privacy policy
Office Ready Technology is committed to protecting and respecting your privacy. This Privacy Policy outlines how we collect, use, store, and protect your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
This policy applies to all personal data we process in the course of providing our IT services, operating our website, or carrying out our business activities.
Office Ready Technology is a UK-registered IT company providing technology solutions and support services. Our registered office is at: Thorpe Hall, Wycliffe, Barnard Castle, Co Durham, DL12 9TW. Company registration number: 12107369.
Office Ready Technology is committed to protecting the privacy of individuals who use our services or even if you are just visiting our website
Personal Data
From Clients and Users
- Full name
- Job title
- Company name
- Contact information (email address, phone number, address)
- Payment and billing information
- Technical information (e.g. IP addresses, browser type, log-in activity)
- Communications (emails, messages, service requests)
From Website Visitors
- IP address
- Device type and operating system
- Browsing behavior (cookies, analytics)
From Job Applicants
- CVs and application details
- Employment history
- References and right-to-work documentation
From Job Applicants
- CVs and application details
- Employment history
- References and right-to-work documentation
Office Ready Technology processes information pertaining to the delivery of a service under contract, for each type of service this may include:
IT support
For the provisioning of helpdesk services, we will gather and use your staff names, your staff email addresses and your staff contact numbers.
Cloud services / Hosting
Where Office Ready Technology provide you with hosting and/or services, platforms such as Email, Hosted Storage, Virtual Machines, Remote Desktop we have no control over the data you upload to these services; therefore any processing that occurs as a result of the delivery of services is a legitimate interest for Office Ready Technology.
Any data that you upload, deemed to contain personally identifiable information or sensitive categories of data must be uploaded in accordance with current EU/UK law; for the avoidance of doubt this means that you must establish your own legal basis to process as a controller in line with The General Data Protection Regulation.
Office Ready Technology will not further process any information you upload to systems we maintain and govern except where we have a legitimate interest to process that overrides the rights and freedoms of others or where we have a legal obligation to do so.
We do also collect information about the devices that you may use but not necessarily own. This will include information such as make, model and software installed.
Cybersecurity
Where Office Ready Technology conduct Cybersecurity work for you, we may have access to several categories of sensitive information including but not limited to personal addresses, mobile phone numbers, health, bank details, passwords, national insurance ID etc.
These items may be collected as a result of in depth analysis of resources available online; namely the dark web or in locations detailing compromised records.
We also may have records pertaining to the number of times you have logged into a service that you have used, how you logged in, your geographic location and the device used. This information cannot identify you, however it can be used to identify trends pertaining to you and the use of our services.
Social media
We use social media to keep you informed about our products and services and also about news that may be of interest to you. We use Linked In social media services to achieve this.
How do we use the information we collect / process about you?
- The provisioning of Office Ready Technology services
- To manage contracts and billing
- To respond to enquiries and support requests
- To improve our services and user experience
- To meet legal, regulatory, and contractual obligations
- To carry out marketing (only with your consent or where lawful)
Data Retention
The length of time we retain your data will depend on the purpose for which we process it. We will retain your information for as long as you are contracted to receive a services from Office Ready Technology.
We may retain some of your data in server logs and backups of associated systems for a period of up to 7 years beyond the cessation of contracted services to comply with legal obligations such as regulation or for legal defense.
We may retain job applicant data for 12months (unless employed)
Sharing Your Data
We do not sell personal data. We may share your data with:
- Trusted third-party service providers (e.g. cloud hosting, payment processors)
- Professional advisers (e.g. accountants, legal advisers)
- Public authorities, where legally required
All third parties are required to respect the security of your data and to act in compliance with data protection law.
Where your data is transmitted internationally, outside of the EEA, we shall ensure that enforceable binding contracts are in place in the absence of a suitable data protection legislation. We will not conduct business where there is neither an enforceable contract nor a suitable data protection legislation.
Security
Office Ready Technology utilizes technical controls such as intrusion prevention and detection systems, anti-virus, firewalls, encryption, internet usage monitoring and role-based access to help protect your information from loss, destruction, misuse, unauthorized access or disclosure as part of our Cyber Essentials certification.
In addition, we utilize organizational controls such as policies and procedures as part of our ISO 27001 to govern the technical controls.
These two sets of controls combined together ensures that your data is held securely and safely and is only available to you and those you provide access to.
Other sites
Our website may contain links to other sites that are not controlled by us; therefore we are not responsible for the content or use of these services, whereas we always strive to vet our vendors and those we are associated with in a service provider capacity the use of services outside our control is at your own risk.
Updating your personal information
If you receive a service from Office Ready Technology, you can modify your personal information by sending us a request to hello@officeready.tech with the subject ‘Right to Rectification’.
