1. Data Controller Overview
Edgway Limited (“Edgway”, “we”, “our”, or “us”) operates as the Data Controller responsible for your personal data collected via edgway.co.uk, subdomains, direct client consultations, discovery workshops, and our digital advisory services.
Edgway Limited
124, City Road, London EC1V 2NX
Direct Telephone: 0330 133 2751
Official Correspondence Email: contact@edgway.co.uk
2. Personal Information We Collect
We may collect, use, store, and transfer different kinds of personal information depending on your interaction with Edgway Limited:
- Identity & Contact Data: Includes first name, last name, business email address, direct telephone number, job title, and employer or associated organisation.
- Project & Discovery Data: Includes technical requirements, operational challenges, current software architecture, and Microsoft licensing scopes submitted through our forms or discovery calls.
- Recruitment Data: Includes curriculum vitae (CV), employment history, educational qualifications, portfolio links, and referee details submitted for job openings.
- Technical & Usage Data: Includes internet protocol (IP) address, browser type and version, time zone setting, operating system, and interaction logs captured during website visits.
- Communications Records: Notes, transcripts, and records of electronic mail exchanges between you and our specialist consultants.
3. Lawful Basis for Processing
Under the UK General Data Protection Regulation (UK GDPR Article 6), we only process your personal data when we have a recognized legal basis:
Contractual Necessity
Processing required to take steps at your request prior to entering into a contract, or to perform our digital advisory and technical delivery agreements.
Legitimate Interests
Operating, safeguarding, and improving our services, answering commercial inquiries, preventing cyber fraud, and maintaining business records.
Consent
Where you have given clear, explicit consent for us to process your data for a specific purpose (such as non-mandatory marketing or opt-in cookies).
Legal Compliance
Processing necessary for compliance with a UK statutory or legal obligation, such as HMRC reporting or anti-money laundering regulations.
4. How We Use Your Information
We process your information exclusively for legitimate enterprise purposes, including:
- Responding swiftly to contact inquiries, RFP submissions, and advisory discovery requests.
- Architecting, scoping, and executing Microsoft Dynamics 365, Azure, and Business Analysis projects.
- Evaluating non-profit grant eligibility and software discount qualifications on behalf of registered UK charities.
- Assessing candidates for published job vacancies and communicating regarding career opportunities.
- Maintaining the security, performance, and integrity of our digital infrastructure.
6. Information Security & Storage
We implement stringent technical and organisational safeguards to defend your personal data against accidental loss, unauthorised access, misuse, or alteration:
- All web traffic is encrypted end-to-end using Transport Layer Security (TLS 1.3 / SSL).
- Role-Based Access Control (RBAC) and Multi-Factor Authentication (MFA) enforce strict least-privilege principles across staff systems.
- Data centres adhere to ISO/IEC 27001, SOC 2, and Cyber Essentials standards.
7. Data Retention Periods
We retain personal information only for as long as necessary to satisfy the business purposes for which it was gathered, including satisfying legal, tax, accounting, or reporting mandates:
- General Inquiries & Scoping Records: Retained for 24 months following the last active communication before secure deletion.
- Client Engagement Contracts & Audits: Retained for 6 years following contract conclusion in compliance with UK statutory requirements.
- Unsuccessful Job Applications: Retained for up to 12 months with candidate consent for future matching, unless earlier erasure is requested.
8. Your UK Statutory Rights
Under UK data protection law, you possess key statutory rights regarding your personal information:
- Right of Access: Request a free copy of the personal information we hold about you (Subject Access Request).
- Right to Rectification: Request correction of inaccurate or incomplete personal records.
- Right to Erasure (“Right to be Forgotten”): Request deletion of your personal records where no overriding legal basis exists.
- Right to Restrict Processing: Request suspension of data processing in specified statutory circumstances.
- Right to Data Portability: Request transmission of your data to you or a nominated third party in a structured, machine-readable format.
- Right to Object: Object to processing predicated upon legitimate interests or direct marketing campaigns.
To exercise any of these statutory rights, please submit a written request to contact@edgway.co.uk. We respond to verified requests within one calendar month.
10. Contacting Us & Complaints
If you have questions regarding this Privacy Policy, wish to exercise your data subject rights, or have concerns regarding how your information is handled, please contact our Data Governance team:
You also have the statutory right to lodge a complaint with the UK supervisory authority, the Information Commissioner’s Office (ICO), at ico.org.uk or by calling their helpline on 0303 123 1113.