CloudNet Technologies Limited is committed to protecting the confidentiality, integrity and availability of the information entrusted to us. This policy explains the practical safeguards we apply across our systems, services, people and technology.
Effective Date: 29 September 2026
Last Reviewed: 29 September 2026
Website: https://cloudnettech.co.uk
CloudNet Technologies Limited (“CloudNet”, “we”, “us” or “our”) is a private limited company registered in England and Wales under company number 14371617. Our registered office is 18 Alma Road, Manchester, England, M19 3NW. Our trading address is Unit 8B, Redfern Industrial Estate, Hyde, SK14 1RD.
This Data Security Policy describes how we protect personal information, customer information, confidential information, systems and technology used in connection with our business and services.
This policy applies to our employees, workers, contractors and authorised third parties who access CloudNet systems, customer systems or information made available to us.
It applies, where relevant, to our websites, business systems, software applications, cloud services, hosted platforms, locally installed solutions, integrations, development environments and supporting infrastructure under our control.
Where CloudNet processes information on behalf of a customer, we also follow the applicable customer agreement, data-processing terms, documented instructions and agreed security requirements.
We recognise that information security is fundamental to the services we provide. We take reasonable and proportionate technical and organisational measures designed to protect information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access or misuse.
Our approach is based on the confidentiality, integrity and availability of information and on applying safeguards that are appropriate to the nature of the information, the technology involved and the potential risks.
Information security is considered throughout the lifecycle of systems and services, from design and development through deployment, operation, maintenance and eventual retirement.
CloudNet processes and protects personal information in accordance with applicable United Kingdom data-protection and privacy requirements, including:
We take account of relevant guidance published by the Information Commissioner’s Office (“ICO”) and the National Cyber Security Centre (“NCSC”).
CloudNet is registered with the Information Commissioner’s Office under registration number ZB535843.
Nothing in this policy should be interpreted as a claim that CloudNet holds a particular security certification or accreditation unless that certification has been formally obtained, remains valid and is expressly identified by us as such.
We consider privacy and information security when designing, developing, configuring and operating systems and services.
Depending on the nature and risk of a particular service, our approach may include:
Where processing may present a higher risk to individuals, including information relating to children or vulnerable individuals, we consider additional safeguards appropriate to the circumstances.
Access to systems and information is granted according to an individual’s responsibilities and legitimate business need.
Our access-control approach includes, where appropriate:
Shared administrative accounts are avoided where individual authenticated access can reasonably be provided.
CloudNet uses appropriate measures designed to protect information during transmission and storage according to the relevant service, platform, information type and level of risk.
Secure communication protocols and encryption are used where appropriate for information transmitted electronically.
Externally accessible interfaces are protected using appropriate combinations of authentication, encrypted communications and access controls.
Sensitive or confidential information must not knowingly be transmitted through an insecure method where an appropriate secure method is reasonably available.
CloudNet incorporates security considerations into the design, development, configuration, deployment and maintenance of software and digital services.
Depending on the nature of the service, controls may include:
Security is treated as an ongoing operational responsibility rather than solely a final-stage development activity.
CloudNet takes a risk-based approach to identifying, assessing and addressing security vulnerabilities affecting systems and services under our management.
Relevant software and systems are kept under review and available security updates are considered according to factors including severity, exposure, operational impact and vendor guidance.
Identified vulnerabilities are assessed and prioritised according to risk, and appropriate remedial action is undertaken within timescales proportionate to that risk.
Where required by a customer agreement, procurement requirement, service specification or risk assessment, CloudNet may arrange independent vulnerability assessment or penetration testing through an appropriately qualified external provider. Findings are assessed, recorded and addressed according to their severity and relevance.
Where appropriate to the relevant service or platform, CloudNet maintains security, operational and administrative logging to support accountability, troubleshooting, monitoring and investigation.
Controls may include:
The extent and retention of logging depends on the architecture, purpose, risk and contractual requirements of the relevant service.
CloudNet applies proportionate security controls to devices, networks, cloud infrastructure and other systems under our management.
Depending on the environment, controls may include:
CloudNet recognises that availability and recoverability are important parts of information security.
Where applicable to a service, appropriate backup, resilience and recovery arrangements are maintained according to the importance of the relevant information, system and customer requirements.
Backup information is protected against inappropriate access and recovery arrangements are reviewed and, where appropriate, tested.
These measures are intended to reduce the impact of system failure, accidental loss, cyber incidents, infrastructure disruption and other events that could affect service availability.
