Odyssey Systems Limited (“Odyssey”, “we”) is the data controller for personal information collected through this website. We are a limited company registered in England and Wales under number 02517487, with our registered office at Lockheed Court, Preston Farm Industrial Estate, Stockton-on-Tees TS18 3SH. We are registered with the Information Commissioner’s Office under registration number ZA043304.
This policy explains what information we collect when you visit odyssey.uk or contact us through it, why we collect it, how long we keep it and the rights you have under the UK General Data Protection Regulation and the Data Protection Act 2018. It covers this website only. Information we process for clients in the course of providing services is covered by the agreement for those services.
We review this policy when the website changes. The version published here is always the current one.
Information you give us
You can contact us through five forms on this website. Each asks only for what we need to respond.
- Contact form: your name, email address, phone number, company and message, what the enquiry is about and, for a support request, how urgent it is, which service or site it concerns and any existing ticket reference.
- Request a proposal: your name, email address, phone number, company, the services you are interested in, the size of your organisation, when you would like to start, and anything you tell us about your current set-up.
- AI readiness assessment enquiry: your name, email address, phone number, organisation, the number of staff, which description best fits where you are with AI, and anything you add.
- Broadband checker: a postcode and the address you choose from its list and, if you ask us to get in touch, your name, email address, phone number, company and anything you add.
- Job applications: your name, email address, phone number, your CV, your right to work in the UK, your experience and your availability for out-of-hours work, and anything you add in support of your application.
We use this information to answer your enquiry, prepare and discuss a proposal, or consider your application, and to contact you about it. Our lawful basis is that the processing is necessary to take steps at your request before entering into a contract (enquiries and proposals), or for our legitimate interest in recruiting staff (applications). We do not use the information you give us through these forms for marketing unless you ask us to keep in touch.
How you found us. When you send the contact form, a proposal request, an AI readiness assessment enquiry or a broadband request, the form also tells us how you reached our website: the name of the search engine or website you came from (for example Google, never the address of the page you were on or what you searched for), and the name of any campaign carried in the link you followed. We store this with your enquiry in Hub so that we can see which parts of our website lead to enquiries. If you accepted analytics cookies, your browser keeps this in its session storage from the first page you visit, so that it is still known if you send a form on a later page; session storage is cleared when you close the tab, and the record holds nothing else. If you did not accept, nothing is stored on your device, and we only see how you reached the page the form is on. Job applications do not include this. Our lawful basis is our legitimate interest in knowing what brings people to contact us.
Support requests and general enquiries are logged as tickets with our service desk, and proposal and meeting requests, and AI readiness assessment enquiries, are stored with our sales team, all in Hub, our business system, so that the person dealing with your enquiry can see it; proposal and meeting requests are also emailed to the team who will respond. The address of the device that sent the form is kept for 30 days to prevent abuse of the forms, then deleted. Job applications are seen only by the people involved in the recruitment decision.
To keep automated spam out of the forms, each form uses Cloudflare Turnstile to check that a person is sending it. When you start filling in or sending a form, your browser contacts Cloudflare, which looks at information about the browser and the connection, including the device’s address, to make that check. Cloudflare uses this information to run the check and to protect its service, not for advertising. Our lawful basis is our legitimate interest in keeping the forms free of abuse. See Cloudflare’s privacy policy.
The speed test. When you start the speed test, your browser downloads and uploads test data to Cloudflare’s speed test servers (speed.cloudflare.com) and times it. As with any website, Cloudflare sees the device’s address and information about the browser and the connection while the test runs; it uses them to run the test and to protect its service. To show you the IP address the test ran from, your browser also asks the same Cloudflare server for the address it sees, and Cloudflare sends it back. The test does not send its result to Cloudflare’s results service. The result and that address appear only on your screen, and reach us only if you send them in a message (we do count finished tests, as described below). See Cloudflare’s privacy policy.
The broadband checker. To tell you which broadband services an address can get, we send the postcode and the address you choose to BT Wholesale. We send BT nothing about you. Each check is recorded in Hub: the postcode area (for example TS18 3), the result and when the check was made, which shows us where there is demand. The full postcode and the address are deleted after 30 days, and the address of the device that ran the check after 48 hours (we keep it that long to stop the checker being abused). If you ask us to get in touch, your details are handled like a proposal request: stored with our sales team in Hub together with the address and the result, and emailed to the team who will reply. Our lawful basis for the checks is our legitimate interest in answering questions about availability and keeping the checker free of abuse; for a request to get in touch, it is taking steps at your request before entering into a contract.
