v2.0, 1 September 2026

Workshop IT Ltd, trading as WIT, is committed to protecting the personal information of the people who visit our website, enquire about our services, work for our clients and suppliers, or work for us. This notice explains what we do with personal data, on what legal basis, for how long we keep it and what you can ask us to do about it.

1. About this notice

1.1 This notice is published by Workshop IT Ltd, registered in England and Wales under company number 08366747, whose registered office is Legacy Centre, Hanworth Industrial Estate, Hampton Road West, Feltham, Surrey TW13 6DH. We trade as WIT and are part of the Net Essence Group. In this notice, “we”, “us” and “our” mean Workshop IT Ltd.

1.2 We are registered with the Information Commissioner’s Office under registration reference ZA832559.

1.3 This notice covers personal data we handle as a controller: information about visitors to our website, people who enquire about our services, contacts at our clients and suppliers, job applicants and anyone who contacts us. Section 2 explains the separate and important case of personal data we handle on behalf of our clients.

1.4 This notice applies to our own website. Where we link to another organisation’s website, that organisation’s own notice applies and we are not responsible for it.

1.5 For anything to do with this notice or your personal data, contact us using the details in Section 13.

2. When we are a controller and when we are a processor

This distinction matters more for a managed IT provider than for most businesses, so we set it out plainly.

2.1 We are a controller for personal data we decide the purposes and means of processing: our website and analytics, our marketing, enquiries we receive, the administration of our client and supplier relationships, recruitment and our own employment records.

2.2 We are a processor for personal data that sits inside the systems we manage, support or host for our clients. That includes mailboxes, files, directories, project data and support records belonging to a client. For that data the client is the controller. We act only on the client’s documented instructions under our Standard Terms and the applicable data processing schedule. We do not use it for our own purposes.

2.3 If you work for one of our clients and want to exercise your rights over personal data held in your employer’s systems, please contact your employer. They are the controller and we will support them in responding. We cannot act on that data on our own initiative.

2.4 Where we act as a processor, we appoint sub-processors only in line with the client’s contract. We remain accountable to the client for them.

3. Personal data we process as a controller

The table below sets out what we process, why, the lawful basis under the UK GDPR and how long we keep it. Retention periods run from the date the relationship or record ends.

Data and examples	Why we process it	Lawful basis	Retention
Website usage data: IP address, approximate location, device and browser, pages viewed, referral source, timing and pattern of visits	Understanding how the site is used and improving it; keeping the site secure	Legitimate interests (running and improving our website securely), assessed in IS07a. Where the data comes from non-essential cookies, consent under PECR	26 months in analytics, then aggregated
Enquiry and contact data: name, employer, job role, email, telephone, postal address and what you asked us about	Responding to you, preparing a proposal and keeping a record of what was discussed	Legitimate interests, or steps taken at your request before entering a contract	24 months from the last contact if no contract follows
Client and supplier contact data: names, roles, business contact details, authorisations and approvals	Delivering and administering the services, service desk access, billing and account management	Performance of a contract, plus legitimate interests for the wider relationship	6 years after the end of the contract, matching the limitation period
Service records: support tickets, correspondence, asset and licence records, access approvals	Providing support, evidencing what was done and to whose instruction, plus quality and security review under ISO 9001 and ISO 27001	Performance of a contract, legal obligation, plus legitimate interests in maintaining auditable records	6 years after the end of the contract
Marketing data: your contact details and your preferences	Sending you material you have asked for or that is closely related to services you have had from us	Consent, or soft opt-in and legitimate interests where you have previously engaged with us	Until you withdraw, then a suppression record kept indefinitely so we do not contact you again
Recruitment data: application, CV, right to work checks and interview notes	Assessing your application and meeting our employment duties	Steps before a contract, legal obligation, plus legitimate interests	12 months after the outcome unless you ask us to keep it on file
Records for claims, insurance and advice: any of the above where needed	Establishing, exercising or defending legal claims, obtaining insurance or professional advice	Legitimate interests, plus legal obligation where one applies	6 years, or longer where a claim or professional liability period requires it

3.1 We do not seek or knowingly collect special category personal data through our website. We do not sell personal data to anyone.

3.2 Please do not send us other people’s personal data unless we have asked you to or they have agreed.

4. Marketing

4.1 We send marketing by email only where you have consented, or where you have previously engaged with us about a similar service and have not opted out. Every marketing email carries an unsubscribe link.

4.2 We occasionally send marketing by post, relying on consent or legitimate interests.

4.3 You can change your preferences or stop marketing entirely at any time, using the unsubscribe link in any of our emails or by emailing info@wit-support.uk. There is one route and it comes to us. We act on requests promptly and in any event within one month.

5. Cookies and website analytics

5.1 A cookie is a small file placed on your device by a website. Some cookies last only for your visit, others remain until they expire or you delete them. Similar technologies such as local storage and tracking pixels work in comparable ways. Where we refer to cookies we mean those too.

5.2 We use cookies and similar technologies in the following categories.

Category	What it does	Do we need your consent?
Strictly necessary	Makes the site work: page delivery, security, load balancing and remembering your cookie choices	No. These are exempt, because without them the site cannot provide what you asked for
Analytics and performance	Tells us how the site is used so we can improve it. We use Google Analytics for this	Yes
Functionality and preferences	Remembers choices you make so the site behaves consistently	Yes

5.3 We ask for your consent to non-essential cookies before we set them, through the banner shown on your first visit. You can change or withdraw your choices at any time using the cookie preferences link in the site footer. You can also block or delete cookies in your browser settings. Blocking all cookies will affect how this and most other websites work.

