CONSUMER PRIVACY NOTICE

DATA PROTECTION FOR 247CONNECT

NetSupport Limited (you may know us as NetSupport, NetSupport Software or NSL) is committed to keeping information provided by you confidential and we shall always be transparent with you about how we are using your details. As customers, or others who want to interact with us, you should always feel safe and secure in how your data is handled.

Where you are a customer making use of our Free 247connect licence for personal use, NetSupport acts as the Data Controller and this Notice forms part of the Terms of Service. If using the Free product for commercial purposes, please refer to our Data Processing Agreement.

In this Notice, we explain how we comply with relevant Data Protection legislation such as the General Data Protection Regulation (GDPR), the Data Protection Act 2018 (DPA), the Privacy and Electronic Communications Regulations (PECR), the California Consumer Privacy Act (CCPA) and other general principles.

Managing Privacy And Personal Data – 247connect At A Glance

This policy will explain what personal data is collected, the purposes behind this, applicable lawful bases, how long we keep data for, who we use to process this data and where that takes place, and your rights as Data Subjects.

We have tried not to use too much legal language, but sometimes we may need to point to particular things. For example, if we say ‘you’ or ‘your’, we will mean you as a Customer or Data Subject. If we say ‘we’, ‘us’, ‘our’ or ‘NetSupport’, we mean NetSupport as the Data Controller.

Read the full Consumer Privacy Notice here

Types of data we collect to use (Tell me why)

• Contact details
• Information we get from other systems
• Information that identifies users
• Information about devices and activities
• Information on how you use 247connect
• Audit information about your 247connect usage.

How we use your data (How exactly?)

• To provide you with remote access and remote management tools, through installed agents or requests
• To provide you with information and tools to perform technical tasks
• To maintain a consistent audit trail of activities and actions
• To keep 247connect running and improve the existing service and tools
• To give personalised customer support.

Sub-processors and partners who process your data (What do they do?)

NetSupport uses the following services to help us store and process your data on our behalf:

• Infrastructure: Microsoft Azure
• Integrations: Microsoft Entra, Google Cloud
• Comms: Twilio Sendgrid.

We use cookies (How can I choose?)

• We use only necessary cookies to run and improve the service.
• We use only necessary cookies to run and improve how we manage our customer relationship with you.
• Our partners/processors use cookies too, which they control.
• You can turn off cookies, but this will mean, for example, that we can’t recognise you in in-app functions or we can’t resolve issues so efficiently.

When and how we collect data (Am I included?)

We collect data from people and devices connected to the 247connect platform, people browsing our website, NetSupport customers and people who view or obtain support through NetSupport:

Know your rights (What can I do?)

• You can access information we hold for you.
• Opt-out of service and notification emails
• Be forgotten by NetSupport
• You can complain about us.

If you have any concerns about your data’s privacy at NetSupport, please get in touch via our contact form, email us at [email protected] or hit the Chat button on our website to talk to us.

The 247connect Full Consumer Privacy Notice

Our role in your privacy

If you are a NetSupport customer or subscriber, this agreement applies to you. As part of the Terms of Service and Consumer Privacy Notice in our contract with you, you should check this agreement to make sure that this is understood to be as we are the provider of the 247connect platform. This agreement is based on the UK GDPR but will also cover other regions.

Our responsibilities

If you are a registered customer of 247connect - Free, we act as the Data Controller of personal data. This means that we provide you with a service that allows you to process personal data based on the purpose and means as set out in Section 3 of our Terms of Service. We are registered with the UK Information Commissioner’s Office under number Z9139408. We also provide you with all details of who we work with, technical and security information and how you can make checks to ensure we are meeting our requirements against both this agreement and any relevant laws.

As you have entrusted us to provide a service to you which processes your personal data, we want to demonstrate to you what that looks like. This Privacy Notice is designed to help you understand what happens with your Personal Data and our commitment to protecting it.

As part of this Notice, we will provide clear information together with linked documents, be available to discuss and work through any questions you have, provide information about our partners who we use to process your data, and give guidance to help you take a privacy-first approach with our tools. Please note that this is a statutory requirement and is not part of any technical support.

Your responsibilities

• Read this Consumer Privacy Notice.
• Check any contract or Terms of Service between us or any other document we have asked you to look at, as these may also have specific information that you want.
• Where you have provided us with personal information as part of our service, or where your end-users have provided us with personal data, it will only be used for the reasons it was provided to us. By submitting the information to us, you confirm that you have the right to authorise us to process it in accordance with this Consumer Privacy Notice.
• You have reviewed the most appropriate use of 247connect and understand that you hold responsibilities for how it is used.

