Privacy Policy

How we collect, use, store, and protect your personal data. Your privacy matters to us — this policy explains your rights and our obligations under UK data protection law.

Last updated: 8 March 2026

1. Introduction

SinonTech Ltd ("Company", "we", "us", "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect personal data when you visit our website (sinontech.co.uk), use our client portal, engage our managed IT services, or interact with us in any other way.

SinonTech Ltd is the data controller for the personal data described in this policy. We are registered in England and Wales.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. What Data We Collect

We may collect and process the following categories of personal data:

Contact and Enquiry Data

When you contact us via our website, email, or phone, we may collect your name, email address, phone number, company name, and the content of your enquiry.

Client Account Data

When you become a client, we collect your name, email address, company name, business address, phone number, and billing information necessary to provide our services and manage your account.

Client Portal Data

If you use our client portal (Lodge), we store your login credentials (username and securely hashed password), session data, and records of quotes, invoices, and product licences associated with your account.

Website Usage Data

We may collect technical information about your visits to our website, including your IP address, browser type and version, operating system, referral source, pages visited, and duration of visit. This data is collected through cookies and similar technologies as described in our Cookie Policy.

3. How We Use Your Data

We use personal data for the following purposes:

To provide our services — delivering managed IT services, processing quotes and invoices, managing client accounts, and providing technical support.
To respond to enquiries — answering questions submitted via our website, email, or phone.
To manage client portal access — authenticating users, maintaining session security, and displaying relevant account information.
To send relevant communications — service updates, security advisories, and important information related to your engagement with us. We do not send unsolicited marketing emails.
To improve our website — analysing usage patterns to enhance user experience, fix issues, and improve content.
To comply with legal obligations — maintaining records as required by tax, accounting, and regulatory requirements.

4. Legal Basis for Processing

We process personal data on the following legal bases under UK GDPR:

Contract performance (Article 6(1)(b)) — Processing necessary to fulfil our contractual obligations to you, including providing services, managing your account, and processing payments.
Legitimate interests (Article 6(1)(f)) — Processing necessary for our legitimate business interests, including website analytics, improving our services, and protecting our systems from security threats. We balance these interests against your rights and freedoms.
Consent (Article 6(1)(a)) — Where you have given specific consent for processing, such as subscribing to communications. You may withdraw consent at any time.
Legal obligation (Article 6(1)(c)) — Processing necessary to comply with legal obligations, such as maintaining financial records for HMRC.

5. Data Sharing

We do not sell, rent, or trade your personal data to any third party.

We may share your personal data with the following categories of recipients, only where necessary:

Hosting providers — Our website and client portal are hosted on infrastructure within the United Kingdom. Your data does not leave UK jurisdiction.
Payment processors — If you make payments to us, your payment information is processed by our payment provider in accordance with PCI DSS requirements. We do not store full payment card details.
Professional advisors — Our accountants and legal advisors, where necessary, under appropriate confidentiality obligations.
Law enforcement — Where required by law or in response to a valid legal request.

We do not transfer personal data outside the United Kingdom or European Economic Area (EEA) unless adequate safeguards are in place, such as Standard Contractual Clauses approved by the Information Commissioner's Office (ICO).

6. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected:

Client account data — Retained for the duration of the client relationship plus 6 years, as required by UK tax and accounting regulations.
Enquiry data — Retained for up to 2 years from the date of your last interaction with us, after which it is securely deleted.
Website analytics data — Retained for up to 26 months.
Client portal data — Retained for the duration of the client relationship. Upon termination, data is retained for 30 days to allow for retrieval, then securely deleted.
Financial records — Retained for 6 years as required by HMRC.

When personal data is no longer required, it is securely deleted or anonymised.

7. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

Right of Access

You have the right to request a copy of the personal data we hold about you (a "Subject Access Request").

Right to Rectification

You have the right to request that we correct any inaccurate or incomplete personal data we hold about you.

Right to Erasure

You have the right to request that we delete your personal data, subject to legal retention requirements.

Right to Restriction

You have the right to request that we restrict the processing of your personal data in certain circumstances.

Right to Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format.

Right to Object

You have the right to object to processing based on legitimate interests or for direct marketing purposes.

To exercise any of these rights, please contact us at info@sinontech.co.uk. We will respond to your request within one month. If you have given consent for any specific processing, you may withdraw that consent at any time.

8. Security

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it, including:

Encryption of data in transit (TLS/HTTPS) and at rest where appropriate.
Secure password hashing using industry-standard algorithms (bcrypt).
CSRF protection and session management with secure, HTTP-only cookies.
Role-based access controls — only authorised personnel can access personal data.
Regular security reviews and updates to our systems and processes.
Server-side input validation to prevent injection and cross-site scripting attacks.

While we take all reasonable steps to protect your data, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security but are committed to continuous improvement of our security practices.

9. Self-Hosted Products

Our security software products (Umbra SIEM, SinonSentinel, SecureMinds AI, SinonForge, SinonStore, and SinonMeet) are designed to run entirely on infrastructure controlled by the Client.

When you deploy our Products on your own infrastructure, SinonTech does not process, access, or have any visibility of the data stored within those Products.

In this scenario, you (the Client) are the data controller for all data processed within the Products. SinonTech has no role as a data processor for self-hosted deployments unless you explicitly grant us access for support purposes, in which case a Data Processing Agreement will apply.

This is a core principle of our approach to data sovereignty: your data stays on your infrastructure, under your control, at all times.

10. Children

Our Website, Services, and Products are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child without appropriate parental consent, we will take steps to delete that data promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Any changes will be posted on this page with an updated "Last updated" date.

We encourage you to review this policy periodically. For significant changes, we may notify existing clients directly.

12. Contact and Complaints

If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or have a complaint about how we handle your data, please contact us:

SinonTech Ltd

Email: info@sinontech.co.uk

Phone: 0141 536 0433

Website: sinontech.co.uk

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office

Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Website: ico.org.uk

Helpline: 0303 123 1113

Questions About Your Data?

If you have any concerns about how we handle your personal data, we are here to help.

Phone: 0141 536 0433

Email: info@sinontech.co.uk