Confidentiality & Privacy

IT Heritages (“IT Heritages”, “we”, “us”) is a systems integrator delivering infrastructure, cloud, cyber security, unified communications and managed services. We operate from offices in Islamabad and Lahore, Pakistan, and Coventry, United Kingdom.

This policy explains what personal data we collect, why we collect it, how we use and share it, and the rights available to you. It applies to our website, our enquiry and consultation process, and personal data we handle while delivering services to clients.

We collect the following categories of personal data:

• Enquiry data — the name, company, email address, telephone number, preferred contact method and message you submit when requesting a consultation or contacting us.
• Correspondence — records of communications between you and our team, including email, telephone and meeting notes.
• Client engagement data — contact and role information for client personnel involved in a project, together with technical documentation produced during delivery.
• Technical data — where our website records it, information such as browser type, device type, approximate location derived from IP address, and pages visited.
• Recruitment data — where you apply to work with us, the information contained in your application.

We do not seek to collect special category data (such as health, biometric or political data) through our website, and ask that you do not submit it in an enquiry.

We use personal data to:

• respond to enquiries and scope prospective engagements;
• prepare proposals, statements of work and related documentation;
• deliver, support and administer contracted services, including infrastructure, cloud, security and communications work;
• manage our contractual and commercial relationship with clients;
• maintain the security and integrity of our own systems and those we manage on behalf of clients;
• meet legal, regulatory, tax and accounting obligations; and
• improve our website and service offering, where our use of technical data allows it.

Where the UK GDPR and Data Protection Act 2018 apply to our processing, we rely on the following legal bases:

• Legitimate interests — responding to business enquiries, delivering and improving our services, and securing our systems, where those interests are not overridden by your rights.
• Performance of a contract — where processing is necessary to enter into or carry out an agreement with you or your organisation.
• Legal obligation — where we are required to retain or disclose information by law.
• Consent — where you have opted in to a specific communication. You may withdraw consent at any time.

When delivering services we frequently act as a processor on behalf of a client, handling data within systems the client controls. In those circumstances the client determines the purposes of processing and our handling is governed by the engagement contract and any applicable data processing terms, alongside this policy.

Our engineers work under confidentiality obligations. Access to client environments is granted on a least-privilege basis and limited to personnel assigned to the engagement.

We may share personal data with:

• service providers who support our operations, such as hosting, communications, and business software vendors, acting on our instructions;
• technology vendors and partners where necessary to deliver, license or support a solution you have engaged us for;
• professional advisers, including legal, insurance and accounting advisers; and
• regulators, law enforcement or other authorities where we are legally required to do so.

We do not sell personal data.

We operate in both Pakistan and the United Kingdom, and personal data may be transferred between those locations and to service providers based elsewhere. Where data originating in the UK is transferred outside the UK, we take steps to ensure an appropriate level of protection, including the use of applicable transfer mechanisms and contractual safeguards.

We keep personal data only as long as necessary for the purposes set out in this policy. Enquiry data that does not result in an engagement is held for a limited period to allow us to follow up. Client and project records are retained for the duration of the relationship and afterwards for as long as required to meet legal, contractual, tax and accounting obligations, or to resolve disputes.

We maintain technical and organisational measures appropriate to the risks presented by our processing, including access control, network and endpoint protection, monitoring, and documented delivery practice. No method of transmission or storage is completely secure, and we cannot guarantee absolute security; where we become aware of a personal data breach we will act in accordance with our legal obligations.

Subject to applicable law, you may have the right to request access to the personal data we hold about you; to have inaccurate data corrected; to request erasure; to restrict or object to processing; to request portability; and to withdraw consent where processing is based on consent.

To exercise any of these rights, contact us using the details below. We may need to verify your identity before responding. If you are in the United Kingdom and are not satisfied with our response, you may lodge a complaint with the Information Commissioner's Office.

Our website uses only the cookies necessary for it to function correctly. If we introduce analytics or marketing cookies in future, we will update this policy and, where required, request your consent before those cookies are set. Most browsers allow you to refuse or delete cookies through their settings.

Our website may link to third-party sites, including our social media profiles. We are not responsible for the privacy practices or content of those sites, and we encourage you to review their policies.

We may update this policy from time to time to reflect changes in our practices or legal obligations. The date of the most recent revision is shown at the top of this page. Material changes will be highlighted on this page.