As your IT provider we can reach your email, files, devices and backups. This page explains, in plain English, how we look after that access and the data behind it. It sits alongside our Privacy Policy.
Our role
When we support your systems we act as a data processor under UK GDPR. You remain the data controller for the personal data in your systems, and we only access or change it on your instructions and as needed to do the work you have asked for. We are happy to sign a data processing agreement with you.
Who can access your systems
- Only PC Support Midlands staff who need to, for the work in hand. We are a small team and we do not use subcontractors to access client systems without telling you first.
- Every PC Support Midlands account is protected by multi-factor authentication.
- In Microsoft 365 tenants we manage, we use dedicated admin accounts kept separate from everyday user accounts, plus a locked-away emergency account that is never used day to day.
- We review admin access as part of our Microsoft 365 security baseline and remove what is no longer needed.
Tools we use to support you
These suppliers may process data as part of the services we provide. Which ones apply depends on the services you take.
- Microsoft 365: our own email, files and Teams.
- Atera: remote monitoring and patching for managed devices.
- Splashtop SOS: remote support sessions, which you start and can end at any time.
- ThreatDown (by Malwarebytes): endpoint protection on managed devices.
- Cove Data Protection (N-able): backup of Microsoft 365 and servers, for clients who take our backup service.
- DrayTek VigorACS: central management of office routers, for clients whose routers we manage.
- Our customer management system: client contacts, support history and project records, hosted in the European Union.
- Anthropic (Claude): AI assistance, under the terms set out on How We Use AI.
How we keep your data safe
- Encrypted connections for remote access and administration.
- Our own devices are kept patched, protected and encrypted.
- We work to written procedures for common jobs, so changes are made the same careful way each time and recorded.
- We only copy client data out of your systems when the job requires it, and delete our copy when the job is done.
If something goes wrong
If we become aware of a breach affecting your data, we will tell you without undue delay, explain what we know, and help you decide whether it needs reporting to the ICO or to the people affected.
When our service ends
At the end of our agreement we will hand back admin access, return any of your data we hold (such as backups) if you want it, and then delete our copies, except where the law requires us to keep records.
Questions
If you need more detail for a supplier questionnaire or audit, email sales@supportmidlands.co.uk and we will help.