Privacy Policy

This policy explains how LeedsLink IT Services (“we”, “us”), based in Leeds, United Kingdom, handles personal data when you use our website, our service desk and client portal (“PitchFork”) at leedslinkit.co.uk and support.leedslinkit.co.uk, or when we provide IT services to you or your organisation. We are the data controller for the personal data described here.

What we collect

• Account details: name, email address, phone number, job title and the organisation you belong to.
• Support activity: tickets, replies, attachments and notes you send us or that we record while helping you.
• Device information: for clients whose devices we manage, details such as device name, operating system and patch status, collected through our remote monitoring and management tooling.
• Project information: tasks, dates and progress for work we deliver for you.
• Billing information: the name and email address of the person or company we invoice, invoice numbers, dates, amounts and payment status.
• Sign-in and security data: sign-in events and session information used to keep accounts secure.

How and why we use it

We use personal data to:

• provide and support the IT services we have agreed with you (contract);
• run, secure and improve our systems, and prevent misuse (legitimate interests);
• issue invoices, keep accounting records and meet tax and legal obligations (legal obligation and contract);
• communicate with you about your tickets, projects and invoices.

We do not sell personal data, and we do not use it for advertising.

QuickBooks Online

Our administrators connect our own QuickBooks Online company to PitchFork using Intuit’s secure sign-in (OAuth 2.0). This connection is used only by authorised LeedsLink IT administrators, and only to:

• look up and link our customer records to the organisations we support;
• read our list of products, services and VAT codes;
• create invoices and email them to our clients through QuickBooks; and
• read back the status of invoices we created (sent, paid, overdue).

We keep a limited copy of this information in PitchFork (invoice number, dates, totals, balance, customer name, the email address it was sent to and its status) so our team can see it without reopening QuickBooks. Our QuickBooks access tokens are encrypted in our database. We do not share QuickBooks data with anyone other than Intuit (which operates QuickBooks), and we do not use it for any other purpose. An administrator can disconnect QuickBooks at any time in PitchFork or from the Intuit account; disconnecting deletes our stored access tokens.

Who we share data with

We use a small number of service providers (“processors”) to run PitchFork, under appropriate agreements:

• our hosting provider, which runs the servers PitchFork is stored on;
• Microsoft, for email delivery and optional Microsoft 365 sign-in;
• Intuit, for QuickBooks Online accounting and invoicing;
• Action1, for remote monitoring and patch management of managed devices.

We may also disclose data where the law requires it, or to protect our rights and the security of our systems.

International transfers

Some of the providers above may process data outside the United Kingdom. Where they do, we rely on adequacy regulations or appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

How long we keep it

We keep support and project records while we provide services to you and for a reasonable period afterwards. Financial records are kept for as long as UK tax and accounting law requires (currently six years). When data is no longer needed we delete or anonymise it.

How we protect it

• Accounts are invite-only, and the service is served over HTTPS.
• Integration credentials and tokens are encrypted at rest.
• Access is limited by role: administrators, agents and client users only see what their role and organisation allow.
• Multi-factor authentication is available through Microsoft 365 sign-in.

Cookies

We use only the essential cookies needed to keep you signed in and to secure sign-in. We do not use advertising or third-party tracking cookies.

Your rights

Under UK data protection law you can ask us for a copy of your personal data, ask us to correct or delete it, restrict or object to how we use it, and ask for it in a portable format. To exercise any of these rights, email hello@leedslinkit.co.uk. If you are unhappy with how we handle your data you can complain to the Information Commissioner’s Office at ico.org.uk.

Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last changed.