Privacy Policy

Last updated: 21 September 2026

1. Who we are

This website, twenty-four.it (the "Site"), is operated by TwentyFour IT Services Ltd ("TwentyFour", "we", "us", "our"), a company registered in England and Wales under company number 09319771, with registered office at Second Floor East, Unit F South Quay, Lakeside Boulevard, Doncaster, England, DN4 5PL.

We are the data controller for the personal data we collect through this Site and for personal data processed through 24IT Growth Engine where TwentyFour determines the purposes and means of processing.

Contact for privacy matters:

• Email: marketing@twenty-four.it

• Post: Second Floor East, Unit F South Quay, Lakeside Boulevard, Doncaster, England, DN4 5PL

We have not appointed a Data Protection Officer. Privacy enquiries are handled by TwentyFour IT Services Ltd and can be sent to marketing@twenty-four.it.

This policy explains what personal data we collect when you visit or use this Site, and how 24IT Growth Engine accesses and uses authorised Google Ads data. It explains why we process data, who we share it with, how long we keep it, how Google API data is protected and deleted, and what rights you have. It is written to comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

It does not cover data we process on behalf of our managed IT clients under separate service agreements — that is governed by our client contracts and Data Processing Agreements, not this policy.

2. What personal data we collect

We collect personal data in three ways: information you give us directly, information collected automatically as you browse, and information from third parties.

2.1 Information you give us directly

Where	What we collect
Contact / “Get in touch” forms	Name, email address, phone number, company name, message content
Quote or callback requests	Name, email, phone, company details, information about your IT environment that you choose to share
Newsletter or marketing sign-up	Name, email address, marketing preferences
Job applications (if posted on the Site)	Name, contact details, CV contents, references
Live chat (if enabled)	Chat transcript, name, email, any details you provide during the conversation

2.2 Information collected automatically

When you browse the Site, we and our third-party tools automatically collect:

• IP address (may be truncated/anonymised — see section 4)

• Device, browser type and version, operating system

• Referring website, pages visited, time spent on pages, click paths

• Approximate location derived from IP address

• Cookie identifiers and similar technologies (see section 6)

2.3 Information from third parties

• If you interact with us via LinkedIn, HubSpot forms, or a similar platform, that platform may pass limited profile or contact information to us in line with your settings on that platform.

• Publicly available business information (e.g. from Companies House, LinkedIn) may be combined with data you give us for sales and marketing purposes.

We do not knowingly collect special category data (health, religion, etc.) through this Site, and we ask that you do not submit such data through our forms.

2.4 Google Ads data accessed through 24IT Growth Engine

24IT Growth Engine is an internal marketing analytics and campaign-management application operated by TwentyFour IT Services Ltd. When an authorised Google Ads account is connected, the application may access data made available through the Google Ads API, including account and customer identifiers, campaigns, ad groups, advertisements and assets, keywords, search-term reporting data, impressions, clicks, cost, conversions, conversion values, budgets, bidding information, campaign status, device and geographic reporting dimensions, and keyword-planning or forecasting information where available.

The Google Ads connection uses Google OAuth 2.0. The application does not receive or store the user's Google password. The OAuth integration is used for Google Ads API access and does not request access to Gmail, Google Drive, Google Calendar or Google Contacts through this integration.

3. Why we use your data and our legal basis

Purpose	Legal basis (UK GDPR Art. 6)
Responding to enquiries, quote requests, and support requests submitted via the Site	Legitimate interests (running our business and responding to prospective/existing clients), and/or steps taken at your request prior to a contract
Providing services under a signed agreement	Performance of a contract
Sending marketing communications about our IT support, cyber security and cloud services	Consent (where required by PECR for electronic marketing), or legitimate interests for existing business contacts marketing similar services, with an opt-out on every communication
Site analytics — understanding how visitors use the Site, improving content and navigation	Consent (via our cookie banner) for non-essential analytics cookies; legitimate interests for strictly necessary/first-party functional data
Running paid advertising and measuring its effectiveness (Google Ads, LinkedIn Ads, etc.)	Consent
Security, fraud prevention, and keeping the Site running	Legitimate interests
Complying with legal obligations (e.g. tax, accounting, regulatory requests)	Legal obligation
Job applications submitted through the Site	Steps taken at your request prior to a contract, and legitimate interests in recruitment
Operating 24IT Growth Engine, analysing authorised Google Ads data and producing campaign reporting and optimisation recommendations	Legitimate interests in operating, measuring and improving our own marketing and advertising activities; where consent is required for a particular processing activity, consent

Where we rely on consent (marketing emails, non-essential cookies), you can withdraw it at any time — see sections 6 and 9.