5.4 Our website is hosted on servers we manage ourselves, located in the United Kingdom. The site is delivered as static pages and sets no cookies of its own. The only optional cookies are the Google Analytics cookies described above, which are not set unless you consent, and your cookie choice is stored in your browser’s local storage rather than in a cookie.

5.5 We do not use cookies to serve advertising to you.

6. Who we share personal data with

6.1 We share personal data only where we need to and only with organisations that are contractually bound to protect it. We assess every supplier that will handle personal data before we appoint them. We keep the current list in our Record of Processing Activities.

Who	Why
Our hosting provider	Website hosting, on servers we manage in the United Kingdom
Microsoft	Email, files, identity and collaboration in our own Microsoft 365 tenant
Our service desk platform	Logging and managing support requests, plus the customer support portal
Google	Website analytics, where you have consented
Our professional advisers, insurers and auditors	Obtaining advice or insurance, plus independent audit of our management system
Credit reference agencies	Credit checks on business accounts, where we need to before offering terms
A buyer or successor	If we sell all or part of the business, personal data may transfer with it, subject to the protections in this notice
Law enforcement, regulators or courts	Where we are legally required to disclose, or to establish or defend legal claims

7. Where your personal data is held

7.1 We hold personal data in the United Kingdom and the European Economic Area wherever we can. We choose UK or EU data residency for our own systems where the option exists.

7.2 Some of our suppliers process personal data outside the UK. Where that happens we rely on UK adequacy regulations, or on the International Data Transfer Agreement or the UK Addendum to the European Commission’s standard contractual clauses, together with an assessment of the risk in the destination country.

7.3 You can ask us which safeguard applies to a particular transfer using the details in Section 13.

8. How long we keep personal data

8.1 The retention column in Section 3 sets out our normal periods. They come from our information classification and retention standard, which we review annually.

8.2 We keep personal data no longer than we need it. Where we cannot fix a period in advance, we decide it by reference to how long the relationship is live, what any contract requires, what statutory limitation periods apply and whether a claim or investigation is reasonably in prospect.

8.3 When a period ends we delete the data, or anonymise it so it can no longer be linked to you.

9. How we keep personal data secure

9.1 We have been certified to ISO 27001 for information security management since 2018 and to ISO 9001 for quality management since 2023. Both certifications are audited independently. Information security is managed as a documented, reviewed discipline rather than a product we have bought.

9.2 Our controls include multi-factor authentication, least-privilege access, managed endpoint protection, encryption in transit and at rest, monitored patching, tested backups, staff training, supplier assessment and a rehearsed incident response process. We are also Cyber Essentials certified.

9.3 If a personal data breach occurs and it presents a risk to people, we report it to the Information Commissioner’s Office within 72 hours of becoming aware of it and tell the people affected where the law requires. Where the breach concerns data we process for a client, we notify that client without undue delay so they can meet their own duties.

10. Artificial intelligence and automated decisions

We tell our clients to govern their use of AI, so we set out our own position here rather than leave you to ask.

10.1 We use a small, deliberately chosen set of business-grade AI tools internally, mainly to speed up documentation, drafting and routine analysis. Every tool is assessed and recorded in our AI system inventory before use, with a named owner and a decision on what data may be used with it.

10.2 A person always reviews AI-assisted output before it is relied on or sent to you. AI does not make decisions about your systems, your data or your account on its own.

10.3 We do not put personal data or confidential client information into consumer or public AI tools. The tools we do approve are contracted so that your data is not used to train their public models.

10.4 We do not make decisions about you by solely automated means that produce legal effects or otherwise significantly affect you, nor do we profile you in that way. If that ever changes we will tell you before it does and explain your rights.

10.5 Our AI governance sits inside the management system already certified to ISO 27001 and ISO 9001. We are extending it to cover AI under ISO 42001, the international standard for AI management.

10.6 Where we deploy or operate AI inside a client’s environment, we do so as a processor on that client’s instructions and under their governance, not our own.

10.7 If you want to know whether and how AI was involved in something we produced for you, ask us and we will tell you.

11. Your rights

11.1 You have the right to ask us for a copy of the personal data we hold about you, to have inaccurate data corrected, to have data erased where there is no good reason for us to keep it, to restrict how we use it, to object to processing we base on legitimate interests and to receive certain data in a portable form. You can withdraw consent at any time where we rely on it. You can object to direct marketing at any time with no reason needed.

11.2 Exercising these rights is free. We respond within one month and tell you if we need longer because the request is complex.

11.3 We may ask you for enough information to confirm your identity, so that we do not disclose your data to somebody else. We ask only for what is proportionate. We do not require certified documents.

11.4 Some rights have limits. Where we cannot do what you have asked, we explain why and tell you how to challenge that.

11.5 To make a request, use the details in Section 13.

12. Changes to this notice

12.1 We review this notice at least annually and whenever our processing, our suppliers or our certifications change materially. The version and date are shown at the top.

12.2 Where a change materially affects you, we tell people we hold contact details for rather than relying on you to check the page.

