Privacy policy

Last updated: 8 October 2026.

Who we are

The IT Person is a service provided by Nebular Cloud Ltd, registered in England and Wales (No. 10242111), at Egerton House, 55 Hoole Road, Chester CH2 3NJ. We're registered with the UK Information Commissioner's Office (ICO) under registration number ZA778974.

If you have any question about your data, or want to use any of your rights, email privacy@theitperson.co.uk. Every request is logged and tracked as a support ticket, so it's never lost.

Two kinds of data, two roles

Your account and billing data, such as your name, email and company details. We decide how this is used, so for this we're the data controller.
Your Microsoft 365 data, which the portal shows you: your users, groups, licences, devices and security settings. This belongs to your organisation. We only read and act on it to provide the service you've asked for, so for this we're your data processor, and our Terms include the data processing terms that apply.

What we collect

When you sign up:

your name, role, work email address and phone number;
your company name and business address;
your Microsoft 365 organisation details, read when your Global Administrator signs in with Microsoft: the organisation name, address, country, verified domains, tenant ID, and the number and type of Microsoft licences. We only keep what's needed to set up your account;
the plan and billing cycle you chose, and your marketing preferences.

When you pay: card payments are handled by Stripe. Your card details go directly to Stripe and never reach us. We receive a customer reference and your payment status. Your VAT invoices come from us.

When you use the portal: with the access your administrator approves (Microsoft's "granular delegated admin privileges", or GDAP), we read information from your Microsoft 365 tenant to show it to you. That covers users, groups, mailboxes, licences, devices, sign-in security and similar settings. We don't read the contents of email, files or chats.

When you contact us: we keep your messages and support tickets in our customer relationship system (CRM).

Technical data: our servers keep short-term logs (for example, the time of a request and error details) to keep the service secure and working. See our Cookie notice for the small number of cookies we use.

Why we use it (lawful basis)

What we do	Lawful basis
Set up and run your account, provide the portal and support	Contract: we need it to provide the service
Take payments and keep billing and tax records	Contract and legal obligation
Keep the service secure, prevent fraud and fix problems	Legitimate interests
Send important service messages (setup, trial ending, payment problems, security alerts)	Contract and legitimate interests
Send the account owner occasional tips, updates and offers about our own similar IT services by email	Legitimate interests (the "soft opt-in" for existing business customers): you can untick this at sign-up, and every email has an unsubscribe link
Occasional phone calls about services that may help	Consent: only if you ticked that box, and you can withdraw it at any time

We don't sell your data, and we don't use it for automated decision-making that has legal or similarly significant effects on you.

Who we share it with

We only share data with service providers who help us run the service, under contracts that protect it:

Microsoft (Azure hosting in the UK, Microsoft 365 and Dynamics 365): hosting, sign-in, our CRM and support tickets, and sending email.
Stripe: card payments.
Our Microsoft licensing distributor (Pax8): only if you choose to buy Microsoft licences through us.
Microsoft Partner Center: Microsoft records us as your partner when your administrator approves our connection.

We may also share data if the law requires it, or to protect our rights and the security of our customers.

Where it's stored

Our service is hosted in Microsoft Azure data centres in the UK. Some providers, such as Stripe, may process data outside the UK. Where that happens, it's protected by UK-approved safeguards, such as an adequacy decision or the UK International Data Transfer Agreement.

How long we keep it

Account and portal data: for as long as you're a customer, then deleted 90 days after your subscription ends.
Billing and invoice records: 6 years, because UK tax law requires it.
Support tickets: for as long as you're a customer, then up to 6 years with your billing records, for our legal records.
Marketing preferences and our marketing list: until you unsubscribe or ask us to stop. Only the account owner is added to our marketing list, never other people in your organisation.
Access to your Microsoft 365: when you cancel, we remove our delegated admin access (GDAP) to your tenant.

Your rights

You have the right to:

access the personal data we hold about you;
correct anything that's wrong;
erase your data (where we're not legally required to keep it);
restrict or object to how we use it;
take your data with you (data portability);
withdraw consent for marketing at any time.

Email privacy@theitperson.co.uk. We'll respond within one month. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office: ico.org.uk or 0303 123 1113. We'd appreciate the chance to put things right first.

For your organisation's Microsoft 365 data, your organisation is in control. Requests about that data should come from your organisation's administrator, and we'll help them.

How we protect it

Data is encrypted in transit and at rest.
Our secrets are kept in a dedicated key vault.
Staff access uses multi-factor authentication.
Our access to your Microsoft 365 uses only the time-limited, least-privilege roles your administrator approves, and they can remove it at any time.

Children

The IT Person is a business service and isn't intended for anyone under 18.

Changes to this policy

If we make significant changes, we'll let customers know by email before they take effect. The date at the top shows when it was last updated.

Also see: Terms and conditions · Cookie notice