CLARION GROUP OF COMPANIES

PRIVACY POLICY

Last reviewed: 01/05/2026

1. Introduction

Clarion Communication Management Ltd and Clarion Communication Information Technology Ltd together referred to in this Privacy Policy as “Clarion”, “we”, “us” or “our”, are committed to protecting the privacy and security of personal data.

This Privacy Policy explains how Clarion collects, uses, stores and protects personal data when:

• providing our products and services;
• managing customer and supplier relationships;
• providing managed IT, systems integration, communications, connectivity, cloud, cybersecurity and related services;
• operating our websites;
• communicating with customers and prospective customers;
• undertaking sales and marketing activities;
• providing technical support;
• managing our employees, contractors and suppliers; and
• otherwise conducting our business.

Clarion is committed to complying with applicable UK data protection and privacy legislation, including the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (“PECR”), as amended from time to time.

 

2. Clarion’s role as Data Controller and Data Processor

Clarion may act in two different capacities when processing personal data.

 

2.1 Clarion as Data Controller

Clarion is a Data Controller when we determine the purposes and means for processing personal data ourselves.

Examples include personal data relating to:

• our customers and prospective customers;
• contacts within customer organisations;
• suppliers and business partners;
• website visitors;
• individuals who contact us;
• individuals attending our events;
• marketing contacts;
• job applicants;
• employees and contractors.

In these circumstances, Clarion is responsible for determining why and how the personal data is processed.

 

2.2 Clarion as Data Processor

As an MSP and technology services provider, Clarion may process personal data on behalf of our customers.

Where a customer determines the purposes and means of processing and Clarion processes personal data solely on the customer’s documented instructions, the customer is the Data Controller and Clarion is the Data Processor.

This may occur when Clarion provides services involving:

• managed IT services;
• systems integration;
• Microsoft 365 and cloud services;
• hosted services;
• email systems;
• backup and disaster recovery;
• cybersecurity;
• endpoint management;
• remote monitoring and management;
• service desk and technical support;
• hosted telephony and communications;
• connectivity services;
• network management;
• data storage;
• security monitoring; and
• other IT or communications services.

The distinction between controller and processor is important. A processor acts on behalf of the controller, while the controller determines the purposes and means of processing.

Where Clarion acts as a processor, the processing will be governed by the relevant customer contract and Data Processing Agreement (“DPA”).

 

3. Personal data that Clarion collects as Controller

Depending upon the nature of our relationship with you, Clarion may collect and process:

• name;
• job title;
• employer;
• business address;
• email address;
• telephone number;
• mobile telephone number;
• correspondence;
• information contained in enquiries;
• information about products and services purchased or considered;
• billing and payment information;
• account information;
• service and support information;
• information relating to meetings and communications;
• information relating to marketing preferences;
• IP addresses and technical information;
• website usage information;
• information obtained from publicly available sources; and
• other information reasonably necessary to conduct our business.

We seek to collect only information that is relevant and reasonably necessary for the purposes for which it is processed.

 

4. How Clarion uses personal data

Where Clarion acts as Controller, we may use personal data for:

 

Providing products and services

• providing products and services;
• administering customer accounts;
• delivering managed IT and technology services;
• providing technical support;
• managing service requests and incidents;
• communicating with customers;
• processing orders;
• administering contracts;
• processing payments and invoices; and
• maintaining and improving our services.

 

Business administration

• managing suppliers and business partners;
• maintaining business records;
• managing our systems;
• protecting our networks and information;
• detecting and preventing fraud and misuse;
• managing complaints;
• establishing, exercising or defending legal claims; and
• complying with legal and regulatory obligations.

 

Sales and marketing

We may use business contact information to communicate with individuals regarding Clarion’s products, services, events and other activities where permitted by applicable law.

 

5. Lawful bases for processing

Where Clarion acts as Controller, we will process personal data only where an appropriate lawful basis exists.

Depending on the circumstances, these may include:

• Consent – where an individual has provided valid consent;
• Contract – where processing is necessary to enter into or perform a contract;
• Legal obligation – where processing is necessary for compliance with a legal obligation;
• Legitimate interests – where processing is necessary for Clarion’s legitimate interests or those of a third party, provided those interests are not overridden by the individual’s rights and interests; and
• Vital interests – where necessary to protect an individual’s vital interests.

Public task is generally not expected to be a principal lawful basis for Clarion’s ordinary commercial activities.

