Legal
Privacy Policy
This policy explains what information we handle and why. Use the contents below to find a topic, or make a privacy request without going through sales.
On this page
- Who we are and how to contact us
- Our role under UK GDPR
- What personal data we collect
- Special category data
- Lawful basis for processing
- Automated decision-making and AI
- How we use your personal data
- Marketing communications
- Data sharing and sub-processors
- International transfers
- Data retention
- Your rights under UK GDPR
- Cookies and tracking
- Security
- Third-party links
- Complaints, changes and contact
| When information is used | Where to find the detail |
|---|---|
| Enquiries, demos and procurement | Information collected, lawful bases and retention periods. |
| Customer-tenant work | Controller and processor roles, AI and human decisions, and the DPA. |
| Website operation and communications | Marketing choices, recipients and cookies and tracking. |
| Your rights or a concern | Your rights, complaints and contact, or make a privacy request. |
Last updated: 2 November 2026 · Version 1.3
1. Who we are and how to contact us
OpsWork is operated by Saqib Engineering Ltd, a company incorporated in England and Wales under Companies House registration number 15866031, trading as OpsWork. Registered office: Unit 17b Bradmarsh Business Park, Rotherham S60 1BY, United Kingdom. VAT registration: GB 491767937. ICO Data Protection registration: ZC196542.
For all privacy-related questions, contact privacy@opswork.uk. We will respond within five working days and resolve any formal request within one calendar month in accordance with UK GDPR.
Saqib Engineering Ltd is not currently required to appoint a statutory Data Protection Officer under UK GDPR Article 37. Privacy responsibility sits with Saqib Shah, Managing Director.
2. Our role under UK GDPR
We act in two distinct capacities:
(a) Data Controller, in respect of personal data submitted through this website, demo forms, sales correspondence and customer contract administration.
(b) Data Processor, in respect of customer data processed by the OpsWork product operating inside the customer-controlled Microsoft 365 tenant and Azure subscription. Our processor obligations are governed by the Data Processing Agreement signed before deployment.
When your organisation uses OpsWork, Letterbox or HVCO, your organisation is the controller of the personal data processed in its own environment.
3. What personal data we collect
Through this website we collect only what we need for what you ask us to do. The table shows what we collect when you use each part of the website, and what happens to it.
| When you | What we collect | What happens to it |
|---|---|---|
| Contact us, or ask for a demo or a price | Your name, company, work email, role, type of firm, team size, the product or plan you are interested in, and your message. | It goes to our sales records so we can reply. |
| Choose a demo time | The time you choose and what you would like to see, with the details above. | We read only free and busy times from our calendar to offer times. When we confirm, we send a Microsoft Teams invitation with your name and email from our Microsoft 365 calendar, and reminder emails 24 hours and 1 hour before. The link to choose a time works for 7 days. |
| Ask for an information pack | Your name, work email, job title, company and company number, the pack you want, and your confirmation that you will keep it confidential, with the time. | We check the company with Companies House and do not accept personal email addresses. If we approve, we email you a private link that works for 7 days. Each copy is stamped on every page with your name, company, email and the date, and each download is recorded. |
| Use Send to my IT | Your name, work email, company and product, your IT contact's email address, and an optional note. | We email your IT contact the setup information and tell them who asked for it. We use their address for nothing else. One order can send to IT at most 3 times, and each send is recorded. |
| Confirm your email address | Your email address. | We email you a 6-digit code. The code itself is never stored, and it works for 15 minutes. |
| Save a form to finish later | What you have typed so far. | We keep it for 7 days and email you a link to carry on. |
| Start a trial or buy | Your company's name, number, registered office and type; the name, job title and work email of the person accepting; the administrator's and billing contact's names and emails; your purchase order; your Microsoft 365 domain and number of users; your choice about product news; and your acceptance of our Terms and Data Processing Agreement, with its time, your IP address and your browser. | We check the company with Companies House. The acceptance details are kept as evidence of the contract. Card details, billing address and VAT number are entered on Stripe's own page (see Payments and billing data below). |
