
8. Your rights
Under UK data protection law you have the right to:
- Access a copy of the personal data we hold about you
- Rectification of data that is inaccurate or incomplete
- Erasure of your data where we no longer have a reason to keep it
- Restrict our use of your data in certain circumstances
- Data portability, to receive data you gave us in a machine-readable format or have it sent to another organisation
- Object to processing based on legitimate interests, and to direct marketing at any time
- Not be subject to decisions based solely on automated processing that significantly affect you. We do not make such decisions.
- Withdraw consent at any time, where we rely on consent (for example for non-essential cookies)
How to make a request
Email privacy@first-technology.co.uk or write to us at the address in section 1. We may ask you to confirm your identity. We will respond within one month, free of charge. If a request is complex we may extend this by up to two further months, and we will tell you why.
Complaints
If you are unhappy with how we have handled your data, please contact us first so we can try to resolve it. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
9. Cookies
Cookies are small files stored on your device when you visit our website.
Strictly necessary cookies make the website work and are always on. We also use analytics cookies, including Google Analytics, to understand how the site is used and to improve it.
You can block or delete cookies at any time in your browser settings, and you can opt out of Google Analytics using Google's browser opt-out add-on. We are updating our cookie banner so that you can choose which non-essential cookies are set and see how long each lasts.
10. Social media
We run pages on platforms such as LinkedIn. When you interact with them, we receive what you share with us and anonymised statistics from the platform. We are joint controllers with the platform for those statistics. Your use of the platform is also covered by its own privacy policy.
11. Changes to this notice
We review this notice at least once a year and will post any changes on our website. This version was last updated in October 2026.
12. Contact us
For any question about this notice or to exercise your rights, contact our data protection lead at privacy@first-technology.co.uk or write to First Technology Holdings Ltd, 23D Horseshoe Park, Pangbourne, Reading, RG8 7JW.