People with access to CloudNet or customer systems and information are expected to act responsibly and protect information entrusted to them.
Employees, workers, contractors and other authorised personnel are expected to:
Relevant security and data-protection guidance or training is provided according to an individual’s role, responsibilities and level of access.
Where third parties process information or provide technology services on our behalf, we take reasonable steps to consider relevant information-security and data-protection risks.
Where required, contractual arrangements define appropriate confidentiality, security, processing and incident-management responsibilities.
Where CloudNet appoints a processor to process personal information on our behalf, appropriate contractual provisions are used in accordance with applicable UK data-protection requirements.
Access provided to suppliers, subcontractors or other third parties is limited to what is reasonably necessary for the authorised service.
Where personal information is transferred outside the United Kingdom and the transfer is subject to UK data-protection restrictions, CloudNet uses an appropriate lawful transfer mechanism.
Depending on the circumstances, this may include UK adequacy regulations, the UK International Data Transfer Agreement, an appropriate UK Addendum or another transfer mechanism permitted under applicable UK law.
Relevant transfer risks, contractual safeguards and technical protections are considered where required.
Information is retained only for as long as reasonably necessary for its lawful purpose, contractual requirements, legitimate business needs or applicable legal obligations.
When information is no longer required, it is securely deleted, anonymised or otherwise disposed of using a method appropriate to its sensitivity and the technology on which it is stored.
Where CloudNet processes customer-controlled information as a processor, retention and deletion are also governed by the relevant customer agreement and documented instructions.
Suspected or confirmed information-security incidents must be reported internally as soon as reasonably possible.
Depending on the nature and severity of an incident, CloudNet may take steps including:
Security incidents are assessed according to their potential effect on confidentiality, integrity, availability, customers and individuals.
Where CloudNet acts as a data controller and becomes aware of a personal data breach, we assess whether notification to the Information Commissioner’s Office is required.
Where legally reportable, notification will be made without undue delay and, where feasible, within 72 hours of becoming aware of the breach.
Where a personal data breach is likely to result in a high risk to the rights and freedoms of affected individuals, those individuals will also be informed where required by law.
Where CloudNet acts as a data processor, we will notify the relevant controller without undue delay in accordance with applicable legal and contractual requirements.
Where CloudNet is responsible for operating or supporting a customer service, we maintain appropriate arrangements for communicating material security incidents affecting that service.
Where a security incident, suspected personal data breach or identified vulnerability presents a material or immediate risk to customer information or systems, we will notify the relevant customer in accordance with applicable contractual, legal and regulatory requirements.
Information provided during an active investigation may be updated as additional facts become available.
Information security includes maintaining appropriate availability of systems and services.
CloudNet maintains business-continuity and recovery arrangements proportionate to our operations and the services concerned.
These arrangements are intended to help us respond to circumstances such as:
More detailed continuity requirements may be defined for particular customer systems or contracts.
CloudNet maintains arrangements for dealing with requests concerning personal information in accordance with applicable UK data-protection law.
Where CloudNet acts as a controller, individuals may exercise applicable rights as described in our Privacy Policy.
Where CloudNet acts solely as a processor, requests concerning customer-controlled information will normally be referred to, or handled in cooperation with, the relevant customer acting as controller.
Overall responsibility for information security rests with CloudNet Technologies Limited.
Management is responsible for ensuring that appropriate responsibilities are assigned and that material information-security risks are considered in relevant business and technology decisions.
Everyone with authorised access to CloudNet or customer information shares responsibility for protecting that information and for reporting suspected incidents, weaknesses or inappropriate access.
Policies, procedures, records and contractual safeguards are maintained where appropriate to support accountability and demonstrate reasonable security governance.
This Data Security Policy should be read alongside our other published policies and contractual documentation, including:
Additional internal procedures and service-specific controls may apply to particular systems, customers, contracts or projects.
We review this policy periodically and may review it sooner following:
Where this policy is updated, the revised version will be published on this page and the effective or last-reviewed date will be amended as appropriate.
For questions concerning this Data Security Policy, information security or data protection, please contact:
Organisation: CloudNet Technologies Limited
Company Number: 14371617
ICO Registration: ZB535843
Registered Office: 18 Alma Road, Manchester, England, M19 3NW
Trading Address: Unit 8B, Redfern Industrial Estate, Hyde, SK14 1RD
Email: [email protected]
Telephone: 0161 710 4311
Website: https://cloudnettech.co.uk