| Sign in to your account or console | Through Microsoft sign-in we receive your name, work email and your organisation's Microsoft 365 identity. In your account we hold your company details, the people you add, your products, your documents, your support messages and a history of changes. | A sign-in cookie keeps you signed in for 60 minutes and is renewed while you use your account, for up to 12 hours; signing out ends it at once. You can download your data, or ask us to delete it, from your account. |
| Send a support or privacy request | Your name, email, what the request is about, and what you write. | It goes to our support or privacy team with a reference, so we can answer it. |
| Ask for access to the investor area | Your name, email, company, role, note, and the confirmations you give. | If we approve, we email you a private link that works for 90 days. |
| Visit any page | Your IP address and browser details. | Our website host, Cloudflare, uses them to deliver pages and keep the site secure. We keep no access log of our own. Short-lived counters keyed by IP address limit abuse and are kept for at most 1 hour. Visits are also counted anonymously (clause 13). |
| Use the Glim guide | Nothing, unless you choose to send us a message. | Glim answers from our published pages, inside your browser. |
Emails we send you from this website, such as codes, receipts, confirmations and private links, come from our opswork.uk mailbox on Microsoft 365.
Through the OpsWork product: workloads deploy into the customer's Microsoft 365 and Azure environment. Optional OCR sends selected document copies to Microsoft Document Intelligence in UK South, where Microsoft uses shared regional temporary storage logically isolated by customer subscription and credentials. This is not storage wholly inside the customer's subscription. Explicit customer-MD acknowledgement is required before OCR. For OpsWork, Letterbox and HVCO alike, when we handle your organisation's content to provide a product we act as your processor, and the Data Processing Agreement sets out how.
We do not knowingly collect data from children. The Service is not directed at or intended for any person under 18 years of age.
4. Special category data
We do not solicit special category personal data (UK GDPR Article 9). Customer-side processing through the OpsWork product may include special category data (for example, HR records processed by the Paul agent), this is processed inside the customer's own tenant under the customer's controller obligations. We do not access such data unless explicitly authorised for support.
5. Lawful basis for processing
We rely on the following lawful bases:
(a) Legitimate interest, responding to business enquiries and demo requests, operating and securing the website and its forms (the robot check, abuse limits and company checks), recording who receives our confidential information packs, sending your IT contact the information you ask us to send, communicating with customers about their subscription, and business development outreach within PECR limits.
(b) Performance of contract, delivering the OpsWork Service under the subscription and Master Services Agreement, and the steps you ask us to take before a contract, such as setting up a trial.
(c) Legal obligation, compliance with UK statutory record-keeping, tax, and regulatory requirements.
(d) Consent, for product news emails and for statistics and advertising cookies (clause 13), which you can withdraw at any time by emailing privacy@opswork.uk, via the unsubscribe link in any product news email, or with Cookie settings at the bottom of every page.
6. Automated decision-making and AI
The OpsWork product uses AI agents to prepare drafts and decisions for review. Within the customer environment, no client-facing, irreversible or material action is taken without explicit human approval. Customers are the controllers of any automated processing within their tenants and are responsible for related data subject rights handling.
We do not subject visitors to this website to automated decision-making that produces legal or similarly significant effects. Some checks on our forms are automatic: we do not accept an information pack or trial request from a personal email address, or for a company that Companies House cannot find or shows as not active. If this affects you, email us and a person will look at your request. We do not use customer data or any data collected via this website to train, fine-tune or otherwise improve any AI model.
7. How we use your personal data
We use your data to: respond to enquiries and quotation requests; arrange demos; send information packs and the information you ask us to send to your IT contact; confirm email addresses; deliver onboarding and ongoing service; administer your subscription, billing and account; provide support; answer privacy requests; meet legal and regulatory obligations; keep the website secure; count visits anonymously and, if you say yes, analyse how the website is used and measure our adverts; and, where you have consented, send product news about new features, content and events.