GDPR rights
- Access your personal data
- Correct inaccurate or incomplete data
- Request erasure (the “right to be forgotten”)
- Restrict or object to processing
- Withdraw consent (where applicable)
- Lodge a complaint with the Information Commissioner’s Office (ICO)
Contact us
We are committed to providing excellent service, however if you have a complaint about your privacy or the use of your personal data and you are an existing customer of ours, please initially contact account manager.
Changes to our Privacy Policy
From time to time, we may amend this privacy policy to fall in line with changes to legislation, including from not limited to the General Data Protection Regulation 2016, Privacy and Electronic Communication Regulation 2003 and the Data Protection Bill 2017 – 2019.
MODERN SLAVERY POLICY
Office Ready Technology is committed to preventing modern slavery and human trafficking in all aspects of our business and supply chains. This statement is made in compliance with the Modern Slavery Act 2015 and outlines the steps we are taking to identify and mitigate the risks of modern slavery in our operations.
Office Ready Technology recognize that, while the risk of modern slavery in the IT sector is relatively low, it may exist in areas such as the sourcing of hardware components, third-party contractors, or outsourced services.
Our Commitment
- Ensuring that modern slavery and human trafficking have no place in our business or supply chains.
- Conducting our business ethically and in compliance with applicable labour laws and regulations.
- Promoting transparency and accountability throughout our organisation and supply chain.
Policies and Governance
We have implemented the following policies to reinforce our commitment:
All employees and contractors must adhere to our Code of Conduct, which promotes ethical practices and prohibits forced or exploitative labour.
Our suppliers are required to uphold the same standards, including prohibiting modern slavery and human trafficking in their operations.
We encourage employees and third parties to report any concerns, including suspicions of modern slavery, through our confidential whistleblowing channels.
This ensures fairness and inclusivity in recruitment, employment, and supplier engagement practices.
Risk Assessment and Due Diligence
- We assess the risk of modern slavery in our operations and supply chains, particularly in higher-risk sectors such as hardware manufacturing.
- New and existing suppliers undergo due diligence checks to ensure compliance with ethical standards, including modern slavery prevention.
- Suppliers are required to confirm adherence to our Supplier Code of Conduct.
- Our contracts include clauses requiring suppliers and contractors to comply with the Modern Slavery Act 2015.
- Regular audits of suppliers and internal processes to ensure compliance with our standards.
- This statement and our approach to modern slavery are reviewed annually to ensure effectiveness.
This Modern Slavery Statement reflects Office Ready Technology’s ongoing commitment to ethical business practices and our determination to combat modern slavery and human trafficking in all its forms.
expenses policy
The purpose of this policy is to define the rules and procedures for incurring and reclaiming business-related expenses. It ensures that all claims are legitimate, reasonable, appropriately authorised, and compliant with UK tax laws.
This policy applies to all employees, contractors, and directors of Office Ready Technology who incur expenses while carrying out business activities on behalf of the Company.
All expenses must be:
- Wholly, exclusively and necessarily incurred for business purposes
- Properly authorised by the relevant line manager
- Supported by original receipts or appropriate documentation
- Submitted promptly, ideally within 30 days of being incurred
Allowable Expenses
The following types of business expenses are generally allowable. Reimbursement is subject to approval and submission of valid documentation.
Travel
- Public transport: Standard class fare only
- Mileage: Private car usage reimbursed at HMRC-approved rates (45p per mile for the first 10,000 miles per tax year, 25p thereafter)
- Parking: Reasonable parking costs related to business travel (excludes any fines)
- Taxis: Permitted when public transport is unavailable, impractical, or time-sensitive
- Flights: Economy class for all domestic and short-haul travel
Accommodation
- Must be reasonable, cost-effective, and necessary for overnight stays on Company business
- Employees must minimise costs where possible (e.g. booking in advance)
Meals and Subsistence
- Reimbursed only when incurred during overnight stays or long-distance travel
- Alcohol is not reimbursable unless for approved client entertainment
Office Supplies and Equipment
- Small, ad hoc purchases (e.g. stationery, kitchen items) may be reimbursed with manager approval
Client Entertainment
- Must be pre-approved by a manager
- Must include a clear business purpose and list of attendees
- Must be pre-approved by a manager
Non-Allowable Expenses
- Personal items or services
- Home office furniture (unless pre-approved)
- Fines or penalties (e.g. parking, speeding)
- Upgrades to business class travel
- Unauthorised gifts or hospitality
Expense Claims Process
- All claims must be submitted using the Company’s approved expense claim system
- Original VAT receipts must be provided where possible
- Claims must be submitted within 30 calendar days
- Reimbursements will be processed on the 15th & 30th day of the month
Corporate Credit Cards
- Must only be used for business-related expenses
- Personal use is strictly prohibited
- Monthly statements must be reviewed and reconciled by the Finance Controller
- Misuse may lead to disciplinary action
Compliance and Auditing
- The Company reserves the right to audit expense claims and request further evidence
- False or exaggerated claims may result in disciplinary action, including dismissal
- Expense records must be retained in accordance with HMRC requirements (typically six years)
Roles and Responsibilities
Policy Review
This policy will be reviewed annually or sooner if there are changes to HMRC guidelines or Company practices.
ethics and anti-bribery policy
The purpose of this policy is to set out the ethical standards expected of employees, contractors, and directors of Office Ready Technology, and to provide clear guidance on the prevention of bribery and corruption in all aspects of the Company’s operations.
