Legal Centre

Privacy Policy

Last updated: 16 October 2026

01Who we are

SOWTK LTD ("SOWTK", "we", "us" or "our") is a private limited company registered in England and Wales under company number 17524830, with its registered office at 128 City Road, London, EC1V 2NX, United Kingdom. We are the controller of the personal data described in this policy.

This policy explains how we collect, use, store, share and protect personal data, in line with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 ("PECR").

02Scope of this policy

This policy applies to personal data we process when you visit our website, contact us, become a customer, a supplier or a partner, or use any of our services, including IT solutions, consultancy, cloud and hosting, infrastructure, websites and software, quantum-safe security, IT support, client support, telecommunications and Call Minutes (together, the "Services").

It does not apply to third-party websites or services linked from our website, which have their own policies. It does not cover data of our own employees, which is handled under our internal staff privacy notice.

Where we host, manage or process data on behalf of a customer, the customer is the controller of that data and we act as its processor. In that case we process it only on the customer's documented instructions, under a data processing agreement that meets Article 28 of the UK GDPR, and the customer is responsible for informing the people whose data it is.

03Data we collect

We collect only the personal data we need. Depending on how you deal with us, this may include:

  • Identity and contact data: name, job title, company, address, email address and telephone number;
  • Account data: usernames, account settings and the history of services you ordered or considered;
  • Verification data: the information and documents described in "Identity and business verification";
  • Financial data: billing address, invoices, payment records and the details needed to take payment (we do not store full card numbers);
  • Telecommunications data: the records described in "Telecommunications records";
  • Technical data: IP address, device and browser details, and logs of how our website and systems are used;
  • Communications: the content of emails, support tickets, contact form messages and calls with us;
  • Supplier and partner data: the contact and business details of people who work for our suppliers and partners.

We do not intentionally collect special category data (such as health or religious beliefs). Please do not send it to us. If such data reaches us through content you or your users transmit over our Services, we process it only as part of providing the Services.

04Identity and business verification

To protect our network, prevent fraud and meet our legal and regulatory obligations, we verify customers before providing certain Services, in particular telecommunications and Call Minutes. Verification ("KYC") may include:

  • company registration details, directors and beneficial owners;
  • the identity of the person acting for the business, including a government-issued photo ID;
  • proof of address and proof of business activity;
  • any licences or registrations required for your activity;
  • references, trade history and information from fraud-prevention and credit-reference sources.

We use this data only to verify you, assess risk and prevent fraud, abuse and money laundering. Copies of identity documents are kept securely, accessed only by authorised staff, and deleted when no longer needed, as described in "How long we keep data".

05Telecommunications records

When you use our telecommunications Services, our systems create records needed to route, bill and protect the service. These may include originating and destination numbers, caller ID, date, time, duration, route, call status, IP addresses and volumes ("call detail records"). We do not record the audio of calls and do not access the content of communications, except where required by law or where you ask us to provide a feature that does so.

Call detail records are used for billing, fraud detection, traffic quality, network protection, dispute resolution, and to answer lawful requests from authorities.

06Job applicants

When you apply for a role through our careers pages, we collect your name, email address, telephone number, country and city, any link you choose to share, your note and your CV. We use this data only to assess your application, contact you about it and, if we make an offer, to prepare your contract.

Our lawful basis is taking steps at your request before entering into a contract, and our legitimate interest in recruiting the right people. Your application is seen only by the people involved in hiring and is stored in our own systems; CV files are kept private and are never published.

We keep applications for 6 months after we tell you our decision, then delete them. If you join our talent pool, we keep your details for up to 12 months so we can contact you about suitable roles; you can ask us to delete them at any time. Please do not include special category data (such as health or religious beliefs) in your CV.

07How we collect data

We collect personal data:

  • directly from you, when you contact us, use our contact form, open an account, order Services or speak with our team;
  • automatically, when you use our website, systems and Services (see our Cookie Policy);
  • from your organisation, when it names you as a contact or user;
  • from third parties, such as companies you authorise, credit-reference and fraud-prevention agencies, carriers and suppliers, and public sources such as Companies House.

