Key facts at a glance: Data controller: Maestra Tech Ltd (England and Wales). Lawful bases used: Contract, Legal Obligation, Legitimate Interests, Consent (where applicable), and Recognised Legitimate Interest for network security. Breach notification: ICO within 72 hours; affected individuals without undue delay. Regulator: ICO, ico.org.uk.
1. Who We Are and How to Contact Us
Maestra Tech Ltd is a UK-based Microsoft 365 security consultancy covering email protection, identity and access. We are the data controller in respect of personal data we collect and process in connection with our business activities, including the delivery of services to clients, the operation of our website, and the management of our business relationships.
| Company | Maestra Tech Ltd |
| Registered In | England and Wales |
| Website | maestra-tech.com |
| Privacy Contact | [email protected] |
| ICO Registration | To be confirmed on registration |
We do not currently meet the threshold requiring appointment of a Data Protection Officer (DPO) under Article 37 UK GDPR. Data protection queries should be directed to the contact above and will be handled by a Director of Maestra Tech.
2. Scope of This Policy
This Privacy Policy explains how Maestra Tech collects, uses, stores, shares, and protects personal data. It applies to:
- Current and prospective clients and their key contacts
- Visitors to the Maestra Tech website (maestra-tech.com)
- Individuals who contact us by email, telephone, LinkedIn, or other channels
- Employees, directors, and contractors of Maestra Tech
- Third-party suppliers and partners with whom we share data in the course of service delivery
This Policy covers personal data processed by Maestra Tech in its capacity as a data controller. Where Maestra Tech processes personal data on behalf of a client (for example, processing DMARC forensic reports that contain email recipient data, or reviewing a client's Microsoft 365 and Entra ID configuration), it does so as a data processor and the client's own privacy policy and our Data Processing Agreement (DPA) govern that processing.
This Policy is governed by UK GDPR, the Data Protection Act 2018 (DPA 2018), the Data (Use and Access) Act 2025 (DUAA), and the Privacy and Electronic Communications Regulations 2003 (PECR). The DUAA received Royal Assent on 19 June 2025; its core data protection provisions came into force on 5 February 2026. This Policy reflects the law as in force at October 2026.
3. What Personal Data We Collect
We only collect data that is adequate, relevant, and limited to what is necessary for the relevant purpose (the data minimisation principle under Article 5(1)(c) UK GDPR).
3.1 Client and Prospective Client Data
- Name, job title, and employer organisation
- Business email address and telephone number
- LinkedIn profile URL (where relevant to our engagement)
- Correspondence and communication history (emails, meeting notes, proposals)
- Billing contact details and invoice records
- Signed contracts, statements of work, and related engagement documents
3.2 Technical and Infrastructure Data
In the course of providing email and identity security services, we may process the following data which may, in some contexts, constitute or contain personal data:
- Domain names, DNS records, and email infrastructure configurations
- DMARC aggregate (rua) reports, typically containing IP addresses, domain names, and authentication statistics; they do not ordinarily contain personal data relating to identifiable individuals
- DMARC forensic (ruf) reports, which may contain headers or partial content of individual emails, including sender and recipient email addresses, subject lines, and timestamps
- Email sending logs, bounce data, spam complaint rates, and deliverability metrics
- ESP dashboard data (e.g. Mailchimp, HubSpot, SendGrid) accessed during deliverability audits
- Microsoft 365 and Entra ID configuration data reviewed during identity assessments, which can include user names, email addresses, role assignments, sign-in records and mailbox rules. We process this as a data processor on the client's behalf, under a Data Processing Agreement.
Important note on DMARC forensic reports: DMARC forensic (ruf) reports can contain personal data relating to third-party email recipients and senders. Where a client enables forensic reporting as part of an engagement, the client is the data controller in respect of that data. Maestra Tech processes it as data processor under a Data Processing Agreement. Maestra Tech recommends that most clients do not enable forensic reporting unless strictly necessary.
3.3 Website Data
- IP address and approximate location derived from IP
- Browser type, device type, and operating system
- Pages visited, time on site, and referral source (via analytics cookies, see Section 8)
- Name, email address, and message content submitted via any contact form
- The domain you enter in our free domain health checker, and the results of the check. Domain names and public DNS records are business information and are usually not personal data.
- If you ask for the full domain health report: your email address, together with the domain and results
- If you book a call: your name, email address, phone number if given, and what you tell us in the booking form
3.4 Marketing and LinkedIn Data
- Name and professional details of individuals who engage with Maestra Tech's LinkedIn content
- Email address of individuals who subscribe to any Maestra Tech newsletter
- Records of consent to receive marketing communications
3.5 Employee and Contractor Data
Where Maestra Tech processes personal data in relation to its employees and contractors, this is governed by a separate internal employee privacy notice provided at the point of engagement.