 

6. B2B Marketing and Legitimate Interests

Clarion undertakes business-to-business marketing and sales activities in relation to our IT, communications, connectivity, cloud, cybersecurity, systems integration and related services.

For appropriate B2B marketing activities, Clarion may rely upon legitimate interests as its lawful basis for processing personal data.

Our legitimate interests may include:

• promoting and developing our business;
• identifying organisations that may benefit from Clarion’s products and services;
• communicating with relevant business contacts;
• developing customer relationships;
• generating new business; and
• providing information about products and services that may reasonably be relevant to an individual’s professional role.

Where we rely on legitimate interests, we consider whether:

1. we have a legitimate interest;
2. the processing is necessary to achieve that interest; and
3. the individual’s interests, rights and freedoms do not override our legitimate interest.

This is commonly referred to as a Legitimate Interests Assessment (“LIA”).

Clarion maintains appropriate records of its legitimate interests assessments.

The ICO confirms that legitimate interests for direct marketing requires consideration of the purpose, necessity and balancing elements of the assessment.

 

7. B2B marketing information

Clarion may process business contact information relating to individuals who work for organisations that we believe may have an interest in our products or services.

Our typical segmentation may include individuals working in:

• IT;
• technology;
• procurement;
• finance;
• operations;
• marketing;
• sales;
• business development;
• senior management;
• directors;
• owners; and
• other relevant business functions.

This list is not exhaustive.

The information we may process for these purposes can include:

• first name;
• surname;
• business email address;
• business telephone number;
• job title;
• employer;
• business address;
• LinkedIn or other professional social-media information;
• business IP address;
• organisation size;
• industry sector; and
• other business-related information relevant to our marketing activities.

We will seek to limit the information we collect to what is reasonably necessary for our business-to-business activities.

 

8. How Clarion obtains marketing data

Clarion may obtain business contact information from:

• enquiries made directly to Clarion;
• existing or previous business relationships;
• individuals who have requested information from us;
• referrals;
• events and meetings;
• business cards;
• professional networking activities;
• LinkedIn and other professional platforms;
• publicly available business information;
• company websites and other publicly available sources;
• business directories;
• third-party data providers; and
• other lawful sources.

Where personal data is obtained from a third party, Clarion will take reasonable steps to ensure that the data has been obtained and supplied lawfully and that appropriate information is provided to individuals where required.

 

9. Electronic marketing

Clarion may communicate with customers and prospective customers by:

• email;
• telephone;
• post;
• professional social media;
• online communications; and
• other appropriate business-to-business communication methods.

The rules governing electronic marketing differ depending upon the type of recipient and communication. Clarion will comply with applicable requirements under PECR and data protection legislation.

Where consent is required, Clarion will obtain appropriate consent before sending the relevant marketing communications.

Individuals may object to or opt out of marketing communications at any time.

The ICO’s current guidance confirms that the availability of legitimate interests as a UK GDPR lawful basis does not, by itself, remove separate requirements imposed by PECR.

 

10. Email tracking

Where permitted by applicable law, Clarion may use technologies within marketing communications to understand whether communications have been opened or links have been accessed.

These technologies may include tracking pixels, web beacons and individually coded links.

We may use this information to:

• measure the effectiveness of marketing campaigns;
• understand engagement;
• improve the relevance of communications;
• maintain the quality of our marketing database; and
• avoid sending unwanted communications.

Where applicable, individuals can opt out of marketing communications using the unsubscribe facility provided in the relevant communication or by contacting Clarion.

 

11. Special category data

Clarion does not generally seek to collect special category personal data for its own marketing or sales activities.

However, special category data may exist within customer systems that Clarion accesses when providing managed IT, cloud, cybersecurity, backup, support or other services.

Where Clarion processes such information as a Processor, it will do so in accordance with the customer’s documented instructions and the applicable DPA.

Where Clarion processes special category data as Controller, we will ensure that an appropriate lawful basis and any additional condition required by applicable law are in place.

 

12. Personal data processed on behalf of customers

Where Clarion acts as Processor, the customer remains responsible for determining:

• the purposes of processing;
• the lawful basis for processing;
• the categories of individuals whose data is processed;
• the types of personal data processed; and
• the privacy information provided to those individuals.

Clarion will process customer personal data only on the customer’s documented instructions, unless applicable law requires otherwise.

Clarion’s obligations as Processor will be set out in the applicable services agreement and DPA.