08How we use your data

We use personal data to:

  • respond to enquiries and prepare quotes;
  • verify customers and suppliers and assess risk;
  • provide, operate, maintain and support the Services;
  • bill, collect payments and keep accounting records;
  • detect, prevent and investigate fraud, abuse, security incidents and unlawful use;
  • protect our network, systems, customers and suppliers;
  • improve our website and Services;
  • send service, security and account notices;
  • send marketing to business contacts where the law allows, with a simple way to opt out;
  • meet legal, regulatory and tax obligations, and establish, exercise or defend legal claims.

We do not sell personal data. We do not make decisions with legal or similarly significant effects about you based solely on automated processing, except automated fraud and abuse controls that may temporarily block traffic; you may ask for a human review of any such decision.

09Lawful basis

We rely on the following lawful bases under the UK GDPR:

  • Contract: to provide the Services and take steps you ask for before a contract;
  • Legal obligation: for tax, accounting, regulatory requirements and lawful requests from authorities;
  • Legitimate interests: to run and protect our business, verify customers, prevent fraud and abuse, secure our network, improve our Services and market to business contacts, where these interests are not overridden by your rights;
  • Consent: where the law requires it, for example non-essential cookies or certain marketing. You may withdraw consent at any time, without affecting earlier processing.

10Sharing your data

We share personal data only where needed, and only with:

  • our hosting, cloud, email, IT and business-system providers that process data on our behalf under written contracts;
  • carriers, network operators and suppliers, where needed to deliver, route, bill or protect telecommunications Services;
  • payment providers and banks;
  • professional advisers, such as lawyers, accountants, auditors and insurers;
  • fraud-prevention agencies, other operators and industry bodies, to prevent and investigate fraud and abuse;
  • police, regulators, courts and other authorities, where the law requires or allows it;
  • a buyer or successor, if our business or part of it is sold or reorganised.

Every processor we use must protect personal data and use it only on our instructions.

11International transfers

Some of our suppliers or carriers may be located outside the United Kingdom. Where personal data is transferred outside the UK, we make sure it is protected, using UK adequacy regulations, the International Data Transfer Agreement or Addendum issued by the Information Commissioner, or another safeguard permitted by law. Transfers to carriers that are needed to complete a communication you request may take place under the derogations permitted by law.

12How long we keep data

We keep personal data only as long as needed for the purpose it was collected for, then delete or anonymise it. In general:

  • enquiries that do not become a customer relationship: up to 24 months;
  • customer and account data: for the life of the relationship and up to 6 years after it ends, for legal claims;
  • invoices, payment and accounting records: 6 years after the end of the financial year, as required by UK tax law;
  • call detail records: up to 12 months in operational systems, and up to 6 years in restricted archives where needed for billing, tax, disputes or fraud;
  • verification records: for the life of the relationship and up to 5 years after it ends; copies of identity documents are deleted earlier where no longer needed;
  • security and system logs: up to 12 months, unless needed for an investigation.

We may keep data longer where required by law, or to investigate fraud, abuse or a legal claim.

13Security

We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls based on least privilege, multi-factor authentication for staff systems, logging, backups, and regular updates. Our staff and processors are bound by confidentiality.

No system is completely secure. If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the Information Commissioner's Office and, where required, you, as the law requires.

14Your rights

Under the UK GDPR you have the right to:

  • access the personal data we hold about you;
  • have inaccurate data corrected;
  • have data erased in certain circumstances;
  • restrict or object to processing, including objecting to direct marketing at any time;
  • data portability, where processing is based on consent or contract and carried out automatically;
  • withdraw consent, where we rely on consent.

To exercise a right, contact us at support@sowtk.net. We may need to verify your identity. We reply within one month, extendable where the law allows. Some rights are limited, for example where we must keep data by law or to defend a legal claim.

15Children

Our Services are intended for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

16Changes to this policy

We may update this policy from time to time. The date at the top shows when it last changed. Where changes are significant, we will tell customers by email or through our Services before they apply.

17Contact and complaints

For any question or request about your personal data, contact us at support@sowtk.net, or write to SOWTK LTD, 128 City Road, London, EC1V 2NX, United Kingdom.

If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection, at ico.org.uk. We would appreciate the chance to resolve your concern first.