Privacy Policy

Effective date: 20/08/2026

Version: 3.1

This Privacy Policy explains how Computer Repair Norwich (“CRN”, “we”, “us”, “our”) collects, uses, stores, shares and protects personal data when you visit our website, contact us, request a quote, book a service, purchase a service, attend our premises, enter an area covered by our surveillance systems, interact with personnel using body-worn or portable recording equipment, or otherwise deal with us.

Please read this Privacy Policy carefully. It should be read together with our Cookie Policy, Website Terms of Use and Service Terms and Conditions.

1. Who we are

Computer Repair Norwich is the controller of the personal data covered by this Privacy Policy.

If you have any questions about this Privacy Policy or about how we use personal data, please contact us using the contact details published on our website or at:

Email: enquiries@computerrepairnorwich.co.uk

Business address: Belmont House, Costessey Lane, Norwich, NR8 6HA, UK

Telephone: 01603 936892 / 07895 859 864

2. What this policy covers

This Privacy Policy applies to personal data we collect through:

• our website;
• email, telephone, text message, social media or other communications;
• contact forms, quote requests and booking requests;
• diagnostic, repair, collection, return, upgrade, software and related services;
• attendance at, access to or activity at or around our premises;
• CCTV, fixed surveillance systems, security cameras, smart or doorbell cameras, body-worn cameras, portable cameras, handheld cameras and other visual or audio-visual recording systems operated in connection with our premises or business;
• any other interaction you have with us in connection with our business.

It applies to personal data relating to customers, prospective customers, website visitors, visitors to our premises and other individuals who contact us, use our services or enter an area covered by our surveillance systems.

3. The personal data we collect

Depending on how you interact with us, we may collect and use the following types of personal data:

• your name;
• your address;
• your email address;
• your telephone number;
• your booking, quote and enquiry details;
• your device details, fault descriptions, service history and job records;
• payment and transaction information;
• communications between you and us;
• marketing preferences;
• website usage data, technical data and analytics data;
• CCTV and surveillance information, including your image, appearance, movements, date and time of attendance, vehicle details or vehicle registration number;
• recordings of interactions with CRN personnel where body-worn, portable or other recording equipment is lawfully used;
• audio of customer interactions where audio recording is lawfully, necessarily and proportionately used;
• information concerning instructions, requests, advice, explanations, warnings, authorisations, complaints or other material communications captured during a recorded customer interaction;
• information relating to the arrival, possession, handover, collection, delivery or condition of customer equipment or other property where captured by surveillance equipment;
• any other information you choose to provide to us.

We may also keep records of quotations, invoices, diagnostics, repair notes, parts used, approvals given, warranty issues, complaints and other service-related administration.

4. Data we may access during repair or diagnostic work

Where you ask us to inspect, diagnose, repair, configure, recover or transfer data from a device, we may incidentally access personal data stored on that device, such as files, folders, photos, emails, account profiles, software settings or other user content.

We do not seek to review personal content unless this is reasonably necessary for diagnosis, repair, testing, migration, recovery, configuration, verification or another service you have asked us to provide.

You are responsible for backing up your data before handing a device to us unless we have expressly agreed otherwise in writing.

5. How we collect your personal data

We may collect personal data:

• directly from you when you contact us, complete a form, request a quote, make a booking, approve work, make a payment or otherwise communicate with us;
• from your device or browser when you use our website;
• from payment providers, analytics providers, hosting providers or other service providers who support our business;
• from other people acting on your behalf where you have asked them to contact us or arrange a service for you;
• from information contained on or supplied with a device you ask us to inspect or repair;
• automatically or directly through CCTV, fixed surveillance systems, security cameras, smart or doorbell cameras, body-worn cameras, portable cameras, handheld cameras or other recording equipment operated at or in connection with our premises or business activities.

Privacy information may be provided through one or more appropriate methods, including communications sent before an appointment or visit, this Privacy Policy, physical surveillance notices, visible cameras, recording indicators, verbal notification or other appropriate means.

Where surveillance information is provided in layers, concise physical notices may be supplemented by fuller information contained in pre-arrival communications and this Privacy Policy.

6. How we use your personal data and our lawful bases

The UK GDPR requires a lawful basis for processing personal data. Depending on the situation, we rely on one or more of the following: contract, legitimate interests, legal obligation and consent.

We may use your personal data for the following purposes:

6.1 To respond to enquiries, provide quotes and take steps before a contract

We use your contact details, enquiry details and device information to respond to messages, assess jobs, prepare quotations and discuss possible services.

