1. Introduction & Scope

BarrowEdge IT Limited (“BarrowEdge IT”, “we”, “us”, or “our”) is committed to protecting the privacy and security of personal and corporate data. This Privacy Policy explains how we collect, use, store, and safeguard personal data when you visit barrowedge.ie, submit a commercial inquiry, or engage our managed IT, cloud, cybersecurity, hosting, and consultancy services.

We process personal data in strict compliance with the EU General Data Protection Regulation (GDPR), the Irish Data Protection Acts 1988 to 2018, and the ePrivacy Regulations (S.I. No. 336 of 2011).

2. Our GDPR Role: Data Controller vs. Data Processor

Because BarrowEdge IT operates as a business-to-business (B2B) technology partner, our legal obligations under the GDPR depend on the nature of the interaction:

• When We Act as a Data Controller: We determine the purpose and means of processing for our own commercial operations, including sales inquiries, client account management, invoicing, vendor procurement, and website analytics.
• When We Act as a Data Processor: When providing managed IT support, cloud administration, endpoint monitoring, backup management, or server hosting for a client organisation, the client remains the Data Controller and we act strictly as a Data Processor under Article 28 of the GDPR.

3. Categories of Data We Collect

We collect only the information necessary to operate our business, secure client infrastructure, and deliver contracted services:

• Business Contact Data: Name, job title, company name, business email address, telephone number, and billing or site addresses.
• Account & Financial Data: Bank transfer references, billing histories, tax registration details, and subscription records.
• Endpoint & RMM Telemetry: Device names, hardware serial numbers, operating system versions, installed software inventories, local IP addresses, and system health metrics collected via our Remote Monitoring and Management (RMM) tools.
• Security & Access Logs: Authentication logs, firewall telemetry, threat detection alerts, and administrative credentials required to provision or maintain client systems.
• Support & Communication Records: Helpdesk tickets, email correspondence, remote session logs, and project documentation.
• Website Technical Data: IP address, browser type, device information, referring pages, and security cookie identifiers when you browse barrowedge.ie.

4. Lawful Basis & How We Use Your Data

We process personal data strictly where a valid lawful basis applies under Article 6 of the GDPR:

4.1 Performance of a Contract

We process contact, account, and technical data to onboard clients, deliver helpdesk and on-site support, manage cloud environments, procure hardware or software licences, and issue invoices.

4.2 Legitimate Interests

We process system telemetry and security logs to proactively detect hardware failures, deploy software patches, block cyber threats, secure our website, and communicate service updates to authorised client contacts.

4.3 Legal & Regulatory Compliance

We retain billing and contractual records to satisfy Irish Revenue tax obligations, statutory accounting rules, and regulatory audit requirements.

4.4 Consent

Where non-essential analytics cookies or optional marketing communications are used, we rely on your explicit consent, which may be withdrawn at any time.

5. Confidentiality & System Access Standards

In the course of delivering managed IT and hosting services, our engineers may have administrative access to client systems containing personal or commercially sensitive data. We enforce strict technical and organisational controls:

• Least Privilege Access: Engineers access client systems, mailboxes, or file repositories strictly when required to resolve an active support ticket, execute a scheduled migration, or verify backup integrity.
• Encrypted Credential Management: All client administrative credentials, API tokens, and recovery keys are stored in encrypted, role-restricted enterprise password vaults protected by multi-factor authentication (MFA).
• Remote Support Controls: Remote screen-sharing sessions are logged and used solely for authorised troubleshooting and maintenance.
• Staging & Migration Hygiene: Any client data temporarily held on staging storage during a server migration, hardware transfer, or recovery operation is permanently and securely wiped once the task is verified.

6. Data Sharing & Sub-Processors

We never sell, rent, or trade personal data. We share information only with vetted third-party service providers (“Sub-Processors”) where essential to deliver our services:

• Cloud, Software & Security Vendors: Upstream software distributors, cloud platform providers, domain registrars, and cybersecurity vendors required to provision and support your licensed services.
• Infrastructure & Hosting Partners: Certified data centre and edge network providers used to host managed websites, servers, and encrypted cloud backups.
• Professional & Financial Services: Regulated payment processors, banking institutions, accounting platforms, and legal or compliance advisors.

7. International Data Transfers

BarrowEdge IT prioritises European Union and EEA data residency for client hosting and backup storage. Where an upstream global technology vendor processes account or security telemetry outside the EEA, we ensure transfers are protected by Chapter V GDPR mechanisms, including the EU-US Data Privacy Framework or European Commission Standard Contractual Clauses (SCCs).

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Prospective Inquiries: Contact form submissions and quotes that do not proceed to a contract are deleted after 12 months.
• Active Client Records & Telemetry: System documentation, RMM telemetry, and support ticket histories are retained for the duration of the active service agreement.
• Financial & Tax Records: Invoices, contracts, and payment records are retained for six (6) years following the end of the financial year in accordance with Irish Revenue legislation.
• Offboarding Purge: Following termination of a managed service contract and completion of handover, client system credentials and backup archives held by BarrowEdge IT are securely purged within the agreed transition window.

9. Your Data Protection Rights

Under the GDPR, you have the right to:

• Request Access to a copy of the personal data we hold about you.
• Request Rectification of inaccurate or incomplete personal data.
• Request Erasure of your data where there is no compelling legal or contractual reason for its continued processing.
• Restrict or Object to processing based on legitimate interests.
• Request Data Portability to receive your data in a structured, machine-readable format.

If you are an employee or end-user of one of our corporate clients and wish to exercise your GDPR rights regarding data held within your employer’s IT systems, please submit your request directly to your employer (the Data Controller).

10. Cookies & Website Security

Our website uses strictly necessary technical and security cookies to ensure reliable site performance and protect against automated bot traffic. Where optional analytics cookies are deployed, you can manage or revoke your preferences at any time via our cookie consent banner or your browser settings.

11. Contact Us & Supervisory Authority

For any queries regarding this Privacy Policy or to exercise your data protection rights, please contact:

• Company: BarrowEdge IT Limited
• Data Protection Contact: Christopher Richardson
• Registered Address: Ballykeerogue, Campile, Co. Wexford, Y34 NF78, Ireland]
• Email: [email protected]
• Website: barrowedge.ie

If you remain dissatisfied with how we handle a data protection matter, you have the right to lodge a complaint with the Data Protection Commission (DPC) at dataprotection.ie.