Data & Compliance Policy

This policy sets out what personal data LH IT Services collects through this website, the legal basis for collecting it, how long it is kept, who it is shared with, and the rights you have under UK GDPR and the Data Protection Act 2018. It is maintained to meet the requirements of the Information Commissioner's Office (ICO).

This policy covers data collected through this website only. It does not cover data collected through on-site service delivery, which is handled separately.

1. Who we are

LH IT Services is the trading name of Lee Hickman, a sole trader providing on-premises IT installation, maintenance, and support services in the United Kingdom. We are the data controller for all personal data collected through this website.

Data controller: Lee Hickman trading as LH IT Services
Contact email: [email protected]
Contact telephone: +44 2036679727
Location: United Kingdom
ICO registration: Application submitted June 2026 — registration number will be added here upon confirmation.

No Data Protection Officer (DPO) is required or appointed. LH IT Services does not process personal data on a large scale, does not process special category data systematically, and is not a public authority. All data protection queries should be directed to the email address above.

2. What data we collect and why

2a. Contact enquiries

When you submit the contact form, we collect:

Your name and email address
Phone number (optional)
Your message
The page you submitted from, referrer URL, and any UTM campaign fields present in the URL
Your browser user agent string
A one-way hashed representation of your IP address — the raw IP address is not stored
Date and time of submission

Purpose: To receive, understand, and respond to your enquiry, and to manage follow-up communication.

Legal basis: Article 6(1)(f) UK GDPR — legitimate interests. Our legitimate interest is in receiving and responding to business enquiries sent directly to us by individuals who have chosen to make contact.

2b. Quote requests

When you submit the quote request form, we collect:

Your name and email address
Phone number (optional)
Company name (optional)
Service interest (selected from a list)
Your message describing what needs quoting
The page you submitted from, referrer URL, and any UTM campaign fields present in the URL
Your browser user agent string
A one-way hashed representation of your IP address — the raw IP address is not stored
Date and time of submission

Purpose: To receive, understand, and respond to your request for a quote, and to manage follow-up communication regarding potential service provision.

Legal basis: Article 6(1)(b) UK GDPR — processing necessary to take steps at the request of the data subject prior to entering into a contract. We also rely on Article 6(1)(f) — legitimate interests in managing business enquiries and customer relationships.

2c. Website analytics

This website uses first-party analytics only. No third-party tracking scripts, advertising networks, Google Analytics, Meta Pixel, or external profiling services are used.

If you accept analytics cookies, we may collect:

A random visitor identifier, stored in a first-party cookie and never linked to your identity
A short-lived session identifier
Pages visited (URL path only, no query strings that could identify you)
Interactions with phone links, email links, service links, quote links, and form submission attempts
Referrer URL and any UTM campaign fields present
A one-way hashed browser identifier used to group sessions — the raw IP address is not stored in analytics tables

Purpose: To understand how the website is used, which pages are useful, and how enquiries reach us — so we can improve the site without relying on third-party tracking platforms.

Legal basis: Article 6(1)(f) UK GDPR — legitimate interests in understanding and improving our website. Analytics cookies additionally require your consent under the Privacy and Electronic Communications Regulations (PECR), which is obtained through the cookie consent banner on your first visit.

Privacy signals: If your browser sends a Do Not Track (DNT) or Global Privacy Control (GPC) signal, the site respects it by not setting analytics cookies and not storing visitor or session analytics events for that request, regardless of any cookie preference previously saved.

2d. Form abuse and spam detection

Submissions identified as automated spam are stored with a spam flag, are not emailed or acted upon, and are retained for a shorter period than legitimate enquiries.

Legal basis: Article 6(1)(f) UK GDPR — legitimate interests in protecting our contact forms from automated abuse and misuse.

2e. Strictly necessary session data

A session cookie is set for every visitor regardless of consent. It is strictly necessary for the security of the contact and quote forms (CSRF protection) and to display confirmation messages after submission. No personal data beyond a random session identifier is stored in this cookie.

Legal basis: Article 6(1)(f) UK GDPR — legitimate interests in operating secure web forms. No consent is required for strictly necessary cookies under PECR.

3. Data processors

We use the following third-party data processors who act on our behalf and under our instruction. We do not sell, rent, or share your personal data with third parties for their own marketing or commercial purposes.

Processor	Hostinger Internetas, UAB
Role	Email delivery (SMTP)
Location	Lithuania, European Union
Transfer basis	EU/EEA — adequate protection under UK GDPR Article 45
Agreement	Hostinger Data Processing Agreement (available at hostinger.com)

When you submit an enquiry or quote request, the details you provided are transmitted via Hostinger's SMTP service to deliver an email notification to LH IT Services. Email content passes through Hostinger's infrastructure for delivery only and is not retained or processed by them beyond that purpose.

All other data (enquiry records, analytics, sessions) is stored on infrastructure under the direct control of LH IT Services and is not shared with any third-party processor.

4. International transfers

Hostinger Internetas, UAB is based in Lithuania, a member state of the European Union. The EU/EEA has been determined to provide adequate protection for personal data under UK GDPR (UK adequacy regulations). No transfer outside the UK or EEA is involved in email delivery.