13. Contacting us and raising a complaint

13.1 For any data protection question or request: email info@wit-support.uk, telephone +44 (0)20 7183 0498, or write to the Data Protection Contact, Workshop IT Ltd, Legacy Centre, Hanworth Industrial Estate, Hampton Road West, Feltham, Surrey TW13 6DH.

13.2 If you are not satisfied with how we have handled your personal data or your request, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office at any time.

13.3 Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Telephone 0303 123 1113. Website ico.org.uk.

Workshop IT Ltd · Referenced by WIT Standard Terms and Service Schedules

This Acceptable Use Policy ("AUP") sets out the standards of conduct that apply to any person or organisation (the "Customer") using a service provided by Workshop IT Ltd ("WIT"), including internet access, hosted voice, SIP, network and managed IT services (each a "Service").

This AUP forms part of the contractual relationship between WIT and the Customer and is incorporated into the WIT Standard Terms and Conditions and each applicable Service Schedule, including Schedule 4 (Telecoms Services).

References to the Customer include the Customer's employees, contractors, agents and any third party using a Service through the Customer's account or premises (each a "User"). The Customer is responsible for ensuring that its Users comply with this AUP.

General Principles

Services are provided for the Customer's lawful business use, and must not be used in any way that is illegal, harmful, fraudulent, or that places the integrity, security or reputation of WIT, any Carrier, or any other user of the WIT or Carrier network at risk.

The Customer shall comply with all applicable laws, regulations and codes of practice, including (without limitation) the Computer Misuse Act 1990, the Communications Act 2003, the Privacy and Electronic Communications Regulations 2003, the UK General Data Protection Regulation and the Data Protection Act 2018.

Prohibited Use

The Customer shall not use, and shall not permit any User to use, a Service to:

send, post, store, upload, download, share or otherwise make available any material that is unlawful, defamatory, obscene, indecent, threatening, harassing, discriminatory, or which infringes the intellectual property, privacy or other rights of any third party;

transmit unsolicited commercial or marketing communications (commonly known as "spam"), engage in mass messaging, or undertake any conduct that contravenes the Privacy and Electronic Communications Regulations 2003 or the General Data Protection Regulation;

make automated, recorded, robo-dialled, "silent" or "abandoned" calls in breach of Ofcom's persistent misuse rules;

make, or attempt to make, calls to premium-rate, international premium-rate, special-rate or revenue-share destinations in a manner that is fraudulent, in breach of policy, or otherwise indicative of compromise of the Customer's systems;

knowingly distribute, upload, transmit or facilitate the distribution of viruses, worms, ransomware, trojans, logic bombs or any other malicious code;

gain or attempt to gain unauthorised access to any computer system, account, data, network or service (whether of WIT, a Carrier, another customer or a third party);

circumvent or attempt to circumvent any authentication, billing, rating, encryption, content filtering or security measure;

engage in any activity which interferes with, disrupts or impairs the operation of the WIT or Carrier network, including denial-of-service activity, port scanning of third-party systems, network sniffing, or generating excessive or anomalous traffic;

resell, rebrand, sub-license or make the Service available to any third party except as expressly permitted in the Customer's contract with WIT;

use the Service in any way that brings, or is likely to bring, WIT or any Carrier into disrepute.

Security and Customer Obligations

The Customer is responsible for the security of its own equipment, networks, end-user devices, accounts and configuration. In particular, the Customer shall:

keep credentials, access codes, SIP credentials, PBX administration passwords and similar authentication information confidential and use reasonable measures to protect them from unauthorised use;

apply security updates and patches to its own systems in a timely manner;

configure any Customer-managed device (including PBX equipment, IP phones, routers and firewalls) in line with reasonable security good practice, including restricting international and premium-rate dialling where not required;

promptly notify WIT of any suspected compromise, unauthorised access or unusual usage pattern affecting the Service.

The Customer acknowledges that compromise of Customer-controlled elements (for example, weak PBX passwords resulting in toll fraud) is the Customer's responsibility, and that all charges incurred as a result of such compromise remain payable in accordance with the applicable Service Schedule.

Reasonable Network Use

Where a Service is provided on a contended, best-efforts or shared basis, the Customer shall not use it in a way that would unreasonably degrade the experience of other users of the network.

WIT may apply reasonable network management measures, including traffic shaping, rate limiting or blocking of specific protocols or destinations, where necessary to maintain the integrity, security or quality of the network. Where practicable, WIT will notify the Customer of significant ongoing measures affecting the Service.

Reporting and Cooperation

The Customer shall report any breach (or suspected breach) of this AUP affecting its Service to WIT without undue delay, by email to ticket AT wit-support.uk or by telephone on 020 7183 0498.

The Customer shall provide WIT with all reasonable cooperation in investigating and addressing any AUP breach, including timely access to information, logs and personnel where appropriate.

WIT's Rights

Where WIT reasonably suspects a breach of this AUP, or where required by law, regulation or a competent authority, WIT may, with or without prior notice:

investigate the suspected breach, including by examining traffic logs and call records;

block or filter specific destinations, calls, traffic or users;

suspend or restrict the affected Service in accordance with the relevant Service Schedule;

in cases of repeated or serious breach, terminate the affected Service in accordance with the Standard Terms;

make any disclosure to a Carrier, regulator or law enforcement body where required.

The Customer acknowledges that WIT is not obliged to monitor traffic but may do so where reasonably necessary to protect the Service, the Customer, other customers or the network.

