Privacy notice | Impact Data Systems

Who we are

This website is run by Impact Data Systems Limited, registered in England and Wales, company number 08516243. Registered office: 1st Floor Kingsway House, Kingsway, Burnley, Lancashire, BB11 1BJ. We are the controller for the personal information described in this notice.

What this notice covers

This notice covers this website and the contact form on it. It does not cover pupil data processed in our education reporting service — see Pupil data in the education service below.

No cookies, analytics or tracking

This website does not set cookies, use analytics, or include tracking pixels or third-party content such as maps, videos, fonts or chat widgets. Everything on the site is served from our own website.

As with any website, our hosting provider processes your IP address and the details of each request in order to deliver pages and protect the service.

What the contact form collects

When you use the contact form we receive:

your name and email address
your organisation and role, if you give them
the topic you choose and your message

The form also includes two spam checks: a hidden field that people don't see, and the time the form was loaded. Neither is used to identify you.

Why we use it and our lawful basis

We use the information you send only to reply to your enquiry. Our lawful basis is:

legitimate interests — responding to people who contact us about our services; and
steps before entering into a contract, where you are asking about using our services.

We don't use it for marketing, and we don't sell or share it.

How it is handled

When you send the form, it is passed to a function running on Microsoft Azure, which emails it to our mailbox. The website does not store your submission in a database.

The organisations that process this information for us are:

Microsoft — website hosting (Azure Static Web Apps) and sending the form by email (Azure Communication Services)
Google — our email (Google Workspace)

How long we keep it

We keep enquiry emails for up to two years after our last contact with you, then delete them. If you become a customer, we keep our correspondence for as long as the contract and our legal obligations require.

Where it is processed

The contact form is processed and sent as email by Azure Communication Services using Microsoft's United Kingdom data location. The website itself is hosted in Microsoft's West Europe region, in the European Economic Area. The UK recognises the EEA as providing adequate protection for personal data, so no further safeguards are needed for that transfer.

We use Google Workspace for email, so enquiry emails may be stored and processed by Google outside the UK, including in the United States. For these transfers Google relies on the UK Extension to the EU–US Data Privacy Framework and, where required, standard contractual clauses. See Google's privacy frameworks.

Your rights

You have the right to ask for a copy of the personal information we hold about you, and to ask us to correct it, delete it or restrict how we use it. You can also object to our use of it. To make a request, email info@impactdatasystems.co.uk.

If you're unhappy with how we have handled your information, please tell us first. You can also complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint.

Pupil data in the education service

In our education reporting service we process pupil data on behalf of trusts and schools, as their data processor. That processing is governed by each trust's data processing agreement with us, not by this notice. If you have a question about pupil data, please contact your school or trust.

Changes to this notice

We'll update this page if anything changes. This version was last updated on 25 October 2026.