What if I am just using 247connect as an end-user?

If you are reviewing 247connect because the Customer has access to your personal data, this is outside of the scope of this Notice, and you need to discuss this with the Customer.

 When and how we collect data

From the first moment your users and devices interact with 247connect, we are collecting data. Sometimes users provide us with data, and sometimes data about users and devices is collected automatically.

Here’s when and how this is done:

What types of data we collect

Contact details

Your name, email address, contact numbers.

Technical data that identifies you

Your IP address, login information, browser type, time-zone setting, browser plug-in types, geolocation information about where you might be, the device you are using, operating system and version.

Data on how you use 247connect during remote management sessions

Images of desktops whilst you are working, requests for help/chats with your operator, applications used and websites accessed.

Data on how 247connect is accessed or changes made

Information on access to the 247connect web portal, changes to devices/user, an audit trail for any configuration changes and who made them.

What about really sensitive data?

We know that you will be using247connect to remotely connect to other devices and other general activities as part of general usage. When users of those devices are using them as part of daily use, talking with others via their devices and share how they are feeling or their particular experiences, then they may be sharing sensitive information. You may also decide to identify end-users or their devices based on ‘sensitive data’ (like racial or ethnic origin, political opinions, religious/philosophical beliefs, genetic data, biometric data, health data, or data about their sexual life). Where you share sensitive information or we process it, then it will be allowed based on how you have agreed to it. We will process this information on the understanding that explicit consent is provided to do this, but you should be mindful of what is shared.

What about children’s data?

247connect is designed to provide Customers with resources and tools to aid in remote management, remote support and remote access. This means that both Customer and end-user personal data will be used. It is not intended that these tools are to be used specifically with children, and are not designed as such.

How and why we collect your data

Data protection law means that we can only use your data where we set out certain reasons and where we have a lawful basis to do so, or where we are required to use it with relevant authorities. As part of the building of 247connect, we have taken this into account, and these are the areas we have identified. If you do not agree with these, then please do not accept the Terms of Service and this Consumer Privacy Notice. All quoted statements below are taken from UK GDPR (Article 6 or 9) or from the ICO website - Data protection principles, definitions, and key terms | ICO.

Giving you 247connect and all relevant resources

This means making sure that 247connect gives you all the available tools. This includes access to resources, delivery of the service and ensuring continued delivery, including service and notification emails.

Lawful basis for this data usage: Contractual Obligations/Legitimate Interests.

Improving 247connect

This means making sure that 247connect is the right tool for you and works as you need it to, including any improvements needed to make sure it continues to be the right tool. This will include technical support and analytical information.

This may also mean taking personal data and anonymising it, so that when different people within NetSupport use it, we have protected it as much as we can.

Lawful basis for this data usage: Legitimate Interest.

Here is what each of the lawful bases means:

Performance of a contract

This states:

“Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract”

Legitimate interest

This states:

“Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.”

Use of legitimate interest would involve a three-part test, looking at the purpose, the necessity and where the balance is between your use of the data and the individual’s interest.

A wide range of interests may be legitimate interests. They can be your own interests or the interests of third parties, and commercial interests as well as wider societal benefits. They may be compelling or trivial, but trivial interests may be more easily overridden in the balancing test.

Other lawful bases

If this involves sensitive/special category personal data, then you will also need to consider the exemption you are using under article 9 of GDPR, such as explicit consent.

Explicit consent

This states:

“the data subject has given explicit consent to the processing of those personal data for one or more specified purposes…”

In these circumstances, it is you, the Customer, who is providing Explicit consent, and it is your responsibility to make sure that this is correct.

For all countries, we try to make sure that it is understood that your organisation makes the decision and ensures they have the right basis for using any personal data.

Your Choices and Rights

Your choices

We will only use the personal data you give us or allow us to collect. Where we have been given personal data by you, we will only use what has been provided. It will not be repurposed or passed on to others.

Turning off cookies in your browser by changing its settings. There are various settings in your web browser that you can use to block or refuse cookies. You can also delete cookies through your browser settings . However, if you do delete cookies, some of 247connect may not work. We have already mentioned that we collect some information about your computer and how you use 247connect, and any cookies we use really are needed.

No need to ask us not to use your data for marketing. Any information you provide to us or that you create when you use 247connect is only ever used as part of giving you 247connect. We do not use it for any marketing or anything else.