Changes to this AUP

WIT may amend this AUP from time to time. The current version is published at https://www.wit-support.uk/wit-aup. Material changes will be notified to active customers in writing (which may include by email) with not less than thirty (30) days' notice.

Continued use of a Service after notified changes take effect constitutes acceptance of the amended AUP.

Contact

Questions, abuse reports or requests for clarification in respect of this AUP should be sent to ticket AT wit-support.uk, marked "AUP".

POL24 Acceptable Use Policy · Version 1.0 · 19 May 2026

For Desktop, Network and Server Support

1. Mutual Indemnity

1.1 Each party (the “Indemnifying Party”) shall indemnify and keep indemnified the other party and its affiliates against all losses, costs, claims, damages and reasonable expenses arising from death or personal injury caused by the negligence of the Indemnifying Party or its employees, agents or sub-contractors.

1.2 Each party shall indemnify and keep indemnified the other party against all losses, costs, claims, damages and reasonable expenses arising from damage to or destruction of tangible property caused by the negligence or wilful default of the Indemnifying Party or its employees, agents or sub-contractors.

1.3 Nothing in this clause shall limit either party’s liability for fraud, fraudulent misrepresentation, or any other matter that cannot be excluded or limited by applicable law.

2. Insurance

2.1 WIT shall maintain throughout the term of this Agreement, and for at least one year following its termination or expiry, appropriate professional indemnity insurance and public liability insurance in amounts adequate to meet its potential liabilities under this Agreement. Evidence of current insurance cover shall be provided to the Client upon reasonable written request.

3. Announcements

3.1 Neither party shall make any public announcement, press release or marketing reference in connection with this Agreement, or use the other party’s name, trade mark or trade name in any disclosure, without the prior written consent of the other party, such consent not to be unreasonably withheld or delayed. This clause shall not prevent either party from making any disclosure required by law or by a regulatory body of competent jurisdiction.

4. Definitions

4.1 “WIT” Workshop IT.

4.2 “The Client” The Company to which WIT provides services as set out in the Agreement.

4.3 “The Service(s)” Services provided by WIT to the Client and referenced by these Terms.

4.4 “Agreement” A document setting out the specific details of the Service provided by WIT to the Client and signed by both parties prior to commencement of the Service. This Agreement may be amended over time by written authorisation of both parties.

4.5 “The Contract” Formed of the Agreement together with these Terms.

4.6 “Remote support” Technical support provided by WIT to the Client virtually and from a remote location.

4.7 “Onsite support” Technical support provided by WIT to the Client by physically attending the Client’s office or other location.

4.8 “Termination date” means the effective date on which a Service terminates in accordance with the applicable Agreement Period.

5. General

5.1 This document sets out the Terms for WIT’s standard Services.

5.2 Specific details of the Services to be provided, associated dates and fees and any agreed adjustments to these Terms are set out separately in the Agreement.

5.3 The duration of each Service (“Agreement Period”), including any initial term, renewal terms and applicable notice periods, shall be as set out in the relevant Agreement or Order Form.

5.4 These Terms may be amended from time to time, subject to proper and reasonable written notification by WIT.

5.5 General work hours are between 08:30 and 18:00, Monday to Friday, excluding public holidays. WIT also closes the office over the festive period.

5.6 Support requests should be made by email to ticket@wit-support.uk or by calling 020 7183 0498. Urgent and emergency out-of-hours requests should be made by telephone (leaving a detailed message if necessary) to ensure the matter is communicated and received.

5.7 WIT aims to respond to all support requests within one hour within working hours wherever possible and resolve problems as soon as possible thereafter.

5.8 Emergencies outside of working hours should be reported by calling 020 7183 0498 and leaving a detailed voicemail. We will assist in any such instances with reasonable endeavour. WIT reserves the right to determine what constitutes an ‘emergency,’ and any out-of-hours requests deemed not to be an emergency will be actioned during the next working day.

5.9 WIT will make all reasonable efforts to achieve the best possible standards of service and assume responsibility for any interruption to Services where this can be determined to be the fault of WIT or one of its suppliers.

5.10 Should the Client experience any serious disruption due the action or inaction of a staff member from WIT, then any remedial work will be undertaken at no charge and with all due consideration to the Client.

5.11 Performance of IT Services, where managed by WIT, will be reported to the Client on a regular basis.

5.12 WIT will aim to meet with key Client staff on a regular basis to discuss performance and develop IT strategy where appropriate.

5.13 Secure software enabling WIT to access a Client’s desktop or server may be utilised when required for Remote support.

5.14 Where WIT provides hardware for the provision of a Service and such hardware is located at the Client’s office, then the Client is responsible for the security of the hardware and agrees to pay for any damage or replacement hardware if the equipment is damaged or stolen.

5.15 WIT may host certain Services at one of its secure data centres.

5.16 Additional work requested by the Client which falls outside of the Scope of Services set out in the Agreement and these associated Terms will be considered Project Work.