The ICO states that a written controller-processor contract is required and that it must cover matters including instructions, confidentiality, security, sub-processors, data-subject rights, assistance, deletion/return and audits.

 

13. Categories of customer data processed by Clarion

Depending upon the services provided, Clarion may process:

• names;
• addresses;
• email addresses;
• telephone numbers;
• usernames;
• account information;
• employment information;
• customer records;
• financial information;
• technical information;
• device information;
• IP addresses;
• authentication information;
• system logs;
• communications data;
• security information;
• information contained in emails and files; and
• other personal data contained within systems managed or supported by Clarion.

Customer systems may also contain special category data or information relating to criminal convictions and offences.

Clarion does not normally determine the content of such data and processes it on behalf of the customer.

 

14. Security of personal data

Clarion takes appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction, damage, alteration or disclosure.

Depending on the service and risk, measures may include:

• access controls;
• multi-factor authentication;
• encryption;
• endpoint protection;
• network security;
• vulnerability management;
• security monitoring;
• backup and recovery;
• access logging;
• physical security;
• staff confidentiality obligations;
• staff security awareness;
• incident management;
• business continuity arrangements; and
• regular review of security controls.

 

15. Data breaches

Clarion maintains procedures for identifying, managing and responding to information security incidents and personal data breaches.

Where Clarion is acting as Processor and becomes aware of a personal data breach affecting customer personal data, Clarion will notify the relevant customer without undue delay in accordance with the applicable DPA and law.

Clarion will provide reasonable assistance to enable the customer to meet its obligations concerning the breach.

 

16. Sub-processors

Clarion may use third-party providers to assist in delivering services.

These may include providers of:

• cloud services;
• Microsoft services;
• backup;
• cybersecurity;
• remote monitoring and management;
• service desk platforms;
• hosting;
• telecommunications;
• connectivity;
• data storage;
• security monitoring; and
• other technology services.

Where Clarion acts as Processor, such providers may constitute sub-processors.

Clarion will ensure that appropriate contractual arrangements are in place with sub-processors and will comply with the relevant authorisation and notification requirements under the applicable DPA.

The ICO states that a processor must obtain the controller’s prior specific or general written authorisation before engaging a sub-processor and must impose equivalent data protection obligations on that sub-processor.

 

17. International transfers

Some Clarion suppliers and technology providers may process information outside the United Kingdom.

Where personal data is transferred outside the UK, Clarion will ensure that the transfer is undertaken in accordance with applicable UK data protection requirements and that appropriate safeguards are used where required.

Where Clarion acts as Processor, international transfers of customer data will also be subject to the customer’s instructions and the applicable DPA.

 

18. Data retention

Clarion retains personal data only for as long as reasonably necessary for the purposes for which it is processed, taking account of:

• contractual requirements;
• legal and regulatory obligations;
• accounting requirements;
• business requirements;
• dispute resolution; and
• security and audit requirements.

 

Marketing data

Clarion may retain business marketing information while there remains a reasonable business purpose for doing so.

Where a contact has not demonstrated continuing interest in Clarion’s products or services, we will review the information and may delete or suppress it in accordance with our internal retention procedures.

Clarion’s marketing data will be subject to periodic review.

 

Customer data

Where Clarion acts as Processor, customer data will be retained, returned or deleted in accordance with the customer’s documented instructions and the applicable services agreement and DPA.

 

19. Data subject rights

Where Clarion is the Controller, individuals may have rights including:

• the right to obtain access to their personal data;
• the right to request correction;
• the right to request deletion in certain circumstances;
• the right to request restriction of processing;
• the right to object to certain processing;
• the right to data portability where applicable; and
• the right to withdraw consent where processing is based on consent.

Individuals may also object to direct marketing.

 

Where Clarion is Processor

Where Clarion processes personal data on behalf of a customer, requests relating to that data will normally need to be made to the customer as Controller.

If an individual contacts Clarion directly regarding data that we process on behalf of a customer, we may refer the request to the relevant customer and will provide reasonable assistance in accordance with the applicable DPA.

 

20. Website and cookies

Clarion’s websites may use cookies and similar technologies.

These may be used for:

• website operation;
• security;
• remembering preferences;
• analytics;
• improving website performance; and
• understanding website usage.

Where consent is required, Clarion will obtain appropriate consent before placing or using non-essential cookies or similar technologies.