4. Lawful Bases for Processing
| Processing Activity | Lawful Basis | Details |
|---|---|---|
| Delivering contracted services to clients | Contract (Art. 6(1)(b)) | Processing necessary for performance of the engagement contract |
| Invoicing and financial records | Legal Obligation (Art. 6(1)(c)) | Required to comply with Companies Act 2006, HMRC obligations, and accounting law |
| Processing DMARC forensic reports on behalf of clients | Contract / Data Processor role | Processed under a Data Processing Agreement; lawful basis is the client's responsibility as controller |
| Responding to enquiries and business development | Legitimate Interests (Art. 6(1)(f)) | Legitimate interest in responding to and pursuing business enquiries; balanced against minimal privacy impact on B2B contacts |
| Running the domain health checker and keeping a record of checks | Legitimate Interests (Art. 6(1)(f)) | Providing the free tool, improving it, and understanding which businesses use it |
| Sending the domain health report you request, and following up about it | Legitimate Interests (Art. 6(1)(f)); Consent where required by PECR | You asked for the report. Every follow-up email includes an unsubscribe link |
| B2B direct marketing to existing client contacts | Legitimate Interests / PECR soft opt-in | Existing client contacts for similar services; right to opt out provided in every communication |
| Email newsletter (opt-in) | Consent (Art. 6(1)(a)) | Freely given, specific, informed consent at point of subscription; right to withdraw at any time |
| Network and information security monitoring | Recognised Legitimate Interest (RLI) (DUAA Annex 1) | Network security processing is listed in Annex 1 as an RLI activity, removing the requirement for a Legitimate Interests Assessment for this specific purpose |
| Analytics cookies (website) | No consent required (DUAA / PECR amendment, 5 Feb 2026) | Analytics cookies used solely to collect aggregate statistics are exempt from the consent requirement under PECR as amended by the DUAA |
5. How We Use Personal Data
5.1 Service Delivery
- Delivering Microsoft 365 email and identity security consultancy services under a signed engagement agreement
- Communicating with clients about the progress of work, technical findings, and recommendations
- Configuring DNS records, DMARC policies, and related email authentication settings on behalf of clients
- Analysing DMARC aggregate reports and, where authorised, forensic reports to identify authentication issues
- Producing audit reports, implementation roadmaps, and deliverables for clients
5.2 Business Operations
- Issuing invoices and managing payment records
- Maintaining records of engagement agreements and correspondence
- Managing supplier, sub-contractor, and partner relationships
- Responding to enquiries from prospective clients, and managing calls booked through our website
- Running our free domain health checker and sending the reports people request
5.3 Marketing and Communications
- Sending email marketing to existing client contacts about similar services (soft opt-in basis under PECR, with opt-out in every email)
- Distributing newsletters to individuals who have subscribed (consent basis)
- Engaging with prospective clients via LinkedIn or other professional channels (legitimate interests basis)
We do not purchase or use third-party marketing lists. All marketing activity complies with PECR 2003 as amended by the DUAA 2025. Every marketing email includes a clear and functional unsubscribe mechanism.
6. Who We Share Personal Data With
Maestra Tech does not sell personal data to third parties. We share personal data only in the following limited circumstances:
| Recipient | Purpose | Safeguards |
|---|---|---|
| DMARC report processing platforms | Processing DMARC aggregate reports on behalf of clients | Data processing agreements in place; aggregate reports do not ordinarily contain personal data |
| Cloud and email providers (e.g. Microsoft 365) | Storing client files, emails, and engagement documents | UK GDPR-compliant DPAs; standard contractual clauses or UK adequacy decision where applicable |
| HighLevel (LeadConnector) | Hosting our website, forms, contact records and booking calendar | Data processing agreement in place; data may be stored in the United States, covered by the safeguards in Section 11 |
| Public lookup services used by the domain health checker (Google and Cloudflare DNS, domain registries via RDAP, Google Safe Browsing) | Looking up the public records of the domain you enter, directly from your browser | Only the domain name is sent, never your contact details |
| Professional advisers (solicitors, accountants) | Legal and financial advice | Bound by professional confidentiality obligations and DPAs where appropriate |
| Sub-contractors and specialist consultants | Delivery of engagement services where specialist input is needed | Written DPAs and confidentiality agreements in place before any data sharing |
| Payment processors | Processing client payments | PCI DSS-compliant processors; Maestra Tech does not store payment card data |
| Regulatory authorities (ICO, HMRC, courts) | Legal obligation or regulatory requirement | Disclosure limited to what is strictly required by law |
7. How Long We Keep Personal Data
| Data Category | Retention Period | Basis |
|---|---|---|
| Client engagement records and correspondence | 6 years from end of engagement | Limitation Act 1980 (contract claims); Companies Act 2006 |
| Invoice and financial records | 6 years from date of transaction | HMRC requirement under Finance Act 1998 |
| DMARC aggregate reports | Duration of engagement + 12 months | Operational necessity for trend analysis; deleted thereafter |
| DMARC forensic reports (where processed) | Maximum 90 days unless otherwise agreed with client | Minimal retention given personal data risk; client DPA governs |
| Website enquiry data | 12 months from last contact | Legitimate interests; deleted after reasonable follow-up period |
| Marketing consent records | Duration of consent + 2 years | Evidence of lawful basis for marketing |
| Prospective client contact data | 24 months from last interaction | Legitimate interests; reviewed and purged annually |
| Domain health checker records (domain and results) | 24 months from the check | Legitimate interests |
| Domain health report requests (email, domain and results) | 24 months from last interaction | Legitimate interests; reviewed and purged annually |
8. Cookies and Website Tracking
Our website uses cookies and similar technologies. Following the DUAA 2025 amendments to PECR, which came into force on 5 February 2026, analytics cookies used solely to collect aggregate statistics no longer require prior consent.
