Privacy and Cookie Notice

Last updated: 22 October 2026

This notice explains how Cambition IT Services Limited (“Cambition”, “we”, “us”) collects and uses personal data about people who visit cambition.co.uk, contact us, or are prospective clients. It reflects the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR) and the Data (Use and Access) Act 2025.

1. Who this notice covers, and who it doesn’t

This notice covers:

• visitors to cambition.co.uk
• people who contact us through the website, by email or by phone
• prospective clients and their staff, and business contacts.

It does not cover personal data we process when we provide IT services to clients. For that data the client is the controller and we act as its processor, under condition 11 and Schedule 3 of our Terms and Conditions. Clients’ staff should read their employer’s privacy notice. We never use client service data for our own marketing (Schedule 3, paragraph 3.3).

2. Who we are (the controller)

The controller is Cambition IT Services Limited, a company registered in England and Wales under company number 08084429.

• Registered office: 6th Floor, Amp House, Dingwall Road, Croydon CR0 2LX
• Trading address: Unit 7, Church Meadows, Haslingfield Road, Barrington, Cambridge CB22 7RG
• Data protection lead: Jamie Stuart, Managing Director
• Data protection contact: ambitious@cambition.co.uk · +44 (0)1223 656 156

We have not appointed a Data Protection Officer, because the law doesn’t require one for a business like ours. Jamie Stuart, our Managing Director, leads on data protection. Please send privacy questions to ambitious@cambition.co.uk.

3. What we collect

We don’t seek special category data such as health information. Please don’t send it to us through the website.

4. How we use it, and our lawful basis

Where we rely on legitimate interests, we have balanced them against your rights. You can ask us for details of that assessment.

5. How long we keep it

6. Who we share it with

We don’t sell personal data. We share it only with suppliers who process it on our behalf under contract, or where the law requires us to:

• Microsoft (Microsoft 365 / Exchange Online): email and business records
• Google (Google Analytics through Site Kit, only after you opt in; reCAPTCHA): analytics and spam protection
• Microsoft (Azure): the website runs on our own server, a Microsoft Azure virtual machine in a UK datacentre, and server and security logs are stored there
• X.AI LLC (Grok), USA: AI assistants we use to run our business. They may process the content of enquiries and prospect correspondence, for example to help draft replies or organise records
• professional advisers, insurers, and authorities where the law requires it.

The suppliers we use to deliver services to clients are listed on our Sub-processors page.

7. International transfers

Some suppliers process data outside the UK. These include Google and X.AI LLC (Grok) in the United States. When personal data leaves the UK, we rely on UK adequacy regulations (for example the UK–US Data Bridge, where the recipient is certified) or appropriate safeguards. Our transfers of enquiry and prospect data to X.AI LLC are restricted transfers, and we make them under appropriate safeguards: the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. We also check that the transfer meets the data protection test in UK law. You can contact us for details of the safeguard that applies.

8. Marketing

We market only to businesses and their staff, never to consumers. Under PECR:

• We may email corporate addresses (for example name@company.co.uk) about our IT services on the basis of legitimate interests. Every message gives you a simple way to opt out.
• We won’t send marketing to personal or sole-trader email addresses unless you have consented, or you have bought or asked about similar services from us and didn’t opt out when we collected your details.
• We won’t make marketing calls to a number registered with the Corporate Telephone Preference Service unless you have told us you’re happy to hear from us.

You can opt out at any time by using the unsubscribe link or by contacting us (section 2). As our Terms and Conditions state, we never use client service data for our own marketing.

9. Your rights

You have the right to:

• access your personal data. We will make reasonable and proportionate searches.
• rectification of inaccurate data
• erasure
• restriction of processing
• object to processing based on legitimate interests, and an absolute right to object to direct marketing
• data portability, where processing is based on consent or contract and carried out by automated means
• withdraw consent at any time, for example to analytics cookies. Withdrawal doesn’t affect processing that has already taken place
• not to be subject to solely automated decisions with legal or similarly significant effects. We don’t make such decisions.

We will usually respond within one month. We may extend this by up to two months for complex requests, and we will tell you if we do.

10. Complaints

If you are unhappy with how we have handled your data, please complain to us first using the contact details in section 2. Under the Data (Use and Access) Act 2025, we will acknowledge your complaint within 30 days, look into it without undue delay, and tell you the outcome.

You can also complain to the Information Commission (formerly the Information Commissioner’s Office, ICO), the UK’s data protection regulator:

• Website: ico.org.uk/make-a-complaint
• Phone: 0303 123 1113
• Post: Information Commission, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

11. Cookies and similar technologies

Strictly necessary

These cookies are needed for the site to work or to keep it secure, so they don’t need your consent:

Analytics (only with your consent)

Marketing (only with your consent)

Third-party embeds

Our Contact page includes an embedded Google Map. Google may set cookies when the map loads.

Analytics cookies are off by default. We set them only after you click “Accept” in the cookie banner. The Data (Use and Access) Act 2025 adds a PECR exemption for some analytics used solely to improve a website, provided visitors get clear information and a simple way to object. That exemption depends on conditions and on regulations and Information Commission guidance coming into effect. Google Analytics shares data with a third party, so we don’t rely on the exemption. We ask for your consent instead.

Changing your choice: use the “Cookie settings” link in the footer at any time. You can also delete or block cookies in your browser settings. Some site features may not work if you block strictly necessary cookies.

We link to LinkedIn but don’t place LinkedIn tracking cookies. Cookie names and durations set by third parties may change from time to time, and we review this table regularly.

12. Links to other sites

This notice doesn’t cover other websites we link to. Please read their own privacy notices.

13. Changes to this notice

We will update this notice when our practices or the law change, and revise the “Last updated” date at the top. See also our Terms and Conditions and Sub-processors list.