Privacy & security policy

Inforcer Privacy Policy

Last updated: 26 August 2026

Inforcer operates a Microsoft 365 multi-tenant management and security platform for managed service providers, together with related support and security services (collectively, the “Services”).

This privacy policy sets out how we collect, store, transfer, share and use information that identifies or is associated with you (your "personal information") that we process as a controller as further described in the paragraph headed “Who is responsible for your personal information” below.

Please read this privacy policy carefully. If you have any questions about this privacy policy or how we use your personal information, please contact us using the contact details set out in the paragraph headed “How to contact us” below.

Who is responsible for your personal information

When you visit the Website

Inforcer Ltd will be the controller of your personal information when you access and use our website at www.inforcer.com (the "Website") or contact us about our products and services. 

When your organisation uses the Services

The Services are provided by Inforcer Ltd or, for clients in the United States, by Inforcer, Inc. For ease, Inforcer Ltd and Inforcer, Inc. are collectively referred to in this privacy policy as “Inforcer”, “we”, “us” or “our”. 

Most of the personal information we receive in connection with the provision of our Services is processed by us as a processor on behalf of the relevant client, meaning we have contractually committed to processing that personal information only on behalf of, and on the instructions of the relevant client. That client will be the controller of that personal information, meaning they determine and are responsible for how that personal information is used, as set out in that client's privacy notice.

We do, however, also use certain information that we receive from clients’ authorised users as a controller, specifically:

• personal information relating to you if you are designated by our client as the main contact for that client’s use of the Services;

• personal information that we receive from clients’ users, such as error notifications, feedback and usage data that we collect through the Services; and

• certain personal information that is used to detect security risks. 

How to contact us

If you would like to contact us about anything in this privacy policy or how we use personal information, please email us at notices@inforcer.com.

Information we collect and how we use it

When we collect your personal information, we will inform you if the information is mandatory or optional. If you do not provide any information which is marked as mandatory, we will not be able to respond to your request or, where applicable, provide you or the client with access to the Services.

When you contact us about our products and services

When you contact us by email, phone or book a demo on the Website, we will collect the following information:

When you sign up for the Services

When you sign up for the Services, we will collect the following information about you if you are the client or the main point of contact for the relevant client:

If you are granted access to the Services by a client

If you are granted access to the Services by our client, we mostly process the personal information we receive about you as a processor. We do, however, also process certain personal information as a controller as follows:

If you are a user of our client’s systems

When our clients use our Services to monitor the security and integrity of their systems, we will collect certain information about how you use those systems to identify security risks. We primarily process this information as a processor on behalf of the relevant client; however, we also use this information as a controller as follows:

When you visit and browse the Website or access the Services

We also automatically collect certain personal information about you and about how you access the Website and the Services.

Cookies and similar technologies

We use cookies and similar technologies to collect certain personal information about how you access and use the Website and Services. To find out more about the types of cookies that we use, please click “show details” on the cookie banner on our Website or Services. You can return to the cookie banner at any time by clicking the floating cookie widget on our Website or Services.

Other than cookies that are required to operate the Website or Services, we will only place cookies on your device or use these technologies to collect information with your consent. If you would like to withdraw your consent to non-essential cookies, you can do this clicking the floating cookie widget on our Website or Services.

Most browsers will also allow you to disable all cookies through your browser or mobile settings. These settings will typically be found in the "options" or "preferences" menu of your browser. Please note that if you choose to refuse cookies you may not be able to use the full functionality of the Website or Services. 

Recipients of your personal information

We may share your personal information in the following situations:

• With Service Providers: We may share your personal information with service providers that perform services for us or on our behalf, such as providing hosting or other technical services such as analytics services or communication services. These recipients will use your personal information as processors on our instructions.

• With advisors: We may share your personal information with our advisors, such as legal advisors or accountants, in connection with obtaining professional services. The lawful basis we rely on for transferring this personal information is that the processing is necessary for our legitimate interests, namely obtaining professional advice.

• For business and corporate transactions: We may share or transfer your personal information with another company in connection with, or during negotiations of, any merger or sale of Inforcer or our assets. These recipients will use your personal information to assess the potential transaction with us, and otherwise only as disclosed in this privacy policy. The lawful basis we rely on for transferring this personal information is that the processing is necessary for our and the third party's legitimate interests, namely assessing and executing a potential transaction with us.

• With affiliates: We may share your information with our affiliates in order to coordinate, provide and receive centralised group-wide services. Affiliates include our parent company and any other subsidiaries, joint venture partners or other companies that we control or that are under common control with us. These recipients will use your personal information only as disclosed in this privacy policy. The lawful basis we rely on for transferring this personal information is that processing is necessary for our legitimate interests, namely managing group-wide services.

• With business partners: We may share your information with our business partners to offer you certain products, services or promotions. Where this is offered as part of the Services, the lawful basis we rely on for transferring personal information is that the processing is necessary for the performance of a contract with you (if you are the client) or for our legitimate interests, namely to provide our Services to the client. Where the transfer is in connection with marketing business partners’ services, we will only share your personal data where you have given us your consent to do so.