| Cookie Type | Purpose | Consent Required? |
|---|---|---|
| Strictly necessary | Essential website functionality (e.g. session management) | No: exempt under PECR |
| Analytics (aggregate only) | Measuring website usage to improve our service; no personal profiling | No: exempt under DUAA/PECR amendment (5 Feb 2026) |
| Marketing / tracking | Not currently used; would require explicit consent if introduced | Yes: explicit consent required if introduced |
We do not currently use cookies for targeted advertising or cross-site tracking. If this changes, we will update this Policy and implement an appropriate consent mechanism before doing so.
9. Your Data Protection Rights
| Right | What It Means |
|---|---|
| Right of Access (SAR) | Request a copy of the personal data we hold about you. We will respond within one calendar month. |
| Right to Rectification | Request correction of inaccurate or incomplete personal data without undue delay. |
| Right to Erasure | Request deletion of your personal data where it is no longer necessary, you withdraw consent, you object, or it has been unlawfully processed. |
| Right to Restriction | Request that we restrict processing of your data (e.g. while we verify the accuracy of data you have disputed). |
| Right to Data Portability | Where processing is based on consent or contract, request your data in a structured, commonly used, machine-readable format. |
| Right to Object | Object to processing based on legitimate interests at any time. You have an absolute right to object to direct marketing. |
| Right to Complain | You have the right to complain to the ICO (ico.org.uk) at any time. From 19 June 2026, you also have a statutory right to lodge a complaint directly with us; we will acknowledge within 30 days. |
To exercise any of these rights, contact us at [email protected]. We will respond within one calendar month. We do not charge a fee for reasonable requests.
10. How We Keep Your Data Secure
We implement technical and organisational measures appropriate to the risk of the processing we carry out, in accordance with Article 32 UK GDPR. These include:
- Multi-factor authentication (MFA) on all accounts and systems used to process personal data
- Encrypted storage for sensitive engagement data and client credentials
- Encrypted communications (TLS) for email and file transfer
- Access controls ensuring personal data is accessible only to those who need it for the relevant purpose
- Regular review of access rights, particularly on conclusion of engagements
- Operating in accordance with the NCSC Cyber Essentials framework
- Prompt revocation of access credentials when staff or contractors leave or change role
In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of the breach, in accordance with Article 33 UK GDPR.
11. International Data Transfers
Maestra Tech is based in the United Kingdom and primarily processes data within the UK. Where we use third-party tools or sub-processors based outside the UK, we ensure appropriate safeguards are in place for any transfer of personal data outside the UK, in accordance with Article 46 UK GDPR.
The safeguards we rely on include:
- Adequacy regulations made by the UK Secretary of State under Article 45 UK GDPR for transfers to countries that provide an adequate level of protection
- The International Data Transfer Agreement (IDTA), published by the ICO, for transfers to countries without an adequacy decision
- The UK Addendum to the EU Standard Contractual Clauses, where appropriate
12. Children's Data
Maestra Tech's services are directed exclusively at business clients and are not intended for use by individuals under the age of 18. We do not knowingly collect or process personal data relating to children. If we become aware that we have inadvertently collected personal data relating to a child, we will delete it promptly.
13. Third-Party Links and Services
Our website and client deliverables may contain links to third-party websites, platforms, or resources. This Privacy Policy applies only to Maestra Tech's processing of personal data. We are not responsible for the privacy practices of third-party websites or services. We encourage you to read the privacy policies of any third-party platforms you access in connection with your engagement with us.
14. Changes to This Privacy Policy
We will update this Privacy Policy from time to time to reflect changes in the law, regulatory guidance, or our processing activities. Where changes are material, we will notify active clients by email before the changes take effect. The effective date at the top of this Policy will always reflect the date of the most recent revision.
15. How to Raise a Concern or Complaint
If you have any concerns about how we handle your personal data, please contact us in the first instance at [email protected]. We will acknowledge your concern and respond substantively within 30 days.
You also have the right to lodge a complaint with the ICO at any time:
| ICO Website | ico.org.uk |
| ICO Helpline | 0303 123 1113 |
| ICO Address | Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF |
16. Governing Law
This Privacy Policy is governed by the laws of England and Wales. Any disputes arising in connection with this Policy are subject to the jurisdiction of the courts of England and Wales. The regulatory authority for data protection in the United Kingdom is the Information Commissioner's Office (ICO), which will be rebranded as the Information Commission under the DUAA 2025 governance reforms.
17. Contact Details
| Company | Maestra Tech Ltd |
| Website | maestra-tech.com |
| Privacy Email | [email protected] |
| Jurisdiction | England and Wales |
| Regulator | Information Commissioner's Office (ICO), ico.org.uk |
© 2026 Maestra Tech Ltd. All rights reserved.