Iconic Management Solutions UK was established to support UK-based organisations and international companies operating in the UK and the EU with managed mobility, wireless expense management, telecom expense management, procurement support, and technology lifecycle visibility.
Iconic Management Solutions UK Limited is a private company limited by shares incorporated in England and Wales under company number 17320780. Its registered office is at 6 Baker Street, Middlesbrough, England, TS1 2LH.
In this Privacy Notice, “IMS UK”, “we”, “us” and “our” refer to Iconic Management Solutions UK Limited.
For personal data covered by this Privacy Notice, IMS UK generally acts as the controller. This means that we determine why and how the personal data is processed. In certain service engagements, we may instead act as a processor on behalf of a business client, as explained below.
| Company | Iconic Management Solutions UK Limited |
| privacy@iconicms.co.uk | |
| Post | Data Protection Enquiries, Iconic Management Solutions UK Limited, 6 Baker Street, Middlesbrough, England, TS1 2LH |
| Company Number | 17320780 |
This Privacy Notice explains how IMS UK collects, uses, discloses, retains and protects personal data relating to:
This Notice applies to our website, business-development activities, client and supplier administration, and related corporate operations. It does not replace a more specific privacy notice, contractual data protection clause or data processing agreement that applies to a particular service, platform or engagement.
In providing Managed Mobility Services, Wireless Expense Management, Telecom Expense Management, device lifecycle services, carrier account support or related services, IMS UK may process personal data on behalf of a business client. That data may include employee names, business mobile numbers, user identifiers, device identifiers, carrier account information, usage information and billing records.
Where relevant to an enquiry or contracted service, we may process:
Where this data is processed on behalf of a client, the client is generally responsible for establishing the lawful basis on which it collects and provides the data to IMS UK.
Further information is provided in our Cookie Policy.
We may process data needed to authenticate users, prevent fraud, detect and investigate cybersecurity threats, respond to suspected misuse, comply with legal or regulatory requirements, or establish, exercise or defend legal rights.
Our website and ordinary business-development activities are not intended to collect:
Please do not submit such information through a general website form. Where sensitive data is genuinely necessary for a specific service, it will be handled through an appropriate contractual, technical and legal process.
We may obtain personal data:
Where we obtain personal data from another source, we will provide the privacy information required by applicable law within the required period, unless a lawful exception applies.
| Purpose | Typical lawful basis |
|---|---|
| Responding to enquiries and arranging consultations | Taking steps requested before entering a contract; legitimate interests in responding to business enquiries |
| Assessing prospective engagements and preparing proposals | Taking steps requested before entering a contract; legitimate interests in business development |
| Managing client, carrier, supplier and partner relationships | Contract; legitimate interests in managing professional and commercial relationships |
| Delivering contracted services | Contract where the individual is a party; legitimate interests; processing on behalf of a client |
| Managing user, device, billing and carrier data for clients | Client instructions under a data processing agreement; legitimate interests where IMS UK acts as controller |
| Processing invoices and payments | Contract; legal obligations; legitimate interests in obtaining and recording payment |
| Maintaining accounting, tax and corporate records | Legal obligation |
| Operating, maintaining and securing websites and systems | Legitimate interests in secure and reliable systems; legal obligations |
| Preventing fraud, misuse and cybersecurity incidents | Legitimate interests; legal obligations; recognised legitimate interests where applicable |
| Conducting non-exempt website analytics | Consent |
| Sending service-related communications | Contract; legitimate interests |
| Sending business-to-business marketing | Legitimate interests or consent, depending on the recipient, method and applicable law |
| Maintaining suppression records | Legitimate interests and legal compliance |
| Handling complaints and rights requests | Legal obligation |
| Establishing, exercising or defending legal claims | Legitimate interests; legal obligation |
| Complying with lawful requests from authorities | Legal obligation; recognised legitimate interests where applicable |
| Evaluating or completing a corporate transaction | Legitimate interests, subject to confidentiality and data protection safeguards |
Where we rely on legitimate interests, those interests may include operating and developing our business, responding to business enquiries, maintaining business relationships, protecting personnel, clients, systems and property, improving services, maintaining appropriate records, preventing fraud and communicating relevant B2B service information. We consider whether the processing is necessary and proportionate and whether the individual’s rights and interests override those interests.
We may use business contact data to communicate about IMS UK services, events, publications and developments where permitted by law. The rules may differ depending on whether the recipient is a limited company or other corporate subscriber, a sole trader, an unincorporated partnership or an individual acting in a personal capacity. Where consent is required, we will seek valid consent before sending the communication. Where we rely on legitimate interests for B2B marketing, we will use the data proportionately, identify IMS UK, provide a valid and simple opt-out and maintain an appropriate suppression record.
RIGHT TO OBJECT TO DIRECT MARKETING. You have an absolute right to object at any time to the use of your personal data for direct marketing, including related profiling.
You may opt out by using an unsubscribe link, replying to the communication or emailing privacy@iconicms.co.uk. Service, security, contractual and regulatory communications are not marketing and may continue where necessary.
We use cookies and similar storage or access technologies in accordance with our Cookie Policy. Strictly necessary technologies may operate without consent where legally permitted. Non-exempt analytics, functional, advertising and tracking technologies will not operate until an appropriate choice has been made. Users may change their choices through the Cookie Settings link on the website.