Your rights

• Your right of access - You have the right to ask us for copies of your personal information. You can request other information, such as details about where we get personal information from and who we share personal information with. There are some exemptions, which means you may not receive all the information you ask for. Read more about the right of access.
• Your right to rectification - You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. Read more about the right to rectification.
• Your right to erasure - You have the right to ask us to delete your personal information. Read more about the right to erasure.
• Your right to restriction of processing - You have the right to ask us to limit how we can use your personal information. Read more about the right to restriction of processing.
• Your right to object to processing - You have the right to object to the processing of your personal data. Read more about the right to object to processing.
• Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation or to you. Read more about the right to data portability.
• Your right to withdraw consent – When we use consent as our lawful basis, you have the right to withdraw your consent at any time. Read more about the right to withdraw consent.

If you make a request, we must respond to you without undue delay and, in any event, within one month.

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

How secure is the data we collect?

We have organisational and technical measures in place to safeguard and secure the information we hold, based on standard industry practices. Further information is in our general Request for Information document as part of this Consumer Privacy Notice, but we prefer not to publicly publish too much security information as a measure to protect our services.

And please remember:

• Only share personal data where you need to.
• You are responsible for your username and password, so keep them secret and safe!
• If you believe that your privacy has been breached, then contact your Data Protection Officer or follow the guidance your organisation provides.

Where do we store your data?

The personal data we collect is processed at our offices in Peterborough or regional offices, or our platform, which is hosted by Microsoft Azure Services in the

By submitting your personal data, you agree to this transfer, storing or processing by us. Limited personal data is transferred or stored outside of the UK or EEA and is detailed below. If we make changes to any transfer of data outside of the UK or EEA, we will notify you, including explaining any steps being taken to ensure that your privacy rights continue to be protected as outlined in this Data Processing Agreement.

For how long do we store your data?

We continue to hold all ‘active’ data (data that has been provided and is linked to active accounts on a verified licence) until the following:

• If your subscription licence has run out and accounts are no longer active, personal data is kept for 30 days, as per this agreement, and then securely deleted.
• We also operate a rolling retention program that retains audit log data for 13 months.
• We can extend the length of the rolling backup, but additional agreements and costs may be needed.

Partners (Processors) who process your data

Technology businesses often use contractors and outside companies to help them host their applications, power their support tools, etc. Any company or individual that we use when processing information under this agreement is a “processor”. This means that any agreement or contract we have with them is, at least, as strict as this agreement. We make sure that we are happy that they will also take the same level of care of the personal data you are trusting us with, including checking if they hold any certificates for their work. Any partners mentioned below will be considered to have general authorisation for us to tell them what they need to do.

In the rare circumstance that there is a change to who we work with that significantly affects any existing service you have with us, we will work to give you advance notice. Where a new element of functionality is available from 247connect, this is turned off by default and does not process any of your data. If you want to turn it on, then you will need to check that you are happy with any partners we are using. In these cases, we include information in our release notes and updates to this agreement.

Here are the details of the main processors and service providers; what they collect, process and store, and a general explanation of why.

Infrastructure

Analytics

Integrations (optional)

Comms

How we use cookies

We use cookies. Unless you adjust your browser settings to refuse them, we (and our sub-processors) will issue cookies when you interact with 247connect. These may be session cookies, meaning they delete themselves when you leave 247connect or ‘persistent’ cookies, which do not delete themselves and help us to recognise you when you return so we can provide you with a tailored service.

How can I block cookies?

You can block cookies by activating a setting in your browser allowing you to refuse the setting of cookies. You can also delete cookies through your browser settings. If you use your browser to disable, reject or block cookies (including essential cookies), certain parts of our platform will not function fully. In some cases, our platform may not be available at all. Please note that where sub-processors use cookies, it is also to enable the service to work correctly. This also includes blocking cookies from other systems you want us to integrate with. We do not allow third parties to set cookies.

Which specific cookies do we use?

Making this Privacy Notice great!

Well done for getting through this Data Processing Agreement and reviewing everything in it! It is designed to help you best understand what we do, under your instructions. Where you have instructions outside of this agreement, then they will be treated as support or account requests, as long as they do not fundamentally change anything mentioned in this agreement.

N.B. This DPA was built based on an open-source design for Privacy Notices from https://juro.com and https://stefaniapassera.com/. Get these patterns free at github.com/juro-privacy. This DPA pattern is open source, and reuse is permitted when using the attributions above. Specific content relating to the service itself may not be reused without the permission of NetSupport.

Further technical information

If you need further technical or operational information, please request our (based on a popular) standardised template. We hope you find this useful as well.

Publication date: 25th February 2026
Version: 1.0