Privacy notice

1. Who we are

234teen CIC is the controller of the personal information described in this notice. We are registered with the Information Commissioner’s Office (ICO).

Contact us by email at victor@234teen.com, tony@234teen.com or barrie@234teen.com; by telephone on 01992 767 662; or by post at 234teen CIC, 1 Market Square, Waltham Abbey, Essex, EN9 1DL.

2. What information we collect

We collect only information reasonably needed to run the business and provide our services. This may include names, job titles, employer details, business email addresses, telephone numbers, enquiry and correspondence details, contract and job instructions, device identifiers such as model, serial number and IMEI, destruction or wiping records, invoices and payment records, and limited website technical information created by our hosting or security services.

Our service is designed so that customer data-bearing equipment does not leave the customer site until data has been successfully wiped or destroyed. We do not deliberately copy or retain the customer content stored on those devices.

3. How we obtain information

We normally obtain information directly from you, from the organisation you work for, from a customer that asks us to perform a service, from device or job records created during the service, or from publicly available business sources where appropriate.

4. Why we use information and our lawful bases

We use personal information to respond to enquiries, provide quotations, take steps before entering into a contract, deliver and evidence services, communicate about jobs, maintain security and audit records, manage suppliers, issue invoices, meet legal and regulatory duties, establish or defend legal claims, and operate and protect our website and systems.

We rely on the lawful bases that apply to the activity: taking steps at your request or performing a contract; our legitimate interests in running, securing and improving the business and providing accountable services; compliance with legal obligations; and consent where it is specifically required, such as for optional direct marketing or non-essential cookies. You may withdraw consent at any time where consent is the basis used.

5. Who we share information with

We share information only where necessary with authorised 234teen personnel; customers and their authorised representatives; service providers supporting email, hosting, asset management, accounting, data wiping, destruction evidence and IT support; professional advisers, insurers or auditors; and regulators, courts or law-enforcement bodies where disclosure is required or permitted by law.

Our main service providers include Google Workspace, IONOS, Cloudflare, AssetTiger, Intuit, Blackbelt360, @RACK and ChatGPT Business. Access is limited according to business need and provider functionality.

Only device or asset identifiers needed for the relevant job are entered into the @RACK system. Customer contact information held in AssetTiger is not transferred to @RACK. Cleared or destroyed equipment sent for recycling is accompanied only by the information required for lawful and traceable handover; no live customer data is transferred.

6. International transfers

Some service providers may process information outside the United Kingdom. Where this happens, we use the provider only where an appropriate legal transfer mechanism or other applicable safeguard is in place. Further information about relevant safeguards can be requested from us.

7. How long we keep information

We keep personal information only for as long as it is needed for the purpose for which it was collected and for legal, contractual, security or claims requirements. Our normal periods are: prospective-customer and general enquiry records for 24 months after the last meaningful contact; customer contracts, job contacts and instructions for 6 years after closure; asset identifiers, job evidence and wiping or destruction certificates for 7 years after job closure; and accounting records for 6 years from the end of the relevant financial year. We may retain information longer where a contract, legal hold, incident or claim requires it, and we securely delete or anonymise information when it is no longer needed.

8. Security

We use proportionate organisational, physical and technical safeguards, including controlled access, multi-factor authentication where supported, protected devices, staff responsibilities, supplier controls, record matching and incident management. No method of storage or transmission is completely risk-free, but we review our controls and respond to suspected incidents.

9. Your data-protection rights

Depending on the circumstances and lawful basis, you may have rights to access your personal information, correct inaccurate information, request deletion, restrict processing, receive certain information in a portable form, object to processing, and withdraw consent. These rights are not absolute and lawful exemptions may apply.

You have the right to object at any time to our use of your personal information for direct marketing. You may also object to processing based on legitimate interests; we will stop unless we have compelling legitimate grounds or need the information for legal claims.

To exercise a right, contact us using the details in section 1. We may need to verify your identity. We normally respond within the period required by data-protection law.

10. Automated decision-making

We do not make decisions about individuals based solely on automated processing where those decisions would have legal or similarly significant effects.

11. Children’s information

Our commercial data-destruction and IT asset services are not directed at children, and we do not intentionally collect children’s personal information through the website. If this changes, we will update this notice and introduce appropriate safeguards.

12. Cookies

This website has no contact form, analytics scripts or advertising trackers. Hosting and security services may use limited technical information and technologies needed to deliver or protect the website. If optional analytics, advertising or other non-essential cookies are introduced, we will explain them and handle consent where required.

13. Complaints

Please contact us first if you have a concern so that we can try to resolve it. You also have the right to complain to the Information Commissioner’s Office, the UK data-protection regulator. Further information is available on the ICO website.

14. Changes to this notice

We review this notice at least annually and when our services, systems or use of personal information materially changes. The published website version will show the current version and effective date.