1. Who we are
Bitnet Solutions Ltd ("Bitnet", "we", "us") is a company registered in England and Wales, company number 09004664, based in Birmingham, United Kingdom. We provide management information systems, IT and cyber security services to schools, trusts, local authorities and businesses.
For the personal data we collect through this website and our own business operations, Bitnet is the data controller. Where we host or support a system on behalf of a school, trust or other customer, that organisation is the controller of the pupil, staff and family data held in it, and we act as their data processor under a written agreement.
We are registered with the Information Commissioner's Office (ICO) as a data controller. You can contact our data protection lead at privacy@bitnets.co.uk.
2. Data we collect
We keep data collection to what we genuinely need. Through this website and our sales and support activity, we may collect:
- Contact and enquiry details — your name, work email address, telephone number, organisation, role and setting type, plus anything you tell us in a message, demo booking or assessment.
- Booking data — when you book a meeting through our scheduling tool, the details you submit and the appointment itself.
- Assessment responses — the answers you give in our online security assessment or cyber health check, and the result generated from them.
- Technical and usage data — IP address, device and browser type, pages visited, referring page and approximate location, collected through cookies and similar technologies.
- Correspondence and support records — emails, live chat transcripts, call notes and tickets.
- Recruitment and supplier data — where you apply for a role with us or work with us commercially.
We do not ask for special category data through this website, and we do not use automated decision-making that has a legal or similarly significant effect on you.
3. Why we use it and our legal basis
| What we do | Legal basis | Notes |
|---|---|---|
| Respond to enquiries, run demos and provide quotes | Legitimate interests, or steps towards a contract | You asked us to get in touch. |
| Deliver and support the services our customers buy | Performance of a contract | Governed by our service agreement. |
| Send service notices, security advisories and renewals | Legitimate interests | Necessary to run the service safely. |
| Send marketing updates and insight content | Consent, or soft opt-in for existing business contacts | You can unsubscribe at any time. |
| Measure how the website is used and improve it | Consent | Analytics cookies are off unless you accept. |
| Protect our systems and prevent fraud or misuse | Legitimate interests, or legal obligation | Includes logging and monitoring. |
| Meet accounting, tax and regulatory duties | Legal obligation | Retention periods set by law. |
4. Who we share it with
We do not sell personal data and we do not share it for third-party advertising. We share it only with:
- Service providers acting on our instructions — hosting, email, scheduling, live chat, analytics, CRM and support tooling, each bound by a data processing agreement.
- Our customers — where you are a user of a system we host on their behalf.
- Professional advisers and authorities — auditors, insurers, and regulators or law enforcement where we are legally required to disclose.
- A buyer or successor — if our business is reorganised or transferred, under equivalent protections.
Our data is hosted in the United Kingdom and the European Economic Area wherever possible. Where a provider processes data outside the UK, we rely on UK adequacy regulations or the International Data Transfer Agreement and Addendum, together with appropriate technical safeguards.
5. How long we keep it
We keep personal data only as long as we need it for the purpose it was collected, then delete or anonymise it. As a guide: enquiries and assessment results for up to 24 months from our last contact; customer contract and support records for the life of the contract plus six years; accounting records for six years after the financial year; live chat transcripts and website analytics for up to 26 months; recruitment records for 12 months unless you agree to longer.
Where we process data on behalf of a school, trust or business customer, retention follows their instructions and their own retention schedule.
6. How we protect it
Protection is one of our founding principles, and we hold ourselves to the standards we advise our customers to meet. Our controls include role-based access and least privilege, multi-factor authentication, encryption in transit and at rest, segregated environments, monitored backups with tested restores, vulnerability and patch management, supplier due diligence, staff training, and a documented incident response process.
If a personal data breach is likely to result in a risk to your rights and freedoms, we will report it to the ICO within 72 hours and tell affected people without undue delay.
7. Your rights
Under UK data protection law you have the right to be informed, and to request access to your data, correction of inaccurate data, erasure, restriction of processing, portability, and objection to processing based on legitimate interests or to direct marketing. Where we rely on consent, you can withdraw it at any time.
To exercise any of these rights, email privacy@bitnets.co.uk. We will respond within one month and will not charge a fee in ordinary circumstances. If your data sits in a system we host for a school or business, we will pass your request to that organisation and support them in answering it.
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
8. Cookies
Cookies are small files placed on your device when you visit a website. We use them to keep the site working, to remember your choices, and, only if you agree, to understand how the site is used. Strictly necessary cookies are set automatically because the site cannot function without them. Everything else stays off until you accept it.
| Category | Set by | Duration | Purpose |
|---|---|---|---|
| Strictly necessary Always on | Bitnet | Session to 12 months | Security, load balancing, form submission and remembering your cookie choices. |
| Functional | Calendly, live chat provider | Session to 12 months | Enables demo booking and live chat. Blocked until you accept; until then those features stay unavailable. |
| Analytics | Bitnet, analytics provider | Up to 26 months | Aggregated statistics on pages visited and journeys taken, so we can improve the site. |
| Marketing | Third-party platforms | Up to 13 months | Measures the performance of our campaigns. Not used unless you accept. |
You can change or withdraw your cookie choices at any time using the button below, or by clearing cookies in your browser. Browser settings also let you block cookies altogether, though parts of the site may then not work as intended. Embedded third-party content, such as our scheduling tool or videos, may set its own cookies under that provider's policy.
9. Children and school data
This website is aimed at professionals and is not directed at children. We do not knowingly collect children's personal data through it.
Pupil, family and staff data held in the systems we build and host belongs to the school, trust or local authority that uses them. Those organisations decide what is collected and why, publish their own privacy notices to pupils and parents, and instruct us as their processor. We handle that data only as set out in our agreement with them, in line with the UK GDPR, the Data Protection Act 2018 and Keeping Children Safe in Education.
10. Changes and contact
We review this notice at least annually and whenever our services or processing change. The version and date at the top of the page tell you when it was last updated. Material changes will be highlighted on the website.
Questions, requests or complaints: privacy@bitnets.co.uk, or write to Bitnet Solutions Ltd, Birmingham, United Kingdom.