This policy aims to:
- Promote honest and ethical conduct
- Prevent bribery, fraud, and corruption
- Ensure compliance with the UK Bribery Act 2010
- Protect the Company’s reputation and stakeholder trust
This policy applies to:
- All employees, officers, and directors
- Temporary and contract staff
- Third parties acting on behalf of the Company (including agents, consultants, suppliers, and business partners)
Policy Statement
Office Ready Technology is committed to conducting business with integrity, honesty, and transparency. We operate a zero-tolerance approach to bribery and corruption and expect all associated persons to act in accordance with this policy at all times.
What Is Bribery?
A bribe is a financial or other advantage offered, promised, given, requested, or received to induce or reward the improper performance of a function or activity.
Examples include:
- Offering payment or gifts to secure a contract
- Accepting hospitality in exchange for business favours
- Making facilitation payments to speed up routine procedures
Bribery is a criminal offence under the Bribery Act 2010 and may result in prosecution of both individuals and the Company.
Prohibited Conduct
The following are strictly prohibited:
- Giving, promising, or offering a bribe
- Requesting, agreeing to receive, or accepting a bribe
- Making facilitation payments (e.g. unofficial payments to public officials)
- Using third parties to engage in bribery on the Company’s behalf
- Ignoring or failing to report suspected bribery or unethical conduct
Gifts and Hospitality
Gifts and hospitality may be accepted or offered only if:
- They are of low monetary value
- They are not intended to influence a business decision
Lavish or frequent gifts or hospitality are not permitted.
Donations and Sponsorships
Office Ready Technology does not make political donations. Charitable donations and sponsorships must:
- Be lawful and in line with the Company’s values
- Not be made to secure a business advantage
- Be approved by senior management
Lavish or frequent gifts or hospitality are not permitted.
Responsibilities
Raising Concerns (Whistleblowing)
Employees are encouraged to report any concerns regarding unethical or potentially illegal conduct. Reports can be made to:
- Line manager
- Senior management
All concerns will be investigated confidentially. There will be no retaliation against anyone raising a genuine concern in good faith.
Raising Concerns (Whistleblowing)
All employees will receive periodic training on ethics and anti-bribery. This policy will be included in induction packs and made available on Office Ready Technlogy’s internal system.
Third parties acting on the Company’s behalf may be required to sign an anti-bribery compliance statement.
Consequences of Breach
Breaches of this policy may result in:
- Disciplinary action, up to and including dismissal
- Termination of contracts with third parties
- Criminal prosecution for individuals and/or Office Ready Technology
Monitoring and Review
This policy will be reviewed annually by the Company’s management team or more frequently if necessary to reflect legal or regulatory changes.
cyber secuirity policy
The purpose of this policy is to outline Office Ready Technology’s commitment to protecting its digital assets, systems, networks, data, and users from cyber threats. It defines rules and procedures to ensure a secure working environment, reduce risk, and comply with relevant UK data protection and information security legislation.
This policy applies to all employees, contractors, consultants, suppliers, and third parties who access or use the Office Ready Technology’s IT systems, services, or data. It covers all devices (e.g. laptops, mobiles), infrastructure (e.g. cloud and on-premises), and digital assets (e.g. emails, software, source code).
Office Ready Technology is committed to maintaining the confidentiality, integrity, and availability of information and systems. All users are expected to adhere to this policy and follow best practices to help defend against cybercrime, data breaches, and unauthorised access.