We may share personal data with our parent company, Iconic Management Solutions, LLC, in the United States. It may provide operational, administrative, technical, security, management, reporting, customer-support or business-development assistance. Depending on the activity, the parent may act as a processor, separate controller or joint controller under an appropriate arrangement.
We may engage service providers supporting website hosting and development, cloud infrastructure, email and collaboration, cybersecurity, customer relationship management, analytics, payment administration, accounting, document management, electronic signature, telecommunications, support, data storage and backup. Providers must be subject to appropriate confidentiality, security and data protection obligations.
Where necessary to respond to an enquiry or perform services, personal data may be shared with the relevant client, telecom carrier, mobile network operator, device or accessories supplier, fulfilment provider, trade-in vendor, professional adviser or other party involved in the applicable service or transaction.
We may disclose personal data to courts, law enforcement bodies, regulators, tax authorities, government departments, auditors, insurers and professional advisers where authorised or required by law or reasonably necessary to protect legal rights.
Personal data may be disclosed under appropriate safeguards in connection with a proposed or completed merger, acquisition, financing, restructuring, transfer of business, sale of assets or insolvency process.
Personal data may be accessed, processed or stored outside the United Kingdom, including in the United States, because IMS UK works with its U.S. parent and may use international service providers.
Where a restricted international transfer is made, we will use a legally recognised transfer mechanism. Depending on the recipient and circumstances, this may include:
Where required, we conduct an appropriate transfer risk or data protection assessment and implement supplementary safeguards. Further information about the safeguards used may be requested at privacy@iconicms.co.uk.
We retain personal data only for as long as reasonably necessary for the applicable purpose, including legal, accounting, security and evidentiary requirements. Our general retention approach is as follows:
| Record category | General retention period |
|---|---|
| General website enquiries not resulting in an engagement | Up to 24 months after the last substantive interaction |
| Prospect and business-development records | Up to 24 months after the last meaningful interaction, unless a longer relationship or lawful reason applies |
| Marketing consent and preference records | For as long as the marketing activity continues and as needed to demonstrate compliance |
| Marketing suppression records | A minimal record for as long as necessary to honour the objection |
| Client contracts and principal engagement records | Generally 7 years after the engagement ends |
| Accounting, invoice and tax records | For the period required by applicable tax and accounting law |
| Client service data processed as processor | As directed by the client and specified in the applicable contract or data processing agreement |
| Website security and access logs | Normally up to 12 months, unless required for an investigation or legal matter |
| Cookie and consent records | As stated in the Cookie Policy or consent-management platform |
| Data protection complaints and rights-request records | Generally 6 years after closure, subject to necessity and proportionality |
| Legal claim and dispute records | Until the relevant limitation period expires and any claim is finally resolved |
Data may be retained longer where necessary for litigation, a regulatory inquiry, fraud prevention, legal compliance or enforcement of an agreement. Backup copies may remain for a limited period under controlled deletion and disaster-recovery procedures.
Subject to applicable conditions and exemptions, you may have the right to:
These rights are not absolute and may depend on the purpose, lawful basis and circumstances of the processing. We do not ordinarily charge a fee. A reasonable fee may be charged, or a request refused, where permitted by law because it is manifestly unfounded or excessive. We may request proportionate information to confirm identity and authority before acting on a request.
Requests may be submitted through our Privacy Rights and Data Protection Complaints page or by emailing privacy@iconicms.co.uk.
IMS UK does not presently use website visitor or business contact data to make decisions based solely on automated processing that produce legal or similarly significant effects. If this changes, we will provide the information and safeguards required by law.
We use proportionate technical and organisational measures designed to protect personal data against unauthorised access, unlawful processing, accidental loss, alteration, disclosure and destruction. Measures may include access controls, authentication, encryption where appropriate, logging and monitoring, vulnerability and patch management, supplier due diligence, confidentiality obligations, security awareness, incident response and backup and recovery controls.
No internet transmission or information system can be guaranteed to be completely secure. Users should not send passwords, payment credentials or unnecessary sensitive information through an ordinary website contact form.
We maintain procedures for assessing and responding to suspected personal data breaches. Where required by law, we will notify the Information Commissioner’s Office and affected individuals within the applicable statutory periods.
Our website and services are directed to organisations and professional users. They are not intended for children under 18. We do not knowingly collect personal data from children through the website. If we become aware that such data has been submitted without an appropriate lawful basis, we will take reasonable steps to delete it.
Our website may contain links to websites operated by third parties. IMS UK is not responsible for the privacy or security practices of third-party websites. Users should review the applicable third-party privacy notice before providing personal data.
A complaint concerning our use of personal data may be submitted through our Privacy Rights and Data Protection Complaints page, by email to privacy@iconicms.co.uk, or by post to the address stated in section 1.
We will:We encourage individuals to contact us first so that we can investigate and attempt to resolve the matter. You also have the right to complain to the Information Commissioner’s Office (ICO).
We may amend this Privacy Notice to reflect changes in law, regulation, our services, technology, suppliers or information-handling practices. The revised notice will be posted on the website with an updated date. Where appropriate, we may provide additional notice of a material change.