4. Google products used on this Site

We use the following Google services. Where these involve non-essential cookies or tracking, they only run after you consent via our cookie banner, and we use Google Consent Mode v2, which signals your consent choice to Google and adjusts what data Google receives accordingly.

Google Analytics 4

We use Google Analytics to understand how visitors use the Site (pages viewed, session duration, referral source, approximate location, device type). Google Analytics sets cookies and collects your IP address; IP addresses are not stored against individually identifiable analytics reports. Data is processed by Google in accordance with the Google Privacy Policy and the Google Analytics data processing terms. You can opt out of Google Analytics tracking across all websites using the Google Analytics Opt-out Browser Add-on.

Google Tag Manager

We use Tag Manager to deploy and manage the tags described in this section (Analytics, Ads conversion tracking, etc.). Tag Manager itself does not collect personal data but controls which other tags fire, and only fires consent-gated tags once you have consented.

Google Ads (conversion tracking and remarketing)

If you arrive at the Site via a Google ad, or if you consent to advertising cookies, we may use Google Ads conversion tracking and remarketing to measure ad performance and show you relevant ads on other sites. This uses cookies and, where applicable, Google’s advertising ID. You can manage the ads you see using Google Ads Settings and can opt out of personalised advertising there.

Google Search Console

Search Console provides us with aggregated, non-identifiable data about search terms and traffic from Google Search. It does not use cookies on your device and does not identify individual visitors.

YouTube embedded video

Where we embed YouTube videos, we use privacy-enhanced mode where available. Playing an embedded video may still result in YouTube/Google setting cookies and collecting viewing data, governed by Google’s Privacy Policy.

Data location: Google processes data collected via these tools on infrastructure that may be located outside the UK. Google is certified under, and transfers are made in accordance with, the UK’s International Data Transfer Addendum to the EU Standard Contractual Clauses, or an equivalent adequacy mechanism, as set out in Google’s data processing terms.

5. 24IT Growth Engine and Google API data

This section applies specifically to 24IT Growth Engine, an internal application developed and operated by TwentyFour IT Services Ltd to analyse and manage authorised digital marketing activity, including Google Ads.

5.1 Google account connection and authorisation

24IT Growth Engine connects to authorised Google Ads accounts using Google OAuth 2.0 and the Google Ads API. The application may request the Google Ads OAuth scope https://www.googleapis.com/auth/adwords. This scope allows the application to communicate with Google Ads accounts that the authorising user is permitted to access. TwentyFour does not receive or store the user's Google password.

5.2 Google user data accessed

Depending on the Google Ads account and permissions granted to the authorising user, 24IT Growth Engine may access:

• Google Ads customer and account identifiers;

• campaigns and campaign settings;

• ad groups, advertisements and advertising assets;

• keywords and keyword-related information;

• search-term reporting data;

• impressions, clicks, cost and other campaign performance metrics;

• conversion and conversion-value information;

• geographic, device and other campaign reporting dimensions;

• bidding, budget and campaign-status information;

• keyword-planning and forecasting information where available through the Google Ads API; and

• other Google Ads reporting information required to provide the application's campaign analysis and management functionality.

The application does not use this Google Ads OAuth integration to access Gmail messages, Google Drive files, Google Calendar data, Google Contacts or the user's Google password.

5.3 How we use Google user data

Google Ads data obtained through the Google Ads API is used only to provide and improve the functionality of 24IT Growth Engine. This includes:

• measuring advertising performance;

• producing campaign, keyword, search-term and conversion reporting;

• analysing advertising spend and effectiveness;

• connecting advertising activity with TwentyFour's marketing and sales attribution processes;

• identifying campaign optimisation opportunities;

• supporting keyword and campaign research;

• generating recommendations for authorised TwentyFour users; and

• where specifically enabled, supporting controlled changes to Google Ads campaigns.

