1. Introduction

Superfast IT is committed to protecting personal data and ensuring all processing activities comply with UK GDPR and the Data Protection Act 2018. This document provides a high level overview of how we protect personal data when delivering our services.

This summary is intended for assurance purposes and complements the detailed Data Processing Agreement (DPA), which governs the legal responsibilities between Superfast IT and its clients.

2. Roles and Responsibilities

Client as Data Controller

The Client determines the purposes and means of processing personal data held within their systems and services.

Superfast IT as Data Processor

When delivering managed services, Superfast IT processes personal data only:

• under the Client’s documented instructions
• as required to provide the contracted services
• in accordance with the DPA
• in compliance with applicable legislation

Superfast IT does not process personal data held within the Client's systems for its own purposes.

Where Superfast IT is also a controller

Separately, and as a controller in its own right, Superfast IT holds limited personal data about the Client's named contacts for account management, service desk communication, billing and marketing. That processing is described in our Privacy Notice.

Where Superfast IT is the controller of Client contact data, the lawful basis is performance of a contract, and legitimate interests for account administration and security monitoring. Where Superfast IT is the processor, the Client determines the lawful basis and Superfast IT acts on the Client's documented instructions.

3. Types of Personal Data Processed

Depending on the services provided, Superfast IT may process:

• employee names and contact details
• authentication details and identity data