Further information may be provided in our Cookie Policy.

 

21. Third-party websites

Our websites may contain links to third-party websites.

Clarion is not responsible for the privacy practices or content of third-party websites.

We recommend that individuals review the privacy policies of those websites before providing personal data.

 

22. Children’s data

Clarion’s services are principally provided to businesses and organisations.

Clarion does not knowingly collect children’s personal data for its own marketing purposes.

However, customer systems may contain information relating to children, particularly where Clarion provides services to schools, colleges, education organisations or other customers.

Where this occurs, Clarion processes such information as Processor in accordance with the customer’s documented instructions and applicable contractual arrangements.

 

23. Automated decision-making and profiling

Clarion does not generally make decisions about individuals based solely on automated processing that produce legal or similarly significant effects.

Where profiling or automated decision-making is introduced in a manner that is subject to additional legal requirements, Clarion will review the processing and implement appropriate safeguards.

 

24. Complaints

If you have concerns about how Clarion has processed your personal data, please contact us first so that we can investigate and seek to resolve the matter.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent regulator for data protection and information rights.

ICO website:

Information Commissioner’s Office: https://ico.org.uk

 

25. Contacting Clarion

For questions about this Privacy Policy or the way Clarion processes personal data, please contact:

Data Compliance, The Clarion Group of Companies, Unit W.01, Canalot Studios, 222 Kensal Road, London W10 5BN

Email:

data-compliance@clarioncomms.com

 

26. Changes to this Privacy Policy

Clarion may update this Privacy Policy from time to time to reflect changes in our services, business activities, technology or applicable legal requirements.

The latest version will be published on our website and the date of the latest revision will be shown at the beginning of this document.

 

APPENDIX 1 – CLARION AS DATA PROCESSOR

Where Clarion acts as a Processor on behalf of a customer, the following provides a general description of the processing.

 

Subject matter

Provision of managed IT, systems integration, cloud, connectivity, communications, cybersecurity, backup, monitoring, support and related technology services.

 

Duration

For the duration of the applicable services agreement and any additional period required for the return or secure deletion of personal data.

 

Nature and purpose

Processing may include:

• accessing;
• storing;
• hosting;
• transmitting;
• retrieving;
• backing up;
• restoring;
• monitoring;
• troubleshooting;
• maintaining;
• securing;
• supporting; and
• deleting

personal data as necessary to provide the contracted services.

 

Categories of data subjects

Depending upon the customer’s organisation and services provided, these may include:

• employees;
• workers;
• contractors;
• customers;
• prospective customers;
• suppliers;
• pupils;
• students;
• parents or guardians;
• service users;
• members; and
• other individuals whose personal data is contained within customer systems.

 

Categories of personal data

Depending upon the services provided, these may include:

• names;
• addresses;
• email addresses;
• telephone numbers;
• usernames;
• account information;
• employment information;
• customer records;
• financial information;
• technical information;
• device information;
• IP addresses;
• authentication information;
• system logs;
• communications data; and
• other personal data contained within customer systems.

Special category data and criminal conviction/offence data may also be present within customer systems.

 

Controller’s instructions

Clarion will process customer personal data only on the customer’s documented instructions unless otherwise required by applicable law.

 

Confidentiality

Clarion will ensure that persons authorised to process customer personal data are subject to appropriate confidentiality obligations.

 

Security

Clarion will implement appropriate technical and organisational measures appropriate to the risks associated with the processing.

 

Sub-processors

Clarion may engage sub-processors in accordance with the applicable DPA and customer authorisation.

 

Data subject rights

Clarion will provide reasonable assistance to the customer in responding to requests from individuals exercising their data protection rights.

 

Data breaches

Clarion will notify the customer without undue delay after becoming aware of a personal data breach affecting customer personal data and will provide reasonable assistance as required by the DPA.

 

Data Protection Impact Assessments

Clarion will provide reasonable assistance to the customer in relation to data protection impact assessments where required and where relevant to the services being provided.

 

End of contract

At the end of the relevant services, Clarion will, at the customer’s choice and subject to applicable legal requirements, return or securely delete customer personal data in accordance with the applicable services agreement and DPA.

 

Audits

Clarion will provide information reasonably necessary to demonstrate compliance with applicable processor obligations and will support audits or inspections in accordance with the applicable DPA and subject to reasonable conditions designed to protect confidentiality, security and the interests of Clarion and its other customers.