24IT Growth Engine is designed principally for data retrieval, reporting, analysis and recommendations. Where functionality capable of modifying Google Ads is enabled, TwentyFour applies application-level controls and human approval processes before campaign changes are made.

Google user data obtained through the Google Ads API is not sold to third parties, provided to data brokers or used to create unrelated advertising profiles.

5.4 AI-assisted analysis

24IT Growth Engine may use AI-assisted processing to analyse advertising performance and generate recommendations for authorised users. Where Google Ads data is processed by an AI service as part of this functionality, only data reasonably required to provide the requested analysis or application feature is processed.

Google user data obtained through Google APIs is not used to develop, improve or train general-purpose or non-personalised artificial intelligence or machine-learning models. AI-assisted processing of Google Ads information is used solely to provide or improve functionality within 24IT Growth Engine.

5.5 Storage and security

Google Ads data retrieved by 24IT Growth Engine may be securely stored or cached within TwentyFour's controlled cloud infrastructure where this is necessary to provide reporting, attribution, historical comparison, analysis and application functionality.

OAuth credentials, access tokens and refresh tokens are treated as confidential authentication information and are protected using appropriate technical and organisational controls. TwentyFour applies access restrictions, encryption in transit, appropriate encryption and secrets-management controls, logging and monitoring, and restrictions limiting access to authorised personnel and application services. We do not store Google account passwords.

5.6 Sharing and disclosure of Google user data

Google user data obtained through the Google Ads API is not sold. We may disclose or process Google user data through contracted service providers acting on our behalf where this is necessary to host, secure, operate or provide approved functionality within 24IT Growth Engine. Such providers may process the data only for the purposes of providing their contracted services to TwentyFour and are subject to appropriate confidentiality, security and data-protection requirements.

We may also disclose information where required by law or where necessary to protect our legal rights. Google user data is not disclosed to third parties for independent targeted advertising, sale to data brokers or information resellers, credit assessment or unrelated profiling.

5.7 Data retention, deletion and revocation

We retain Google Ads information obtained through the Google Ads API only for as long as reasonably necessary to provide the application's reporting, attribution, analysis and campaign-management functionality, meet legitimate business requirements, or satisfy applicable legal obligations.

OAuth access and refresh credentials are retained only while the relevant Google integration remains authorised and required by the application. If access to a Google account is disconnected or authorisation is revoked, we will cease obtaining new data from that account and the associated OAuth credentials will be deleted or rendered unusable. Stored Google Ads data that is no longer required for the purposes described above will be securely deleted or anonymised in accordance with our retention procedures.

An authorised user may request deletion of personal data held by TwentyFour by contacting marketing@twenty-four.it. Users can also revoke 24IT Growth Engine's access through their Google Account under the controls for connections to third-party apps and services.

5.8 Google API Services User Data Policy

TwentyFour's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide or improve user-facing functionality within 24IT Growth Engine and for the purposes disclosed in this Privacy Policy.

6. Cookies and similar technologies

We use cookies and similar technologies (such as local storage and tracking pixels) to make the Site work, understand how it’s used, and — where you consent — for marketing.

6.1 Categories of cookies we use

Category	Purpose	Requires consent?
Strictly necessary	Core Site functionality, security, load balancing, remembering your cookie preferences	No — cannot be switched off
Functional	Remembering preferences (e.g. form progress, chat widget state)	Only where non-essential
Analytics	Google Analytics and similar tools, to understand visitor behaviour and improve the Site	Yes
Marketing/advertising	Google Ads, LinkedIn Insight Tag, HubSpot tracking cookies used for retargeting and campaign attribution	Yes
CRM/forms	HubSpot cookies set when you submit or interact with a form, used to recognise returning visitors and personalise follow-up communication	Yes, where non-essential

A full, current list of the specific cookies set on this Site (name, provider, purpose, and expiry) is available in our cookie banner / cookie preference centre at any time, and is kept up to date there rather than duplicated in this document, as cookie names and durations can change as tools are added or updated.

