Privacy policy
Last reviewed 22 July 2026
This explains what we collect, why, how long we keep it, and the rights you have over it. Plain English, no dark patterns.
This is our current, working policy, written to match how we actually operate and the UK law that applies. Our ICO registration number and Companies House number will be added here and in the footer once confirmed. For a specific contractual form, ask us and we will provide a signed version.
Who we are
Optimum IT Solutions is the data controller for the personal data described here. We are based at 4 Marine Esplanade, Leith, Edinburgh EH6 7LU and you can reach us on the details on our contact page.
For most client work we act as your data processor rather than the controller, and that relationship is governed by our Data Processing Agreement rather than this page.
What we collect
Through this website and in the normal course of doing business, we collect only what we need:
- Contact form and enquiry details: your name, business, email, phone, and whatever you choose to tell us about your situation
- Correspondence: emails, WhatsApp messages and call notes, so we have a record of what was agreed
- Client and billing records: the information we need to deliver the work and to invoice you
- Basic technical data: anonymised, aggregated analytics about how the site is used, covered in more detail in our Cookie policy
Why we hold it and our lawful basis
To reply to you and, if you become a client, to deliver the work and invoice for it. The lawful basis is your consent when you first contact us, then the performance of our contract with you, and our legitimate interest in running the business and keeping proper records.
We do not buy marketing lists and we do not sell yours. We do not use your data to train public AI models, and where a build involves AI we tell you in writing which providers are used and on what terms.
How long we keep it
Enquiries that go nowhere are deleted after twelve months. Client records are kept for as long as we are contractually engaged and then for the period we are legally required to keep them for tax and accounting, which is currently six years. Call recordings and transcripts follow the retention set out in our Session recording policy.
Who we share it with
Only the suppliers we need to run the business, each under their own data agreement: our email and hosting providers, our accounting software, and payment processors such as Stripe. We name the specific processors used on your project in writing. We do not send your data outside the UK or EEA without an appropriate safeguard in place, and where you need everything to stay in the UK we can arrange that.
Your rights
Under UK GDPR you can ask to see what we hold, to correct it, to have it deleted, to restrict or object to how we use it, and to receive a copy in a portable format. Email us and we will action it within a month at no charge.
If you are not happy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk, though we would always rather you told us first so we can put it right.
The easiest way to reach us about anything on this page is email. We answer data and privacy requests within one month, as UK GDPR requires, and usually much sooner.
Questions about this policy? Email [email protected] or see the rest of our legal and policy pages.