5.17 WIT will liaise with other third parties where necessary and in relation to the Services provided.

6. Scope of Services

6.1 Infrastructure Support: Network, Servers and Server-based Services

6.1.1 WIT will aim to maintain availability across the Client’s computer network, servers and server-based services. The scope of service provision includes:

6.1.1.1 Close monitoring of hardware, server-based services and the network utilising monitoring software;

6.1.1.2 Pro-active maintenance when required to minimise the risks of problems and disruption;

6.1.1.3 Emergency support when critical services are disrupted;

6.1.1.4 Security and software update application;

6.1.1.5 Appropriate use of backup and recovery processes to protect the running of services;

6.1.1.6 Liaison with third-party service providers, including Internet Service Providers (ISPs) relating to the Client’s IT infrastructure;

6.1.1.7 Regular reporting of the performance of IT services and critical issues;

6.1.1.8 Assistance in the development of an ongoing IT strategy.

6.2 Infrastructure support services will generally be provided remotely, with visits made to site when required.

6.3 Installation or reconfiguration of services may be considered Project Work and will be assessed on request.

6.4 WIT will make every reasonable effort to enable rapid recovery in the event of service disruption.

6.5 Any maintenance that may cause potential disruption to Services will be agreed with the Client in advance and may be scheduled over a lunchtime or out-of-hours.

6.6 Emergency work, such as a critical service failure, may require immediate maintenance to prevent disruption or the prolonging of disruption. Wherever possible WIT will liaise with the client in such instances, although if the Client is unavailable or the incident occurs outside of working hours then WIT may undertake any appropriate action deemed necessary and follow this with a report to the Client.

6.7 Service fees are based on the number and type of devices to be supported and the scope and size of the network. This will be assessed on a regular basis and any adjustment agreed in writing with the Client.

6.8 Backup Services

6.8.1 In most cases, WIT backup services will consist of local and offsite backups unless otherwise agreed upon with the Client. Tape backup will be invoiced separately if agreed and based on the relevant frequency.

6.8.2 Local Backup

6.8.2.1 Local backup is provided to enable rapid retrieval of data due to everyday issues such as inadvertent deletion or corruption. Local backup may be stored on both the primary and/or a separate backup server, and backup systems may be utilised as deemed appropriate.

6.8.2.2 Files captured by the backup system may be restored directly by the user or by request of WIT. Backups will take place at an agreed frequency and will be retained for a configurable period on local hardware.

6.8.2.3 Local backup may be lost if there is a serious failure of the hardware hosting this service.

6.8.2.4 The Service may not successfully backup files which are open at the time it runs. Clients are encouraged to have a policy advising users to save their work regularly to the server and close files when not working on them.

6.8.2.5 Should backup data exceed the storage available then WIT may delete backups, commencing from the oldest date, to enable the Service to continue to run. WIT may also reconfigure the backup retention period to enable the Service to continue to run within available storage. WIT will liaise with the Client in such instances.

6.8.2.6 Backup is charged per TB of total storage supported or per server, depending on what type of backup is in place.

6.8.3 Offsite Backup

6.8.3.1 Offsite backup is generally provided for disaster recovery purposes, ie: to enable the recovery of data and services in the event of a serious problem befalling office-based equipment and services which renders them inoperable or inaccessible.

6.8.3.2 Offsite backup will occur at a frequency determined by WIT and agreed with the Client, which is dependent on a number of elements including internet connectivity, server and service type, the anticipated amount of data to be supported and the backup service chosen. Fileserver backup is usually backed up every hour, whereas other services will usually be backed up daily.

6.8.3.3 Changes will be copied over the internet to offsite storage hosted at one of WIT’s secure datacentres. Only the latest changes will be retained on the offsite backup to provide a mirror of the current data.

6.8.3.4 If the Client creates a large amount of new data on the server, then the offsite backup may not be complete due to the amount of data that then has to copy over the internet within the frequency window. The re-structuring or re-naming of folders already on the file share may also cause this problem. In any event, the Client should always discuss such actions with WIT in advance, where possible, to ensure the offsite backup can be properly managed. If the offsite backup cannot be properly brought up-to-date remotely, then a manual disk catch-up may be required, which will be chargeable at standard project rates.

6.8.3.5 Backup data is encrypted in transmission using SSH protocol.

6.8.3.6 If data is ever moved physically between the Client site and the backup location, disk encryption will be used to protect the data whilst in transit.

6.8.3.7 The offsite backup may also not complete if the Client suffers serious and continued disruption to their internet connection. In such instances WIT will liaise with the ISP to try and resolve the problem and bring services back online. During such a period WIT cannot guarantee the offsite backup server, and a manual disk catchup may need to be run in order to bring the offsite copy back up to date.

6.8.3.8 Where the offsite backup is out-of-date and this can be determined to be the fault of WIT, then WIT will undertake a manual backup free of charge and within four working days of the last complete backup.

6.8.3.9 Backup services are monitored and audited daily and the Client will be informed if problems occur that result in the offsite backup becoming out of date by more than three consecutive working days.

6.8.3.10 Data from the offsite backup may be provisioned at a location in Central London within 24 hours in the event of an emergency. Depending on the amount of data backed up, only critical data may be provisioned within the initial 24 hours, with other data following in agreed phases.

6.8.3.11 The Service does not include the provision of server hardware, the reconfiguration of servers or networks, or any other aspects of disaster recovery that would attract additional project and equipment charges. The Client is expected to have a Disaster Recovery Plan in place to meet their agreed recovery time objectives (WIT can assist with the technical aspects of such a plan).

6.8.3.12 Offsite backup is charged per TB of total storage supported.

6.8.3.13 WIT will securely delete any client data on termination of the service.

6.8.4 Tape Backup

6.8.4.1 Tape backup of offsite backup data is provided as an additional chargeable service. The backup is written to LTO standard tape media using open standard data formats. This service is subject to a minimum quarterly order.