6.2 Managing cookies

You can:

• Change your preferences at any time via the cookie settings link in the Site footer

• Set your browser to block or delete cookies (this may affect Site functionality)

• Opt out of specific providers directly (see the Google opt-outs in section 4, and LinkedIn’s advertising preferences if applicable)

We do not run non-essential cookies before you have made a choice in the cookie banner, in line with PECR requirements.

7. Who we share your data with

We share personal data with:

• Service providers acting as our data processors, under contract, including:

Category	Provider
Website hosting provider	Cloudflare, Inc. (content delivery and security) and our contracted website hosting infrastructure
CRM and marketing platform	HubSpot Inc.
Analytics and advertising	Google LLC / Google Ireland Ltd
Email delivery	HubSpot Inc.
Live chat provider (if used)	HubSpot Inc. (where live chat is enabled)
24IT Growth Engine application services	Contracted cloud, security and approved AI service providers used to host, secure or provide application functionality, subject to contractual confidentiality, security and data-protection requirements

• Professional advisers (accountants, lawyers, auditors) where necessary

• Regulators and law enforcement, where required by law

• A buyer, if we sell or transfer part or all of our business, subject to appropriate safeguards

We do not sell your personal data to third parties.

Where a processor is based outside the UK, we ensure an appropriate transfer mechanism is in place (UK adequacy regulations, the UK International Data Transfer Addendum, or equivalent Standard Contractual Clauses).

8. How long we keep your data

Data type	Retention
Enquiry/contact form submissions that do not convert to a client relationship	24 months from last contact
Marketing contact data (subject to consent/opt-out)	Until you unsubscribe or we identify the contact as no longer relevant, reviewed at least annually
Client and contract data	Retained for the duration of the relationship plus 6 years for accounting and legal purposes
Website analytics data	14 months
Job applications	12 months unless you join TwentyFour, in which case per employee record retention
Google Ads API data used by 24IT Growth Engine	Only for as long as reasonably necessary for reporting, attribution, analysis and campaign-management functionality, legitimate business requirements or legal obligations; deleted or anonymised when no longer required
Google OAuth access and refresh credentials	Only while the relevant Google integration remains authorised and required; deleted or rendered unusable after disconnection or revocation

9. Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you

• Rectification of inaccurate or incomplete data

• Erasure (“right to be forgotten”), in certain circumstances

• Restrict processing, in certain circumstances

• Data portability, where processing is based on consent or contract and carried out by automated means

• Object to processing based on legitimate interests, including direct marketing (you can object to marketing at any time, with no need to give a reason)

• Withdraw consent at any time, where processing is based on consent (this does not affect the lawfulness of processing before withdrawal)

To exercise any of these rights, contact us at marketing@twenty-four.it. We will respond within one month, as required by law.

If you are unhappy with how we have handled your data, you have the right to complain to the UK Information Commissioner’s Office (ICO):

• Website: ico.org.uk

• Helpline: 0303 123 1113

We would appreciate the chance to resolve any concern directly first, at the contact details above.

10. Security

We use appropriate technical and organisational measures to protect personal data, including encryption in transit (HTTPS), access controls, secrets-management controls for authentication credentials, logging and monitoring, and regular review of our third-party processors' security posture. Access to 24IT Growth Engine and Google API data is restricted to authorised users and application services. As a cyber security and managed IT provider ourselves, we apply the same standards to our own Site and applications that we recommend to our clients. No system is completely secure, and we cannot guarantee absolute security of data transmitted to us over the internet.

11. Children

This Site is intended for business use and is not directed at children. We do not knowingly collect personal data from anyone under 16.

12. Changes to this policy

We may update this policy from time to time, for example when we add a new tool to the Site, change 24IT Growth Engine functionality or Google API access, or when guidance from the ICO or Google changes. The "Last updated" date at the top of this page shows when it was last revised. Material changes will be highlighted on the Site.

13. Contact us

TwentyFour IT Services Ltd

Company number: 09319771

Second Floor East, Unit F South Quay, Lakeside Boulevard, Doncaster, England, DN4 5PL

Email: marketing@twenty-four.it

Phone: 01302 732190