Lawful basis: contract, where necessary to take steps at your request before entering into a contract; and/or legitimate interests in running and responding to business enquiries.

6.2 To provide services to you

We use your information to book, diagnose, inspect, collect, repair, upgrade, return, invoice and support the services you request from us.

Lawful basis: contract.

6.3 To manage payments, accounts, records and business administration

We use personal data for invoicing, payment handling, financial administration, record keeping, warranty administration, service history and other business operations.

Lawful basis: contract, legitimate interests and legal obligation, where records are required for tax, accounting or regulatory compliance.

6.4 To protect our business, systems and customers

We may use personal data for fraud prevention, misuse prevention, enforcing our terms, resolving disputes, debt recovery, protecting our systems, protecting persons and property, maintaining security at our premises and keeping our website and business secure.

Lawful basis: legitimate interests.

Our legitimate interests may include protecting customers, visitors, personnel, devices, equipment and property; preventing or investigating wrongdoing; maintaining accurate and reliable records of material customer interactions and significant incidents; resolving conflicting accounts or disputes; protecting the security and proper operation of our business; and establishing, exercising or defending legal rights.

6.5 To improve our website and services

We may use website usage data, enquiry trends, service records and analytics information to improve our website, customer experience, content, operations and service offering.

Lawful basis: legitimate interests, and where required by law, consent for non-essential cookies or similar technologies.

Our use of cookies and similar technologies is explained separately in our Cookie Policy.

6.6 To send marketing communications

If we send marketing by email, text or similar electronic means, we will do so only where permitted by law and, where required, on the basis of your consent.

Lawful basis: consent and/or legitimate interests where lawfully applicable.

Individuals have the right to object to direct marketing.

6.7 CCTV, smart cameras and fixed video surveillance

We may operate fixed cameras and surveillance systems for the protection and security of our customers, visitors, personnel, premises, customer equipment and business.

Surveillance equipment may include fixed CCTV, security cameras, smart cameras, doorbell cameras and other comparable recording technology.

Depending upon the equipment and settings in use from time to time, fixed surveillance may operate:

• continuously;
• intermittently;
• when movement or activity is detected;
• when a doorbell or other device is activated; or
• following another configured triggering event.

Some equipment may therefore create only short motion-triggered or event-triggered recordings, while other fixed CCTV systems may operate for longer periods or continuously where this is reasonably necessary and proportionate.

The equipment, configuration, recording duration and activation method may change from time to time as our security requirements and technology change.

6.8 Areas covered by fixed surveillance

Surveillance may cover the premises, driveway, access routes, entrances, exterior areas, customer handover and collection areas, working areas and other locations in which customers, visitors, vehicles, customer equipment or CRN personnel may reasonably be present.

Individuals and vehicles may enter the field of view of our surveillance equipment from the point at which they approach or cross the entrance or threshold of our driveway.

A recording may therefore begin before a visitor reaches the building itself and may continue while that person enters, remains at or leaves the premises.

Cameras positioned at or within our property may incidentally capture limited areas beyond our physical property boundary where those areas fall naturally within the camera’s field of view.

Where a camera’s field of view includes an area beyond our property boundary, we seek to ensure that the coverage remains reasonably necessary and proportionate to the legitimate purpose for which the camera is operated and that unnecessary intrusion into neighbouring property or unrelated areas is avoided where reasonably practicable.

6.9 Body-worn, portable and handheld recording

CRN personnel may wear, carry or use body-worn cameras, portable cameras, handheld cameras or other comparable recording equipment during customer visits, equipment drop-offs, collections, deliveries, handovers and other business interactions.

Body-worn or portable recording may be activated for all or part of a relevant customer interaction where we reasonably consider recording necessary and proportionate.

Relevant interactions may include:

• the arrival or departure of a customer;
• equipment drop-off or collection;
• documenting the condition in which equipment is presented or returned;
• explanations given by the customer about a fault, history or previous event;
• customer instructions or requests;
• discussions concerning the work or outcome requested;
• explanations, advice or warnings provided by CRN;
• discussions of risks associated with inspection, dismantling or repair;
• permissions or authorisations given or refused;
• discussions concerning quotations, charges or next steps;
• complaints or disagreements;
• safety or security concerns;
• unusual or significant incidents; and
• another material interaction where an accurate contemporaneous record may reasonably be required.

One purpose of body-worn recording is to create an accurate contemporaneous record of relevant customer interactions so that, where necessary, CRN and the customer can establish what was said, explained, requested, agreed, disputed or otherwise occurred.

