Last updated: 22 October 2026
NWIMS Group is committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page explains how we meet those obligations, both for the personal data we hold about our own customers and contacts, and for the data we handle on behalf of business customers through our managed IT, hosting, backup and telecoms services.
For full details of what personal data we collect and why, please read our Privacy Policy.
Our two roles under GDPR
As a data controller – for the personal data of our customers, suppliers and website visitors (for example your contact, billing and support details), we decide how that data is used and are responsible for it.
As a data processor – when we host, back up, support or manage systems for a business customer, we may handle personal data that belongs to that customer (for example their staff or client records). In those cases our customer is the controller, and we process the data only on their documented instructions and for the purpose of providing the agreed service.
Data processing agreements
Where we act as a processor, our terms of service include data processing terms that meet the requirements of Article 28 of the UK GDPR. These cover:
- processing personal data only on the customer’s documented instructions;
- confidentiality obligations for everyone who has access to the data;
- appropriate security measures;
- using sub-processors only with the customer’s authorisation, under equivalent contractual terms;
- helping customers respond to data subject requests and meet their own GDPR obligations;
- deleting or returning data at the end of the service;
- making available the information needed to demonstrate compliance.
Business customers can ask for a copy of our data processing agreement and our current list of sub-processors at any time.
How we keep data secure
- UK data centre – hosting, backup and virtual servers run from our privately owned data centre in Kendal, Cumbria, with controlled access, CCTV, power protection and environmental monitoring.
- Encryption – data is encrypted in transit, and our online backup service encrypts data before it leaves your systems.
- Access control – access to customer systems and data is limited to authorised staff who need it to do their job, protected by strong authentication.
- Monitoring and protection – our network and systems are monitored, patched and protected with managed security tools.
- Remote support – remote support sessions are started only at your request or with your permission, and you can end a session at any time.
- Staff – all staff are bound by confidentiality obligations and receive data protection and security training.
Use of AI
We use AI tools, including an AI phone receptionist, to help our team respond quickly. These tools are used with human oversight and under contract with our providers. Full details are on our Use of AI page.
Data breaches
We have procedures to detect, investigate and respond to personal data breaches. Where we are the controller, we will report qualifying breaches to the ICO within 72 hours and tell affected individuals where required. Where we are a processor, we will notify the affected customer without undue delay so that they can meet their own obligations.
Making a data protection request
You can ask to access, correct, erase, restrict, object to or move your personal data. To make a request:
- email privacy@nwims.com; or
- write to NWIMS Group, Whinfell Business Park, Longpool, Kendal, Cumbria, LA9 6ER; or
- call 01539 266255.
We may need to confirm your identity before acting on a request. We will respond within one month, and there is normally no charge. If your request is about data we hold on behalf of one of our business customers, we will pass it to that organisation and help them respond.
Contact and complaints
NWIMS Communications Ltd (ICO registration ZA161688) and NWIMS IT Support Ltd (ICO registration ZA161683) are both registered with the Information Commissioner’s Office as data controllers.
If you have any questions about how we handle personal data, please get in touch using the details above. If you are not satisfied with our response, you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.