6.8.4.2 Unless otherwise stated, all of the Client’s hosted data will be written to tape using the open-source ‘Bacula’ programme: http://www.bacula.org/en/

6.8.4.3 Each tape set will be provided directly to the Client once the backup is prepared.

6.8.4.4 The backup catalogue and instructions on how to retrieve data are provided on a DVD to accompany each tape backup set.

6.8.4.5 The Client is thereafter responsible for the storage and security of the backup tapes. Tape sets must be kept together with the accompanying DVD to ensure future access. Tapes must also not be subject to extreme heat or cold, magnetic forces or physical damage (such as dropping), which can prevent future accessing of data.

6.8.4.6 Any files open at the time of the original offsite backup may not be successfully written to tape.

6.8.4.7 The Client may request that WIT retrieve data from any tape set provided under this Service, and such requests will be subject to additional charges based on our standard project rates.

6.8.4.8 Tape backup is charged per TB written to tape or per server if multiple servers are backed up in this manner.

6.8.5 “Cloud” Long-Term Retrieval

6.8.5.1 In place of magnetic tape, as described above in section 6.8.4, The Client may opt for back up to a cloud provider (eg: WIT:BKP, Azure, AWS, etc) for long term retrieval capability. This is an additional chargeable service.

6.8.5.2 Backups to the selected cloud storage provider will occur quarterly. This allows for data to be written before it rotates out of the local fileserver backup retention window.

6.8.5.3 Any files open at the time of the backup may not be successfully committed.

6.8.5.4 The Client will not have direct access to these backups. Restoration requests will be actioned by WIT.

6.8.5.5 Restoration requests may be subject to additional charges based on our standard project rates. This will be confirmed with the client prior to commencement of the work.

6.8.5.6 The cost for this service is dependent on the amount of data being backed up, and the cost per GB or per TB of the storage provider. This will be confirmed with The Client before signing the order form. Implementation or Project Costs may also be levied.

6.9 Business Continuity / Disaster Recovery Solutions

6.9.1 Our business continuity solutions provide near time recovery in the event of a disaster through the replication of services to our datacentres.

6.9.2 Replicated servers can be made available for remote access in the event of a disaster, enabling the Client to continue to use such services with minimal downtime.

6.9.3 The enabling of replicated servers and access to such services are subject to protocols agreed upon with the Client.

6.9.4 The Service will include live testing once per year at a time agreed upon with the Client. Additional tests, if requested, will be subject to project fees.

6.9.5 The Service is subject to continual monitoring. If the Service experiences disruption of more than one working day the Client will be notified.

6.9.6 If the service is subject to disruption of more than one working day, and that cause can be determined to be the fault of WIT, then a rebate will be applicable based on the amount of downtime experienced by the service and totalling an equivalent percentage of the monthly fee.

6.9.7 Any maintenance that will entail a suspension of replication of more than one day will be agreed with the Client in advance.

6.10 Firewall Provision

6.10.1 WIT may provide firewall hardware as part of the Service and, in such cases, rapid replacement of hardware in the event of a failure.

6.10.2 Our Firewall service includes configuration and maintenance of firewalls, including configuration of VPN access for the Client when requested from authorised personnel.

6.10.3 Firewall service charges are based on the scope of the service and the number of devices to be supported.

6.11 Desktop Support

6.11.1 Desktop Support services provide technical support to Client staff in relation to their desktop PCs and Macs, laptops, tablets, smartphones and VoIP telephones.

6.11.2 Desktop support services are provided as a mix of Onsite and Remote support.

6.11.3 Service charges are based on the number of users to be supported by WIT. This will be reviewed and assessed on a regular basis and any adjustment in fees agreed with the Client.

6.11.4 WIT’s provision of desktop support may include:

6.11.4.1 The setup, maintenance and support of workstations and user accounts, including installation of applications, software and security updates, hardware and software upgrades, email accounts and network connections;

6.11.4.2 Responding to users’ technical requests in a timely manner, including keeping them updated on issues affecting them when pertinent;

6.11.4.3 Providing general orientation for users on workstations when necessary;

6.11.4.4 Liaison with key Client staff on operational issues, such as purchasing, new and departing staff, office moves and building works;

6.11.4.5 Liaison and coordination with third parties on technical issues;

6.11.4.6 Assistance with the management of IT assets.

6.11.5 Onsite support hours will generally be undertaken at the Client’s main office but may also be provided at other sites within a reasonable travelling distance as and when required.

6.11.6 Support issues should be reported to WIT by emailing ticket@wit-support.uk.

6.11.7 Support requests will be prioritised depending on reported or apparent urgency or as directed by the Client.

6.11.8 Support requests will be logged and tracked in our ticketing system.

6.11.9 WIT will refer issues requiring onsite action to the next available onsite support session or schedule an interim visit if the matter is urgent.

6.11.10 If a request is urgent or WIT have not responded to a submitted request within a reasonable time (i.e. 30–60 mins), then the Client should call the office to ensure the request is being actioned.

6.11.11 If a Client has an emergency out of hours request they should call the office number and leave a detailed voice message. This will be texted to our team to ensure a faster response than an email.

6.11.12 Any desktop support work required outside of the general work hours or scope of service stated above will be considered Project Work.