Key Principles
- Protect data from unauthorised access or loss
- Maintain system availability and performance
- Prevent malware, phishing, and other cyber threats
- Comply with UK GDPR, Data Protection Act 2018, and other legal obligations
- Ensure security awareness among all staff
Roles and Responsibilities
Acceptable Use
- Users must not share passwords or account details
- Systems may only be used for legitimate business purposes
- Unauthorised software or hardware must not be installed
- Users must lock devices when unattended
- Remote working must follow secure access guidelines
Password and Access Control
- Passwords must be strong and include a mixture of characters, mixed case, symbols and numbers
- Multi-factor authentication (MFA) must be used where available
- Access is granted based on the principle of least privilege
- Accounts must be deactivated immediately upon termination of employment
Device and Endpoint Security
- All Company-owned devices must have approved antivirus/EDR software installed
- Devices must be encrypted
- Security patches and software updates must be applied promptly
- Personally owned devices (BYOD) must be registered and secured
Email and Internet Usage
- Email should be used professionally; phishing awareness training is mandatory
- Do not open suspicious attachments or click unknown links
- Internet access should be for work purposes only
- Company email addresses must not be used for personal registrations or services
Data Protection and Encryption
- Sensitive data must be stored in approved locations (e.g. SharePoint, OneDrive)
- USB drives must be encrypted and authorised before use
- Backups must be performed regularly and stored securely offsite or in the cloud
Cloud and Third-Party Services
- All cloud services must be assessed for security and compliance risks
- Data stored in third-party systems must be protected and aligned with UK GDPR
- Third parties must sign Data Processing Agreements (DPAs) where necessary
Cyber Incident Response
- All security incidents (e.g. malware, unauthorised access, data leaks) must be reported immediately to the Lead Systems & Security Engineer
- An Incident Response will be followed, including containment, investigation, and reporting
- High-risk breaches must be reported to the ICO within 72 hours as required by law
Training and Awareness
- All employees must complete cybersecurity awareness training annually
- New starters must complete induction training
- Regular simulated phishing tests and refresher training may be carried out
Monitoring and Auditing
- IT systems may be monitored for security, performance, and compliance
- Logs may be collected for auditing, incident analysis, and regulatory requirements
- Users should have no expectation of complete privacy on Company-owned systems
Compliance and Disciplinary Action
Breaches of this policy may result in:
- Disciplinary action (up to and including dismissal)
- Revocation of access rights
- Legal action or criminal prosecution where applicable
Policy Review
This policy will be reviewed annually, or sooner if significant changes occur in law, technology, or the threat landscape.
business continuity and disaster recovery policy
The purpose of this policy is to establish a framework for maintaining and restoring business operations in the event of a disruption, disaster, or emergency that affects the operations of Office Ready Technology. It outlines procedures to ensure critical business functions can continue or resume swiftly with minimal impact.
This policy applies to all Company departments, personnel, contractors, systems, and assets involved in the delivery of IT services and solutions. It covers incidents including, but not limited to:
- Natural disasters (floods, storms, fire, etc.)
- Cyber-attacks (ransomware, data breaches)
- Infrastructure failures (power outages, network disruptions)
- Pandemics or other public health crises
- Human error or sabotage
Office Ready Technology is committed to:
- Identifying and mitigating risks to business continuity
- Ensuring continuity of critical services to clients
- Protecting the safety and well-being of staff
- Minimising financial and operational impact
- Meeting legal, regulatory, and contractual obligations
Objectives
- Maintain continuity of operations during and after disruptions
- Recover IT systems and data in a timely manner
- Communicate effectively with stakeholders
- Define clear roles and responsibilities during an incident
Roles and Responsibilities
Business Continuity Manager (BCM)
- Maintains and tests the BCDR Plan
- Leads recovery efforts during an incident
- Reports to the Board on continuity preparedness
- Maintains data backup systems and recovery tools
- Ensures network redundancy and availability
- Assists in technical recovery efforts
Department Heads
- Identify critical business functions
- Develop department-specific continuity procedures
- Ensure team awareness and training
All Staff
- Familiarise themselves with BCDR procedures
- Participate in training and tests
- Follow incident response instructions
Business Impact Analysis (BIA)
Office Ready Technology will conduct a BIA annually to:
- Familiarise themselves with BCDR procedures
- Participate in training and tests
- Follow incident response instructions
Risk Assessment
A formal risk assessment will be conducted annually to identify potential threats and vulnerabilities. This will inform mitigation strategies and improvements to continuity plans.
Backup and Recovery Procedures
- Data Backups: All critical data must be backed up daily and stored securely both onsite and offsite (cloud-based or geographically separate data centres).
- System Recovery: Systems shall be restored according to their RTO and RPO values.
- Testing: Backups and restoration procedures must be tested quarterly.
Communication Plan
Office Ready Technology will maintain an up-to-date emergency contact list including employees, clients, vendors, and authorities.
Disaster Recovery Plan (DRP)
The DRP outlines step-by-step procedures to recover IT systems after a disaster. It includes:
- Incident detection and reporting
- Damage assessment
- System restoration order (priority-based)
- Resource allocation (personnel, equipment, suppliers)
- External vendors contact details
- Post-incident review
Training and Awareness
All employees must be trained annually in their roles within the BCDR framework. New starters must complete BCDR induction training.
Testing and Review
- Tabletop Exercises: Conducted twice annually to simulate different incident scenarios.
- Live Tests: Once a year, involving partial or full invocation of continuity procedures.
- Policy Review: This policy will be reviewed annually or following any significant change to the business or IT infrastructure.
.png)
.png)