1. Introduction

Superfast IT is committed to protecting personal data and ensuring all processing activities comply with UK GDPR and the Data Protection Act 2018. This document provides a high level overview of how we protect personal data when delivering our services.

This summary is intended for assurance purposes and complements the detailed Data Processing Agreement (DPA), which governs the legal responsibilities between Superfast IT and its clients.

2. Roles and Responsibilities

Client as Data Controller

The Client determines the purposes and means of processing personal data held within their systems and services.

Superfast IT as Data Processor

When delivering managed services, Superfast IT processes personal data only:

• under the Client’s documented instructions
• as required to provide the contracted services
• in accordance with the DPA
• in compliance with applicable legislation

Superfast IT does not process personal data for its own purposes.

3. Types of Personal Data Processed

Depending on the services provided, Superfast IT may process:

• employee names and contact details
• authentication details and identity data
• device and system identifiers
• access logs and audit trails
• customer or supplier contact information (where included in systems managed)