Privacy policy

This policy explains what personal data the UK edition of our website (2nd-wind.com/en-gb/) processes, why, and what rights you have.

1. Who is responsible

The controller is:

2nd wind IT Limited
124 City Road
London EC1V 2NX, United Kingdom
Email: hello@2nd-wind.com

We process your data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Our sister company in Germany, 2nd wind GmbH, runs this website, the website chat and our service desk for us, as our processor under a written agreement. The UK treats the European Economic Area as providing adequate protection, so your data stays protected to the same standard when our sister company handles it.

2. Hosting and server logs

This website is delivered by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, as a sub-processor. When you open a page, Cloudflare processes the data that is technically necessary to deliver it: your IP address, the date and time of the request, the page requested, the page you came from, and your browser and operating system.

We use this data only to deliver the website and to protect it against attacks and misuse. The legal basis is Art. 6(1)(f) UK GDPR; our legitimate interest is a secure, working website. Cloudflare keeps this data only as long as these purposes require and then deletes it in line with its retention periods (see Cloudflare’s privacy policy). Cloudflare may process data in the USA. Cloudflare is certified under the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), and its data processing terms include the UK International Data Transfer Addendum. You can check the certification at dataprivacyframework.gov and read the terms at cloudflare.com/cloudflare-customer-dpa. We don’t combine this data with other data.

3. No tracking

We don’t set cookies ourselves and don’t use analytics, advertising or social media tools. To protect the website against automated attacks, Cloudflare may set a strictly necessary security cookie (such as __cf_bm). It expires after 30 minutes and isn’t used to track you. The legal basis is regulation 6 of the Privacy and Electronic Communications Regulations (PECR), which allows what is strictly necessary for a service you asked for and for its security, together with Art. 6(1)(f) UK GDPR.

Country and language. When you open the bare address 2nd-wind.com, our server at Cloudflare uses your browser’s language settings and the country Cloudflare derives from your IP address to send you to the matching language version. The country and language picker at the bottom of each page asks our server for the same country, to suggest it, and so does a short hint that offers you a page in the version for your country or language. Neither is stored. If you choose a country in the picker or answer the hint, your browser keeps that choice in its local storage (not a cookie), so the picker can show it on your next visit and the hint doesn’t come back. It never leaves your device, and you can delete it at any time in your browser settings. The legal basis is regulation 6 PECR, as you asked for the choice to be kept, together with Art. 6(1)(f) UK GDPR; our legitimate interest is showing you the right version of the website.

Fonts are served from our own website, so your browser doesn’t connect to third-party font services.

4. When you contact us

If you contact us through the contact form, the website chat or by email, we process the details you give us, such as your name, contact details and message, to handle your enquiry. The legal basis is Art. 6(1)(b) UK GDPR where your enquiry relates to a contract or steps before one, and otherwise Art. 6(1)(f) UK GDPR; our legitimate interest is answering your enquiry. We keep your enquiry for as long as we need it to answer you and to follow it up. If a contract follows, your details become part of our client records; if not, we delete the enquiry once we no longer need it. Records we must keep by law, such as accounting and VAT records (six years), we keep for those periods and delete afterwards.

Contact form. The form sends us what you enter (name, company, email address, phone number if you give one, and your message) and the page and language version you sent it from. It goes through Cloudflare (section 2) and Microsoft Power Automate (Workflows) to Microsoft Teams, both part of Microsoft 365, where our team reads and answers it. The form sets no cookies and loads nothing from third parties. To block spam it checks a hidden field and how long the form took to fill in. Providing your details is voluntary; we need your name, company, email address and message to answer you, and the phone number is optional.

Website chat. If you open the chat on our website, we process what you enter (your name, your company if you give it, your email address and your messages) together with the page and language version you chat from and the time of each message, to answer you. The chat is our own software on this website; no third-party chat service is involved. Your messages reach our team in Microsoft Teams through a bot run in Microsoft Azure (Azure Bot Service, see below), and our replies come back the same way. The chat button loads nothing and stores nothing until you start a chat. Then your browser keeps the chat’s identifier in its local storage (not a cookie) so the conversation can continue on other pages; it is used only to show you your own chat, and you can delete it at any time in your browser settings (regulation 6 PECR). The copy of the chat on our website is deleted automatically 30 days after the last message; the copy in Microsoft Teams is kept like any other enquiry (see above). The legal basis is Art. 6(1)(b) UK GDPR where your enquiry relates to a contract or steps before one, and otherwise Art. 6(1)(f) UK GDPR; our legitimate interest is answering your enquiry. Providing your details is voluntary; we need your name, email address and a message to start a chat.

For email, the contact form and the website chat we use Microsoft 365 (Exchange Online, Microsoft Teams and Power Automate) and Microsoft Azure (Azure Bot Service), provided by Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, as a sub-processor. Data may also be processed in the USA; Microsoft is certified under the UK Extension to the EU-US Data Privacy Framework, and the transfer terms in Microsoft’s Data Protection Addendum apply in addition.

5. Links to other websites

Some pages link to other websites, for example a vendor’s documentation. Data is only sent to those sites when you click the link, and their own privacy policies apply.

6. Your rights

You have the right to access your data (Art. 15 UK GDPR), to have it corrected (Art. 16), deleted (Art. 17) or restricted (Art. 18), and to receive it in a portable format (Art. 20). To exercise these rights, write to hello@2nd-wind.com.

Right to object: where we process your data on the basis of legitimate interests (Art. 6(1)(f) UK GDPR), you can object at any time for reasons arising from your particular situation (Art. 21 UK GDPR). We then stop processing it unless we can show compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims.

We don’t use automated decision-making or profiling.

Complaints to us. You can raise any data protection complaint with us directly, by email to hello@2nd-wind.com or by post to the address above. We acknowledge receipt within 30 days, look into the complaint without undue delay and tell you the outcome. Your right to contact the regulator is unaffected.

You also have the right to complain to the Information Commission (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, ico.org.uk.

7. Changes to this policy

We update this policy when the website or the law changes. The date at the top shows the current version.