6.12 Project Work

6.12.1 Any work falling outside of the scope of services outlined above should be considered Project Work.

6.12.2 The scope, time and rate of Project Work will be agreed in advance in writing with the Client wherever possible.

6.12.3 Project Work rates will be communicated to the Client at the commencement of the Agreement, and any changes in such rates thereafter will be provided to the Client with reasonable written notice.

6.12.4 Formal written authorisation from the Client will be required for all Project Work. The Client agrees to provide such authorisation after the work has been undertaken in the event that the work is required at short notice due to an emergency and the necessary authorising representative of the Client cannot be contacted prior to the work being carried out. WIT will make reasonable attempts to contact the Client in all such instances.

6.13 Exclusions

6.13.1 WIT will not be accountable for:

6.13.1.1 Any work or cost generated due to the failure of the Client to provide an adequate internet link, hardware or internal network to enable effective provision of Services;

6.13.1.2 Any disruption to Services where this is due to the actions or inactions of or services provided by any other party which might impact on the Services provided by WIT;

6.13.1.3 Any adverse impact on the performance of the Service is due to other hardware, software, or services employed by the Client that are not managed by WIT.

6.13.2 WIT staff will not install software on Client machines where it is known that such an undertaking would be a contravention of any relevant licensing agreement. In such instances and wherever possible, WIT will advise the Client of licensing requirements and the proper action to follow. This does not mean that WIT will always be aware of all licensing requirements for any specific software and take no liability for such aspects. It is expected that the Client is aware of any licensing requirements that they agree to when sourcing any software or service.

7. Service Fees and Payment

7.1 Fees for the Service are set out in the Agreement.

7.2 Charges may be subject to adjustment from time to time and will be notified to the Client with reasonable written notice.

7.3 Fees will be invoiced in advance on a monthly basis unless an alternative payment term is set out.

7.4 Payment for ongoing services must be received within 14 days of the date of the invoice.

7.5 Payment for recurring fees should be made by Standing Order wherever possible.

7.6 Payment for hardware, software or project work is to be made at the point of order.

7.7 If a project scope is expanded due to change requests made by the Client after a project fee has been agreed then additional fees may be chargeable and invoiced at the completion of the project. Wherever possible this will be agreed in writing with the client and in advance of the additional works being undertaken.

8. Disputes

8.1 In the event of any dispute arising under or in connection with this Agreement, the parties shall first attempt to resolve it informally. The dispute shall be referred in writing to the day-to-day contract representatives of each party, who shall use all reasonable endeavours to resolve it within five Working Days of referral.

8.2 If the dispute is not resolved under clause 8.1, it shall be escalated to a director or senior manager of each party, who shall use all reasonable endeavours to resolve it within a further five Working Days.

8.3 If the dispute remains unresolved following the steps above, either party may commence legal proceedings. The parties agree that this escalation process shall be completed before proceedings are issued, except where either party seeks urgent injunctive or other interim relief.

8.4 WIT shall continue to provide the Services in accordance with this Agreement during any dispute resolution process, and the Client shall continue to make payment as per the payment terms set out in this Agreement.

9. Termination of Services

9.1 Either party may terminate a Service by providing written notice in accordance with the notice period specified for that Service in the relevant Agreement or Order Form.

9.2 Prior termination of the Contract by the Client will incur cancellation fees totalling the remaining fees payable for the contract duration, except in cases when WIT can be proven to be in serious breach of the terms of this Contract.

9.3 On termination or expiry of this Agreement for any reason, WIT shall, within 30 days: (a) return to the Client all Client data in its possession, or if requested by the Client, destroy it and certify in writing that destruction has been completed; (b) provide reasonable assistance to the Client or its nominated successor provider with the migration of data and services, including provision of helpdesk logs and relevant technical records for the preceding twelve months; and (c) cease all processing of Client data and co-operate to ensure an orderly handover of the Services.

9.4 Transition assistance beyond standard handover may be subject to charge at WIT’s then-prevailing day rates, which will be agreed with the Client in advance.

10. Data Protection

10.1 As a Data Controller, WIT fully adhere to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. A copy of our Data Protection Policy is available on request.

10.2 WIT ensure that the following principles are met with regard to the protection of personal data:

10.2.1 Lawful, fair and transparent processing;

10.2.2 Legitimate and justified collection;

10.2.3 The limitation of collecting and processing data in line with specified and relevant purposes;

10.2.4 The maintenance of accurate data;

10.2.5 The retention of data for no longer than is legitimately required;

10.2.6 Appropriate security to maintain the protection and integrity of data.

10.3 WIT’s services, systems and processes are designed with these data protection principles in mind and are subject to regular review to ensure continued adherence, improvement and effectiveness.

10.4 Data Processing

10.4.1 WIT may function as a Data Processor on behalf of our Clients (the controller) where we host or manage their data. In addition to the general data protection terms set out above WIT, when acting as a data processor, will:

10.4.1.1 Ensure that the detail of any processing service is set out in the relevant service terms;

10.4.1.2 Take the signing of a service agreement as written instruction to undertake the specified processing of data;

10.4.1.3 Ensure that any WIT employees or contractors involved in the processing of client data are subject to a duty of confidence;

10.4.1.4 Take appropriate measures to ensure the security of the processing;

10.4.1.5 Only engage sub-processors with the explicit and prior consent of the data controller under written contract;

10.4.1.6 Ensure the controller can meet their GDPR requirements with respect to data access, security, breach notification and impact assessments;

10.4.1.7 Delete and return all personal data as requested to the controller as requested at the end of the contract;

10.4.1.8 Submit to audits and inspections; provide adequate information to the controller to ensure they are meeting their data protection obligations;

10.4.1.9 Notify the controller if there is any request or requirement which would involve the infringement of GDPR or other relevant data protection laws.