Such recordings may be especially relevant where there is later a complaint, misunderstanding, conflicting recollection, allegation or legal dispute.

The availability or wearing of a body-worn camera does not mean that it is recording continuously throughout the day.

Continuous or indiscriminate body-worn recording will not be used merely because a device is capable of it. Recording should remain reasonably connected to the purpose for which it has been activated.

6.10 Audio recording of customer interactions

Body-worn and other portable cameras may be capable of recording audio as well as video.

Audio recording is more intrusive than purely visual recording and is therefore considered separately.

Where reasonably necessary and proportionate, body-worn recording may include audio so that the conversation itself forms part of the accurate contemporaneous record of a material customer interaction.

This may include recording what was said concerning:

• instructions or requests;
• the history or condition of equipment;
• pre-existing damage;
• equipment handover or collection;
• work requested;
• risks relating to inspection, dismantling or repair;
• advice, explanations or warnings provided by CRN;
• permissions or authorisations;
• quotations, charges or other material service matters;
• complaints or disputed matters;
• safety incidents or threatening or abusive behaviour; or
• another matter where the precise content of the conversation may reasonably be relevant later.

Audio is not used merely because recording equipment has a microphone.

We consider whether recording the conversation is reasonably necessary to achieve the particular purpose and whether the use of audio is proportionate to that purpose.

Audio recording will not ordinarily be left running indiscriminately outside relevant customer interactions.

Where reasonably practicable, the individual will be informed that body-worn video, audio or both are about to be recorded before recording begins.

6.11 Purposes of surveillance and recording

Our purposes for using fixed surveillance, body-worn video or other recording equipment may include:

• protecting customers, visitors, CRN personnel and other persons;
• protecting customer devices, vehicles, equipment, stock, tools and other property;
• maintaining the safety and security of our premises;
• preventing and detecting crime;
• deterring or investigating theft, fraud, criminal damage, threatening behaviour, harassment, trespass or other misconduct;
• documenting the arrival, handover, collection, delivery, possession or condition of equipment or property;
• creating an accurate contemporaneous record of material customer interactions;
• documenting instructions, requests, advice, explanations, warnings, permissions and authorisations;
• establishing what was or was not said, requested, explained, agreed or represented if accounts later differ;
• investigating complaints, accidents, incidents or allegations;
• resolving disputes and misunderstandings;
• verifying events or circumstances relevant to a customer or business dispute;
• dealing with insurance matters;
• establishing, exercising or defending contractual or legal rights or claims;
• providing evidence to appropriate authorities or professional advisers where lawful; and
• maintaining the proper and secure operation of our business.

Our principal lawful basis for ordinary business surveillance is our legitimate interests in protecting people and property, maintaining security, preventing and investigating wrongdoing, maintaining appropriate and reliable records of material customer interactions and significant incidents, resolving disputes and protecting our business and legal rights.

Other lawful bases may apply where processing is necessary to comply with a legal obligation or another provision of applicable law.

We do not rely upon customer consent where consent is not the appropriate lawful basis for surveillance.

6.12 Notification and transparency

We may provide information about surveillance and recording through one or more appropriate methods, including:

• appointment, booking or other communications sent before attendance;
• this Privacy Policy;
• physical CCTV or surveillance notices;
• visible cameras or recording equipment;
• warning lights or other indicators on recording equipment;
• verbal notification; or
• another appropriate means having regard to the circumstances.

Customers attending by appointment may therefore receive detailed information about surveillance before they arrive at the premises.

Physical notices may be concise and discreet where appropriate to the setting and may form part of a layered privacy-notice approach under which further information concerning CRN, the purposes of surveillance, retention, disclosure and individual rights is available through pre-arrival communications and this Privacy Policy.

Because body-worn and portable cameras may be less obvious than fixed surveillance equipment, where reasonably practicable we will inform an individual that body-worn video, audio or both are about to be recorded before activating the recording or otherwise provide an appropriate visible or audible indication that recording is taking place.

6.13 Objections to surveillance and body-worn recording

Where we rely upon legitimate interests, you may have the right to object to the processing of your personal data on grounds relating to your particular situation.

An objection may be made verbally or in writing.

If you object to body-worn or other non-essential recording, we will consider your particular circumstances, why you object, why recording is proposed, whether recording remains necessary and proportionate, and whether the purpose can reasonably be achieved by a less intrusive method.