8. Marketing communications
We only send marketing communications by electronic means where you have consented, for example with the product news tick when you start a trial, or where you are an existing customer receiving information about services similar to those you have purchased and have not opted out (PECR soft opt-in).
Every product news email has a one-click unsubscribe link, which takes effect at once. You can also opt out by emailing privacy@opswork.uk; opt-outs by email are honoured within 5 working days.
9. Data sharing and sub-processors
We do not sell, rent or trade personal data. We share personal data only with:
(a) Sub-processors necessary to deliver the Service and this website: Microsoft Corporation (Microsoft 365, including our email, calendar and Teams; Azure, including the OpsWork systems that receive website enquiries and orders; and Azure OpenAI); Cloudflare Inc. (website hosting and DNS, the robot check on forms, the anonymous visit count, and forwarding email sent to our opswork.uk addresses); and Stripe Payments Europe, Ltd (payments).
(b) Companies House, when we check a company: we send only the company name or number to the public register.
(c) Only if you say yes to statistics or advertising cookies: Google (Google Analytics, Google Ads), Microsoft (Clarity) and LinkedIn (LinkedIn Insight Tag), as described in clause 13.
(d) Your IT contact, when you use Send to my IT: only the information you ask us to send.
(e) Professional advisers (accountants, lawyers, auditors, insurers) under appropriate confidentiality obligations.
(f) Authorities where required by law, regulation or court order.
The current sub-processor list is published at opswork.uk/sub-processors and provided to customers on request as part of the procurement documentation. Material changes to the sub-processor list are notified to customers in advance.
10. International transfers
Product workloads deploy into customer-controlled Azure resources in UK South. Optional OCR includes Microsoft-managed UK South processing and temporary storage outside storage wholly owned by the customer's subscription. Microsoft states that submitted OCR input and results are deleted 24 hours after analysis completes; OpsWork does not promise immediate provider deletion. Any onward transfer associated with Microsoft service operations must be assessed under the applicable Microsoft agreement and customer DPA; UK regional processing is not a blanket statement about every support or operational access.
For this website, Cloudflare, Stripe and, only if you say yes to statistics or advertising cookies, Google, Microsoft and LinkedIn may process data outside the UK, including in the United States. Where they do, the transfer relies on the UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, or the provider's UK transfer terms.
Where a transfer is not covered by UK adequacy regulations or an applicable certified UK Extension to the EU-US Data Privacy Framework arrangement, we use the ICO International Data Transfer Agreement or its Addendum, as appropriate.
11. Data retention
Website enquiry records, including demo bookings, information pack requests and their download records, and Send to my IT requests: retained 24 months from last meaningful contact, then deleted or anonymised.
Customer contract records (including correspondence, contract documents, the record of your acceptance, and financial records): retained 7 years after termination of the subscription, in accordance with the Companies Act 2006 and HMRC record-keeping requirements.
Privacy requests: retained 6 years after we answer them, so we can show how each was handled.
Short-lived items: a form saved to finish later is kept 7 days; an email code is never stored and works for 15 minutes; private links work for 7 days (information packs and choosing a demo time) or 90 days (the investor area); a sign-in lasts 60 minutes, renewed while you use your account for up to 12 hours; abuse counters keyed by IP address are kept for at most 1 hour.
Marketing data: retained until you opt out, then suppressed indefinitely to honour your opt-out.
Cookies and browser storage: how long each one lasts is on the Cookies page. Your cookie choice is kept on your device for up to 12 months.
12. Your rights under UK GDPR
You have the right to: be informed about how your data is used; access your personal data; rectify inaccurate data; request erasure (in defined circumstances); restrict or object to processing; data portability; not be subject to solely automated decision-making with legal effect; and withdraw consent where processing relies on consent.
To exercise any of these rights, email privacy@opswork.uk with sufficient information for us to identify your records, or use our privacy request page. If you have an OpsWork account, you can also download your data, or ask us to delete it, from your account. We will respond within one calendar month, extendable to three months in complex cases where we will inform you of the reason within the first month.