• With law enforcement, regulators and other parties for legal reasons: We may share your personal information with third parties as required by law or if we reasonably believe that such action is necessary to (i) comply with the law and the reasonable requests of law enforcement; (ii) detect and investigate illegal activities and breaches of agreements; and/or (iii) exercise or protect the rights, property, or personal safety of Inforcer, our users or others. These recipients will use your personal information in the performance of their regulatory or law enforcement role. The lawful basis we rely on for sharing personal information with these recipients is that the processing is either necessary to comply with a legal obligation to which we are subject, or is necessary for our legitimate interests, namely enforcing our rights or complying with requests from regulatory authorities.

Retention of your personal information

We will retain your personal information only for as long as is necessary for the purposes set out in this privacy policy, unless a longer retention period is required by law or for the establishment, exercise, or defence of legal claims.

International transfers

Your personal information may be transferred to — and maintained on — computers located outside of the country you are in where the data protection laws may differ than those in your jurisdiction.
If you are in the United Kingdom or the European Economic Area, these international transfers of your personal information will be made pursuant to appropriate safeguards in accordance with applicable law:

We will take appropriate steps to ensure that your personal information is treated securely and in accordance with applicable law and this privacy policy regardless of where it is processed.

If you wish to enquire further about the safeguards we use, please contact us using the details set out at in the paragraph headed “How to contact us” above.

Security of Your Personal Data

The security of Your Personal Data is important to Us, but remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. While We strive to use commercially acceptable means to protect Your Personal Data, We cannot guarantee its absolute security.

Our methods of protection include: (a) physical and environmental protections provided by our trusted cloud hosting providers, who maintain industry-standard security of their data centres; (b) organisational measures, such as employee training, background checks where appropriate, strict access controls, and ensuring staff only access data on a “need-to-know” basis; (c) technical measures, including encryption in transit and at rest, secure authentication, network monitoring, and regular vulnerability assessments.

Your privacy rights

You have the following rights in respect of your personal information that we hold:

• Right of access. You have the right to obtain:

  (i)    confirmation of whether, and where, we are processing your personal information;

  (ii)    information about the categories of personal information we are processing, the purposes for which we process your personal information and information as to how we determine applicable retention periods;

  (iii)    information about the categories of recipients with whom we may share your personal information; and

  (iv)    a copy of the personal information we hold about you.

• Right of portability. You have the right, in certain circumstances, to receive a copy of the personal information you have provided to us in a structured, commonly used, machine-readable format that supports re-use, or to request the transfer of your personal data to another person.
• Right to rectification. You have the right to obtain rectification of any inaccurate or incomplete personal information we hold about you without undue delay. 
• Right to erasure. You have the right, in some circumstances, to require us to erase your personal information without undue delay if the continued processing of that personal information is not justified.
• Right to restriction. You have the right, in some circumstances, to require us to limit the purposes for which we process your personal information if the continued processing of the personal information in this way is not justified, such as where the accuracy of the personal information is contested by you.
• Right to withdraw consent. If we have collected and presently process your personal information with your consent, you can withdraw consent at any time. Please note, however, that withdrawal of your consent will not affect the lawfulness of our prior processing of the personal information.
• Right to complain to us. You have the right to submit a complaint to us if you believe that we have not complied with applicable privacy law in how we process your personal information or deal with your rights request.

You also have the right to object to any processing based on our legitimate interests where there are grounds relating to your particular situation. There may be compelling reasons for continuing to process your personal information, and we will assess and inform you if that is the case.

If you wish to exercise one of these rights, please contact us using the contact details in the paragraph headed “How to contact us” above.

You also have the right make a complaint at any time to the Information Commissioner's Office ("ICO"), the UK regulator for data protection issues. You can make a complaint via the ICO's website (https://ico.org.uk/make-a-complaint/). This website also provides additional contact details for the ICO.

If you are resident in the EEA, you have the right to make a complaint at any time to the regulator in your jurisdiction. To find out how to contact your local regulator, please visit https://edpb.europa.eu/about-edpb/about-edpb/members_en.

Children's privacy

Our Website and Services are not directed at anyone under the age of 18. We do not knowingly collect personally identifiable information from anyone under the age of 18. If you are a parent or guardian and you are aware that your child has provided us with personal information, please contact us. If we become aware that we have collected personal information from anyone under the age of 18, we take steps to remove that information from our servers.

Links to other websites

Our Website and Services may contain links to other websites that are not operated by us. If you click on a third party link, you will be directed to that third party's site. We strongly advise you to review the privacy policy of every site you visit.
We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.

Changes to this privacy policy

We may update our privacy policy from time to time. We will notify you of any changes by posting the new privacy policy on this page.

We will let you know via email and/or a prominent notice on our Website or Services, prior to the change becoming effective and update the "Last updated" date at the top of this privacy policy.

You are advised to review this privacy policy periodically for any changes. Changes to this privacy policy are effective when they are posted on this page.