Depending upon the circumstances, an alternative may include:

• conducting the relevant interaction without body-worn recording;
• reducing the duration or scope of the recording;
• recording video without audio or audio without video where the equipment permits and this adequately achieves the purpose;
• making contemporaneous written notes;
• using written confirmation of important instructions or warnings; or
• another appropriate arrangement.

Your objection does not necessarily require us to stop processing. Where applicable law permits us to do so, we may continue processing if we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or where processing is necessary for the establishment, exercise or defence of legal claims.

An objection to body-worn recording does not automatically require CRN to deactivate fixed security cameras or other surveillance systems lawfully operated for the safety and security of people, premises or property.

Where CRN reasonably considers body-worn or portable recording necessary for a particular interaction and no suitable less intrusive alternative can reasonably achieve the purpose, we may decide not to commence the relevant face-to-face interaction or accept the proposed service.

Where an existing service or contract is already underway or we already hold your equipment, we will consider the existing contractual position and the circumstances before deciding how the matter should proceed. Any discontinuation of work, return of equipment, payment obligation or other consequence will be handled in accordance with applicable law and our Service Terms and Conditions.

A decision not to provide or continue a service will not be made because of a protected characteristic or another unlawful discriminatory reason. We will consider any reasonable adjustment or other requirement arising under applicable equality law.

If your communication amounts to an exercise of your statutory right to object, we will handle and respond to it within the period required by applicable data-protection law.

6.14 Retention, security and use of surveillance recordings

Surveillance footage is retained only for as long as reasonably necessary for the purposes for which it was collected.

Routine fixed-camera or surveillance footage may be automatically overwritten or deleted in accordance with the retention settings and storage capacity of the relevant system.

Routine body-worn recordings may likewise be deleted when they are no longer reasonably required for the purpose for which they were made.

Where footage relates to an accident, safety or security incident, material customer interaction, suspected offence, complaint, dispute, allegation, insurance matter, legal claim, equipment handover or another event requiring investigation or evidence, relevant footage may be identified, extracted or preserved and retained for longer where reasonably necessary.

Preserved footage may be retained for as long as reasonably necessary to investigate or resolve the relevant matter, comply with a legal obligation, cooperate with an appropriate authority, or establish, exercise or defend legal rights.

Access to surveillance recordings is restricted to persons who reasonably require access for an authorised purpose.

We take reasonable technical and organisational measures to protect recordings against unauthorised access, alteration, disclosure, copying, loss or destruction.

We do not retain surveillance footage indefinitely merely because storage capacity allows us to do so.

7. Special category data

We do not normally ask for special category personal data.

Please avoid sending us unnecessary sensitive information unless it is genuinely relevant to the service you require.

If you choose to provide this kind of information, or if special category information is incidentally captured during an otherwise lawful business interaction or surveillance recording, we will handle it only where we have a lawful basis and, where required, an additional condition for processing.

We do not use ordinary CCTV or body-worn surveillance for facial-recognition identification, biometric identification or similar automated biometric processing unless we expressly introduce such technology and first put in place any additional legal safeguards and privacy information required.

8. Passwords, account access and device content

If a service requires account access, passcodes, passwords, recovery details or access credentials, we may use those details only for the purpose of carrying out the service you requested, testing the device, confirming functionality, returning the device in working order, or otherwise administering the job.

We ask that you do not provide us with unnecessary passwords or personal information unless they are genuinely needed for the requested service.

9. Who we may share personal data with

We may share personal data where reasonably necessary with:

• payment processors;
• website hosting and IT service providers;
• email and communications providers;
• cloud storage or business software providers;
• analytics providers;
• accountants, professional advisers or insurers;
• delivery, courier or collection providers;
• parts suppliers, specialist subcontractors or service partners where relevant to the job;
• suppliers or service providers involved in the operation, storage, maintenance or security of surveillance systems;
• law enforcement, regulators, courts, government bodies or other third parties where required by law or where necessary to establish, exercise or defend legal claims.

Relevant surveillance or body-worn recordings may also be disclosed where lawfully and reasonably necessary to the police, insurers, solicitors, courts, tribunals, regulators or other appropriate persons in connection with an incident, complaint, suspected offence, insurance matter or legal claim.

We do not sell your personal data.

10. International transfers

Some of our service providers may store or process personal data outside the UK.

Where we make a restricted transfer of personal data outside the UK, we will do so only where lawful and with appropriate safeguards in place, such as use of a country covered by UK adequacy regulations or other permitted transfer mechanisms and protections.

If you would like more information about any international transfers and the safeguards used, please contact us.

