1. Who we are
Last updated: 3 November 2026
Rubicon IT Limited ("Rubicon", "we", "us") is a managed IT support and cyber security provider. We are registered in England and Wales, company number 04947573. Our registered office is 10 Campbell Court, Bramley, Tadley, Hampshire, RG26 5EG.
For the information described in this policy, we are the data controller. If you have a question about your data, email privacy@rubicon-it.co.uk or call 0800 007 3040.
2. What this policy covers
This policy covers personal data we collect when you visit rubicon-it.co.uk, contact us, use our free security assessment, subscribe to our emails, apply for a job or deal with us as a prospect or supplier.
If you are a Rubicon managed service client, the data we handle on your behalf (your files, email, devices and systems) is covered by your service agreement and our Data Processing Addendum. In that case you are the controller and we are your processor. This policy does not replace those terms.
3. What we collect and why
Enquiries and contact forms
We collect your name, email address, phone number, company name and the details of your enquiry. We use them to reply and to discuss our services. Our lawful basis is legitimate interests (running our business and answering enquiries) or taking steps at your request before a contract.
Free security assessment
We collect your name, company name, email address, the frameworks you choose and your answers to the questionnaire. We use them to produce your report, email it to you and follow up about the results. We also review answers in aggregate to understand common gaps across businesses. Our lawful basis is legitimate interests.
Emails and marketing
If you subscribe to our newsletter, we rely on your consent, and you can withdraw it at any time. We may also email business contacts about similar services where the law allows. If you work for one of our clients, we may use your work contact details from our service records to send you our newsletter and updates about our services. For these emails our lawful basis is legitimate interests. Every marketing email includes an unsubscribe link, and we keep a record of your preferences so we respect them.
Prospecting
We collect business contact details (name, job title, work email, phone number and company) from public sources and business data providers such as Apollo, to contact businesses that may need our services. Our lawful basis is legitimate interests, and you can object at any time.
Website analytics and tracking
With your consent, we use Google Analytics 4 to measure how people use the site. With your consent, we also use HubSpot tracking to link site visits to your enquiry or form submission. We switch both off until you accept the relevant cookie category. You can change your choice at any time using Cookie Preferences in the footer. See our Cookie Policy for the full list of cookies.
Support, calls and meetings
When you contact us for support or sales, we keep a record of the conversation, such as a ticket, email or call note. We do not currently record phone calls. If we start recording calls, for example for training or quality, we will tell you at the start of the call and update this policy first.
We may record and transcribe Microsoft Teams meetings, including meetings with clients, using a meeting assistant. We tell everyone at the start of the meeting, and you can ask us not to record. We use recordings and transcripts to keep accurate notes and follow up on actions. Our lawful basis is legitimate interests.
Job applications
If you apply for a role, we collect the details you send us, such as your CV and contact details. We use them to assess your application and to contact you. Our lawful basis is legitimate interests, or taking steps at your request before a contract.
We check your right to work in the UK because the law requires it. If you give us health or diversity information, or we carry out a basic criminal record check for a role that needs one, we rely on our obligations under employment law and the conditions in the Data Protection Act 2018.
Client portal
Our Client Portal is run by DeskDirector. It has its own privacy information, which applies when you log in there.
Where your information comes from
Mostly from you. We may also receive business contact details from your employer, from public business sources (such as your company website or LinkedIn profile) or from business data providers such as Apollo.
4. Service providers
We do not sell your personal data. We share it with trusted service providers who process it for us under written agreements, including:
- Hosting and website delivery (Vercel)
- Database storage (Supabase)
- Customer records and marketing (HubSpot)
- Email delivery (Resend)
- Website analytics (Google)
- Email and office applications (Microsoft 365)
- Support tickets and service desk (Kaseya Autotask)
- Workflow automation (Zapier)
- Meeting notes and transcription (Fireflies)
- Accounting and invoicing software
A list of the providers we use to deliver our managed IT services to clients is available on request, as explained on our Sub-processors page.
We may also share personal data where the law requires it, to protect our rights or security, or as part of a sale or restructure of our business. In that case, the new owner will only be able to use your data in line with this policy.
5. Transfers outside the UK
Some of our providers store or access data in the EU or the United States. When personal data leaves the UK, we make sure it is protected by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, also known as the UK-US data bridge, for certified US providers) or by standard contractual clauses with the UK Addendum or the ICO's International Data Transfer Agreement. Contact us for a copy of the safeguards we use.
6. How long we keep your data
- Enquiries that do not become a contract: up to 3 years after our last contact
- Security assessment submissions: up to 3 years
- Meeting recordings and transcripts: deleted when we no longer need them, and no later than 12 months after the meeting
- Client contracts and correspondence: 6 years after the contract ends
- Marketing contacts: until you unsubscribe, or 2 years after your last interaction with us
- Job applications: 6 months for unsuccessful candidates
- Website analytics data: up to 14 months
We may keep some records longer where the law requires it, for example accounting records.
7. Your rights
Under UK data protection law you can ask us to:
- Give you a copy of your personal data
- Correct anything that is wrong
- Delete your data
- Restrict how we use it
- Move it to another provider
- Stop using it for marketing or where we rely on legitimate interests
Your right to stop us using your data for direct marketing is absolute. If you ask us to stop, we will.
Where we rely on your consent, you can withdraw it at any time. We do not make decisions about you using only automated processing.
Email privacy@rubicon-it.co.uk and we will reply within one month. Complex requests can take up to three months, and we will tell you if we need longer. We may need to confirm who you are first.
8. Complaints
Tell us first and we will try to put things right. Email privacy@rubicon-it.co.uk and we will acknowledge your complaint within 30 days. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
9. How we protect your data
We use access controls, encryption in transit, multi-factor authentication and monitoring across the systems that hold personal data. We limit access to the people who need it. No system is completely secure. If a breach puts your rights at risk, we will report it to the ICO where the law requires, and we will tell you without delay if the risk to you is high.
10. Cookies
We use cookies to make the site work and, with your consent, to measure usage and support marketing. See our Cookie Policy for details and to change your choices.
11. Links to other sites
Our site links to other websites, including social media and partner sites. We are not responsible for their content or privacy practices.
12. Children
Our website and services are for businesses. They are not aimed at anyone under 18, and we do not knowingly collect their data. If you think a child has given us personal data, email privacy@rubicon-it.co.uk and we will delete it.
13. Changes to this policy
We will update this policy when our practices change and show the date at the top. If we make a significant change, we will say so on the site.