10.4.2 The Client, in respect of these services, remains the data controller and therefore retains all obligations and rights inherent in such a role and should ensure that their policies and systems adequately support these responsibilities.

11. Information Security

11.1 WIT are committed to ensuring effective security is in place to protect Company and Client information and to minimise the potential for financial, operational or reputational damage through the unauthorised accessing of information or loss of business continuity.

11.2 WIT are certified in ISO 27001 for Information Security Management and commit to maintaining this accreditation with annual audits and recertification.

11.3 All WIT systems, services and processes are subject to regular risk assessment, mitigation action and continual improvement with respect to information security.

11.4 All WIT employees receive information security training as a core element of their induction and remain involved in the Company’s continual assessment and improvement processes.

11.5 The continued security of a Client’s information is also dependent on the Client’s own processes, systems and behaviour. WIT will assist with advice on best practice and provide strategic input where appropriate, but the serious engagement of the Client and their effective support of good practice amongst their employees is necessary to properly minimise information security risks, and WIT will not take responsibility for information security incidents where this is not in place.

11.6 It is recommended that the Client undertake a minimal annual review of their information security, with the involvement of WIT to advise on IT aspects of this area.

12. Confidentiality

12.1 WIT, by virtue of our service provision, will have access to Client’s confidential information and, therefore, commit to:

12.1.1 Strict confidentiality with respect to client data at all times;

12.1.2 Never access data, assets or services without legitimate cause;

12.1.3 Never read, copy, share or reference client information without the express instruction of the Client;

12.1.4 Manage the access of WIT employees to Client data in respect to their responsibilities;

12.1.5 Notify the Client if we become aware of a breach of these principles.

13. Restrictive Clause

13.1 Neither party shall, without the prior written consent of the other party, directly or indirectly solicit, induce, recruit, or attempt to entice away any employee, contractor or consultant of the other party who has been involved in the performance or receipt of the Services at any time during the term of this Agreement. This restriction applies during the term of this Agreement and for a period of twelve months following its termination or expiry, howsoever arising. This clause does not apply to bona fide general recruitment advertising not specifically directed at employees of the other party.

14. Force Majeure

14.1 Neither party shall be liable for failure to perform its obligations under the terms of this Contract if such failure results from circumstances beyond the party’s reasonable control.

15. Liability

15.1 The total liability of WIT to the Client as a result of any breach of any terms of the Agreement shall not exceed the service charge paid by the Client to WIT over a 3 month period, unless and to the extent that such liability (if any) is one against which WIT is effectively insured and such insurance has not been vitiated by any act or default of the Client in which case the total liability of WIT to the Client shall not exceed £1,000,000.

15.2 Neither party shall in any event be liable for indirect losses or consequential losses or losses of profit by the other or any third party.

15.3 The parties acknowledge that they have negotiated and agreed this limitation of liability, that it reflects a fair and reasonable allocation of risk between them having regard to the nature of the Services and the Charges payable, and that it satisfies the requirement of reasonableness within the meaning of the Unfair Contract Terms Act 1977.

Workshop IT Ltd — Standard Terms and Conditions. Revision 9.4. Effective 20 April 2026.

Workshop IT Ltd · Third parties engaged to process personal data on WIT's behalf in the delivery of managed IT services

This page lists the third parties that Workshop IT Ltd ("WIT") engages to process personal data on its behalf in the delivery of managed IT services. These parties act as sub-processors under Article 28 of the UK General Data Protection Regulation and the Data Protection Act 2018, and are subject to WIT's Data Processing Agreement (Schedule 3 to the WIT Master Services Agreement).

WIT will notify clients in writing at least 30 days before making any material addition or change to this list. Clients who object on reasonable grounds should contact legal@workshopit.co.uk within 14 days of notification.

Note for MSP clients: Some sub-processors listed below operate within your own IT environment under WIT's management (for example, endpoint security and remote monitoring tools). These tools are deployed and operated by WIT on your behalf; the underlying data remains yours. Where a tool operates solely within your own tenancy or infrastructure, WIT's sub-processor relationship covers its management of that tool, not the tool itself.

IT Service Management

Infrastructure and Cloud

Security and Device Management

Communications

Finance and Administration

Artificial Intelligence Platforms

Client Rights and Opt-Out

Clients may object to the addition of a new sub-processor by contacting legal@workshopit.co.uk within 14 days of receiving written notice of the change. WIT will work in good faith to resolve any reasonable objection.

Clients may separately opt out of Client-Specific External AI use (the use of AI platforms outside the Microsoft 365 tenancy on work involving their identity, systems, staff or data) at any time:

Send written notice to security@workshopit.co.uk. AI opt-out takes effect within 10 working days of receipt and does not affect other sub-processors or disable tenant-resident AI features operating within your own M365 tenancy.

Questions and Full Annex

This page reflects WIT's current active sub-processors. A complete Schedule 3 Annex, including details of transfer mechanisms for non-UK sub-processors, is available on request from legal@workshopit.co.uk.