11. How long we keep personal data

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, including for legal, accounting, tax, insurance, complaint-handling, warranty, fraud-prevention, security and record-keeping purposes.

As a general guide, we may keep:

• enquiries and quote requests: for up to 12 months after the last meaningful contact;
• customer job records, invoices and transaction records: for up to 6 years after the end of the relevant customer relationship or accounting period;
• warranty and complaint records: for up to 6 years after the matter is closed;
• marketing consent and suppression records: until consent is withdrawn, you opt out, or for as long as needed to maintain our do-not-contact records;
• website analytics and cookie-related data: in line with our Cookie Policy and the settings of the relevant tools;
• routine fixed-camera, CCTV and body-worn footage: for the period reasonably necessary for its security, evidential or record-keeping purpose, after which it may be automatically overwritten or deleted;
• preserved surveillance or body-worn footage relating to a particular material interaction, incident, complaint, dispute, alleged offence, insurance matter or legal claim: for as long as reasonably necessary to investigate or resolve the matter or establish, exercise or defend legal rights.

We may keep information for longer where reasonably necessary to comply with legal obligations, resolve disputes, enforce our agreements, investigate incidents, deal with complaints or defend legal claims.

12. Security

We take reasonable technical and organisational measures to protect personal data against unauthorised access, misuse, alteration, disclosure or loss.

These measures may include secure devices, password protection, access controls, encryption where appropriate, secure software, limited access to records, reputable service providers, and secure disposal or deletion where data is no longer needed.

Surveillance and body-worn recordings are subject to the same general security principles, with access limited to persons who reasonably require it for an authorised purpose.

No method of transmission over the internet or method of electronic storage is completely secure, so we cannot guarantee absolute security.

13. Your data protection rights

Under the UK GDPR, individuals may have rights including:

• the right to be informed;
• the right of access;
• the right to rectification;
• the right to erasure;
• the right to restrict processing;
• the right to data portability;
• the right to object; and
• rights relating to automated decision-making, where applicable.

These rights do not apply in every case, and some are subject to conditions, exemptions or limitations.

If you want to exercise any of your rights, including an objection to processing based upon our legitimate interests, please contact us using the contact details in this policy.

An objection may be made verbally or in writing.

14. Subject access requests

You can ask for a copy of the personal data we hold about you, including fixed-camera, CCTV or body-worn recordings in which you are identifiable where the right of access applies.

We will normally respond to a valid subject access request within the period required by applicable law.

A subject access request is normally free of charge, although a reasonable fee may be permitted in limited circumstances such as manifestly unfounded or excessive requests or requests for additional copies.

We may ask for information to verify your identity before responding to a request.

For a request concerning CCTV, body-worn video, audio or other surveillance footage, it is helpful to provide the approximate date, time, location and circumstances of the recording so that we can identify the relevant footage.

Where a recording also contains personal data relating to another individual, we may need to blur, redact, mute, crop or otherwise protect that person’s information before disclosure.

An applicable exemption or other lawful restriction may affect whether particular footage can be provided.

15. Marketing

Where we send marketing communications, you can opt out at any time by:

• clicking the unsubscribe link where available;
• contacting us directly; or
• asking us to stop.

Individuals have the right to object to direct marketing.

We may still keep limited suppression information so that we can respect your opt-out request and avoid contacting you again inappropriately.

16. Cookies and similar technologies

Our website may use cookies and similar technologies for functionality, security, analytics and user experience.

Our use of cookies and similar technologies is explained in more detail in our Cookie Policy.

Where applicable law requires consent for a non-essential cookie or similar technology, we will seek that consent before using it.

17. Third-party websites

Our website may contain links to third-party websites, plug-ins or services.

We are not responsible for the privacy practices, content or security of third-party websites.

You should read their privacy policies separately.

18. Complaints

If you have any concern about how we use your personal data, please contact us first so that we have the opportunity to investigate and try to resolve the matter.

You also have the right to complain to the Information Commissioner’s Office (ICO), which is the UK supervisory authority for data protection matters.

You can find details on the ICO website.

19. Changes to this Privacy Policy

We may update this Privacy Policy from time to time.

Any updated version will be posted on our website with a revised effective date and version number.

We recommend checking this page periodically to stay informed of any changes.

20. Contact us

If you have any questions about this Privacy Policy or about how we handle personal data, please contact us using the details below:

Computer Repair Norwich

Email: enquiries@computerrepairnorwich.co.uk

Telephone: 01603 936892 / 07895 859 864

Address: Belmont House, Costessey Lane, Norwich, NR8 6HA, UK