Privacy policy.

1. Who We Are

Zopi Ltd ("Zopi", "we", "us", "our") is an IT consultancy registered in England and Wales (Company No. 14510053). We provide VoIP telephony, cloud infrastructure, cybersecurity, payments technology, and managed IT support services.

For the purposes of UK data protection law, Zopi Ltd is the data controller of personal data collected through this website and in the course of providing our services. You can contact us at connect@zopi.uk.

2. What Personal Data We Collect

We may collect and process the following personal data:

• Contact information — name, email address, phone number, company name, submitted via our contact or partner enquiry forms.
• Account information — email address and password hash for client portal accounts.
• Support and service data — information you provide when raising support tickets, uploading documents, or communicating with us.
• Usage data — IP address, browser type, pages visited, and referral source collected automatically when you use our website (via server logs).
• Marketing data — UTM parameters and campaign source if you arrive via a marketing link, used to understand how enquiries originate.
• Zopi Guard security data — when a server running Zopi Guard blocks someone trying to break in, it sends us the attacker's IP address, when it was seen, how many failed logins it made and how many different usernames it tried (never the usernames or passwords themselves). Guard never sends private network addresses, addresses on the server's allow list, or any address that has signed in successfully. Each Guard server also tells us its name, Windows version and the address it connects from.

3. How We Use Your Data

We use your personal data for the following purposes:

• To respond to enquiries and provide quotations for our services
• To deliver services you have contracted with us, including managing support tickets and invoices
• To provide access to the Zopi client portal
• To send service-related communications (account updates, invoice notifications, maintenance notices)
• To improve our website and services through analysis of usage patterns
• To protect Zopi Guard customers: an attacker's address reported by more than one company, or one making a very large number of attempts, goes on a shared block list that every Zopi Guard server downloads
• To comply with our legal obligations

We do not use your data for automated decision-making or profiling. We do not sell your personal data to third parties.

4. Legal Basis for Processing

We process your personal data under the following legal bases:

• Contract — processing necessary to perform a contract with you or take pre-contractual steps at your request.
• Legitimate interests — processing for the purposes of our legitimate business interests, such as responding to enquiries, improving our services, preventing fraud, and keeping our customers' systems secure (including the Zopi Guard shared block list), where these interests are not overridden by your rights.
• Legal obligation — processing required to comply with applicable law.
• Consent — where you have given clear consent, for example by submitting a contact form or registering for early access communications.

5. Data Retention

We retain personal data only for as long as necessary for the purposes it was collected, or as required by law. In general:

• Enquiry and contact data: up to 2 years from last contact
• Client account and service data: duration of the contract plus 6 years (for accounting and legal compliance)
• Support ticket data: 3 years from resolution
• Website usage logs: up to 12 months
• Zopi Guard attack reports: 90 days after the address was last seen attacking; an address stays on the shared block list for 30 days after it was last seen

6. Sharing Your Data

We may share your personal data with:

• Service partners — trusted third-party providers who support delivery of our services (e.g. cloud hosting, VoIP network providers), bound by data processing agreements.
• Professional advisors — accountants, solicitors, or insurers where necessary.
• Regulatory authorities — where required by law or to protect our legal rights.
• Zopi Guard customers — addresses on the shared block list are sent to every Zopi Guard server. If you think your address has been listed by mistake, email connect@zopi.uk and we will review it; Zopi Guard customers can also ask through the client portal.

We find the approximate country and city of an IP address using DB-IP's database (IP Geolocation by DB-IP), which we keep on our own server — addresses are not sent to DB-IP or anyone else to look them up.

We do not transfer personal data outside the UK or EEA unless appropriate safeguards are in place.

7. Cookies

We only use one cookie: a session cookie that keeps you signed in to the client portal. It’s set when you sign in, it’s needed for the portal to work, and it ends when you sign out or close your browser.

We don’t use advertising cookies, and we don’t use Google Analytics or any other third-party tracking. To see how the website is used, we keep our own visitor statistics on our own server. They use no cookies and store nothing in your browser.

A few pages remember small preferences in your browser so they work the way you left them, for example which time range you chose on our status page, or that you’ve already seen the animation on our hardware recycling page. These hold no personal information, and you can clear them at any time in your browser’s settings.

8. Your Rights

Under UK GDPR you have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate or incomplete data.
• Erasure — request deletion of your personal data where there is no legitimate reason for us to continue processing it.
• Restriction — request that we restrict processing of your data in certain circumstances.
• Portability — request a copy of data you have provided to us in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing.

To exercise any of these rights, please contact us at connect@zopi.uk. We will respond within one month. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

9. Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or destruction. These include encrypted data transmission (HTTPS), access controls, and regular security reviews. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the ICO as required by law.

10. Changes to This Policy

We may update this privacy policy from time to time. The current version will always be available at this URL. If we make significant changes we will notify clients directly by email.