13. Cookies and tracking
Necessary, always on. This website uses the cookies and browser storage it needs to work and stay secure: your sign-in, your light or dark choice, the robot check on forms, what you type on the buying pages if you go back a step, and your cookie choice.
Anonymous visit count, always on. Cloudflare Web Analytics, from our website host Cloudflare, counts page views, the page you came from, browser and device type, country, and how fast pages load. It sets no cookie, stores nothing on your device and gives you no visitor ID, so we see totals only, never who you are. Our lawful basis is our legitimate interests in running and improving this website (UK GDPR Article 6(1)(f)) and, for reading information from your browser, the statistics exception in PECR as amended by the Data (Use and Access) Act 2025. Blocking scripts from cloudflareinsights.com in your browser stops it.
Statistics and advertising, only if you say yes. We use these only if you say yes in the cookie banner. None of them is set before you choose, and Reject all keeps them all off. Statistics: Google Analytics and Microsoft Clarity (pages viewed, clicks and scrolling with the text you type hidden, device type and approximate location, with a random visitor ID, so we can improve the site). Advertising: Google Ads and LinkedIn Insight Tag (to measure our adverts and see which companies visit, never to identify you personally without your consent). Our lawful basis for these is your consent (UK GDPR Article 6(1)(a) and PECR regulation 6). Google, Microsoft and LinkedIn process this data in the EU and the United States under the UK adequacy regulations and the UK Extension to the EU-US Data Privacy Framework. Each tool's cookies, and how long they last, are on the Cookies page.
You can refuse, or withdraw at any time, with Cookie settings at the bottom of every page; refusing has no effect on using the site. Your choice is saved on your device for up to 12 months and sent to us with a random code and the wording version, never with your name, email or IP address. We do not display any third-party advertising. The full list, with each cookie, who sets it and how long it lasts, is on the Cookies page.
14. Security
We maintain appropriate technical and organisational measures (UK GDPR Article 32) including: encrypted transmission (TLS 1.2+), encrypted storage where applicable, least-privilege access controls, a robot check and abuse limits on our website forms, private links that expire, signed and timestamped audit logs in the OpsWork product, Entra ID identity for product agents, Azure Key Vault for secrets, and regular review of access. Further detail is in the Security architecture page and the Data Processing Agreement.
We carry appropriate professional indemnity and cyber liability insurance. Details can be provided to customers under non-disclosure during procurement.
15. Third-party links
This website may contain links to third-party websites and services. We are not responsible for the privacy practices or content of those websites and the inclusion of any link is not an endorsement. You should review the privacy policies of any third-party service before sharing personal data.
16. Complaints, changes and contact
If you are dissatisfied with how we handle your personal data, please contact privacy@opswork.uk first. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.
We will acknowledge your complaint within 30 days and respond without undue delay. You can also contact the ICO on 0303 123 1113.
We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page indicates the date of the most recent revision. Material changes will be notified to customers via email and to website visitors via a notice on this page for at least 30 days.
For privacy questions: privacy@opswork.uk
For general enquiries: hello@opswork.uk
Payments and billing data (current offer)
Subscriptions bought on this website are paid through Stripe. Our payment processor is Stripe Payments Europe, Ltd. Card details are entered on Stripe's own page and go to Stripe; OpsWork does not see or store them.
With your order we pass Stripe your company details, the names and emails you give for the acceptance, the administrator and billing, your purchase order and your Microsoft 365 domain, so the subscription carries them. We read back the billing address and VAT number you enter on Stripe's page to set up your subscription and invoices.
We keep the billing record for your subscription: firm name, billing email, plan, amounts, invoices and payment status. We never hold card numbers. Billing and invoice records are retained for 7 years, in line with the contract and financial records in clause 11.
This section sits beside the numbered clauses above and adds Stripe to the processors named in clause 9. Billing questions from existing customers: support@opswork.uk.