No other personal data collected through this website is transferred outside the United Kingdom or European Economic Area.

5. Retention periods

Data	Retention period	Reason
Contact and quote enquiries	2 years from submission	Business follow-up and relationship management
Analytics session and event records	12 months	Trend analysis and website improvement
Daily aggregate analytics metrics	36 months	Long-term performance benchmarking (no personal data)
Spam submissions	90 days	Abuse pattern detection

After these periods, personal data is permanently deleted or anonymised. Aggregate metrics that contain no personal data may be retained indefinitely.

6. Your rights under UK GDPR

You have the following rights regarding personal data we hold about you. To exercise any of them, contact us at [email protected]. We will respond within one calendar month in line with UK GDPR Article 12.

Right to be informed — This policy, together with the privacy notice on our contact and quote forms, fulfils our obligation to tell you how we use your data at the point of collection.
Right of access (Subject Access Request) — You can request a copy of the personal data we hold about you, along with information about how it is used, where it came from, and who it has been shared with. We will provide this free of charge unless requests are manifestly unfounded or excessive.
Right to rectification — You can ask us to correct inaccurate personal data or complete incomplete data. We will action this without undue delay and within one month.
Right to erasure (‘right to be forgotten’) — You can ask us to delete your personal data where it is no longer necessary for the purpose it was collected, where you have withdrawn consent (if consent was the basis), or where you have objected and we have no overriding legitimate grounds. We will action reasonable erasure requests promptly.
Right to restriction of processing — You can ask us to pause processing of your data — for example while we verify the accuracy of data you have disputed, or while we consider an objection you have raised.
Right to data portability — Where processing is based on consent or contract and is carried out by automated means, you can request your data in a structured, commonly used, machine-readable format. This right applies to data you have provided directly to us.
Right to object — You can object at any time to processing based on legitimate interests (Article 6(1)(f)). We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, or unless the processing is necessary for legal claims. You can also object at any time to processing for direct marketing purposes — we do not carry out direct marketing, but if this changes you will have an unconditional right to object.
Rights related to automated decision-making — We do not carry out automated decision-making or profiling that produces legal or similarly significant effects on individuals. No decisions about you are made solely by automated means.
Right to withdraw consent — Where we rely on your consent — specifically for analytics cookies — you can withdraw it at any time by clearing your cookies for this site or declining via the cookie consent banner. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

7. How to complain

If you are unhappy with how we handle your personal data, please contact us first at [email protected]. We will aim to resolve your concern promptly and fairly.

If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the supervisory authority for data protection in the United Kingdom:

Website: ico.org.uk
Report a concern: ico.org.uk/make-a-complaint
Helpline: 0303 123 1113

8. Security measures

We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, or misuse:

All data is transmitted over HTTPS (TLS encrypted connections).
Session data is encrypted at rest.
IP addresses are one-way hashed before storage and cannot be reversed to identify an individual.
Contact and quote forms are rate-limited and include spam filtering to reduce abusive submissions.
CSRF tokens are used on all forms to prevent cross-site request forgery.
Personal data is stored on infrastructure under the direct control of LH IT Services and is not pushed to third-party cloud platforms.

9. Cookies

This website sets the following cookies:

Cookie name	Purpose	Duration	Category
`lh_it_services_session`	Maintains your session, protects forms with CSRF security tokens, and displays confirmation messages after form submission	Until browser is closed or session expires (120 minutes of inactivity)	Strictly necessary
`lhits_consent`	Stores your cookie consent preference (accepted or declined) so the banner does not reappear on every visit	12 months	Strictly necessary (preference)
`lhits_visitor_id`	A randomly generated identifier used to count unique visitors. Not linked to your identity. Set only if you accept analytics cookies.	Approximately 13 months	Analytics (consent required)
`lhits_session_id`	A randomly generated identifier used to group page views into a single visit. Not linked to your identity. Set only if you accept analytics cookies.	30 minutes of inactivity	Analytics (consent required)

No advertising cookies, cross-site tracking cookies, or third-party cookies of any kind are set on this website.

10. Cookie consent

On your first visit, a banner at the bottom of the page offers you the choice to accept or decline analytics cookies.

Accept — lhits_visitor_id and lhits_session_id are set and page interactions are recorded as described in section 2c above.
Decline — no analytics cookies are set and no visitor or session events are stored for your visits.

Your preference is stored in the lhits_consent cookie for 12 months. The banner will not reappear until that preference expires. You can change your preference at any time by clearing your cookies for this site.

Regardless of your preference, the session cookie (lh_it_services_session) is always set. It is strictly necessary for the contact and quote forms to function securely.

11. Provision of data

Providing your name, email address, and message when using our contact or quote forms is voluntary. However, without these details we cannot respond to your enquiry or prepare a quote. There is no legal or contractual obligation to submit a form — you may also contact us by telephone at +44 2036679727.

12. Changes to this policy

If we make material changes to this policy, we will update this page and revise the date below. Continued use of the website following a material change constitutes acknowledgement of the updated policy.

Last reviewed: June 2026