Counting finished tools. When you finish the speed test, the broadband checker, the PSTN switch-off check, the Cyber Essentials check or the AI readiness check, your browser tells Hub which tool was finished, and Hub adds one to that tool’s count for the day. Your browser sends only the tool’s name, not your answers, the result or anything that identifies you. Nothing is stored on your device, and the count does not record the device’s address. If you then send the form on the tool’s page, the form also says which tool you used and, if the summary the tool wrote into your message is still there as it was, repeats that summary, so that it is stored with your enquiry. Our lawful basis is our legitimate interest in knowing which tools are useful and whether they lead to enquiries.
Some roles ask screening questions about requirements the role cannot do without, such as a minimum amount of relevant experience. On those roles our system checks your answers automatically when you apply, and an application that does not meet a requirement is not taken further. This automated decision is necessary to consider your application at your request. We tell you by email no sooner than the next working day, and until then a member of our team can review the decision and reverse it. You have the right to ask for a person to review an automated decision, to give us your point of view and to challenge it: reply to that email, or contact us using the details below. Your CV itself is never read or scored automatically.
Telephone calls. Calls to and from Odyssey may be recorded, to keep an accurate record of what was asked and agreed, for training and to resolve complaints. Recordings of calls with our service desk are transcribed, and a short summary is written, by software that runs on our own equipment; nothing is sent to an outside AI service. The transcript and summary are kept with the recording, and only staff permitted to listen to the recording can read them.
Information collected automatically
Our web server records standard log information for each request: the address of the connecting device, the page requested, the date and time, the referring page and the browser used. We use these logs to keep the website secure and running, and to see which pages are read. We do not use them to identify individual visitors. Our lawful basis is our legitimate interest in running a secure service.
With your consent, we also use Google Analytics to see how people find and use the website, and Microsoft Clarity to see how pages are used. See Cookies below.
Cookies
Analytics, only with your consent. When you first visit, we ask whether you accept analytics cookies. Nothing is loaded from Google and no analytics cookie is set unless you choose Accept. If you accept, we load Google Tag Manager, which runs Google Analytics. Google Analytics sets two cookies, _ga and one beginning _ga_, each lasting up to two years, which let it recognise a returning browser. Google Analytics keeps what it records for 14 months, then deletes it. It tells us which pages are visited, how people arrive (for example from a search engine), when someone completes one of our forms, and when someone clicks one of our phone numbers to call us. It does not tell us who you are, it does not store your device’s address, and we do not combine it with what you send us through the forms. We do not use advertising features, and we do not let Google use this information for advertising. Our lawful basis is your consent. Google processes the information on our behalf, in line with Google’s privacy policy.
Session recordings, only with your consent. If you accept, we also load Microsoft Clarity, which records how pages are used: where visitors scroll, what they click and how they move around a page, shown to us as heatmaps and replays. It is set to mask all text, so a replay shows the layout of a page without the words on it, and nothing typed into a form is recorded. It uses your device’s address to estimate which country you are in and does not show us the address. Clarity sets two cookies on this website, _clck and _clsk, which link the pages you visit into one recording, and Microsoft may set its own cookies from its domains when the recording is sent. Microsoft keeps recordings for 30 days. Clarity is linked to our Google Analytics, so a recording can be matched with the Google Analytics record of the same visit, and Microsoft reads our Google Analytics figures to show them beside the recordings. We do not combine any of this with what you send us through the forms. Our lawful basis is your consent. Microsoft processes the information on our behalf, in line with Microsoft’s privacy statement.
If you accept, your browser’s session storage also keeps how you arrived at the website, as described under How you found us above. It is not a cookie, it is cleared when you close the tab, and it is never sent to Google.
Changing your mind. Use Cookie settings at the foot of any page. If you reject after accepting, we remove the Google Analytics and Clarity cookies set on this website and the record of how you arrived from your browser; cookies Microsoft set from its own domains are under Microsoft’s control. We remember your choice in your browser’s storage for a year, then ask again; that record holds only the choice and the date.
The map on our contact page. The contact page shows a map of our office provided by Google Maps. When the page loads, your browser requests the map from Google, and Google may set its own cookies and collect information about your visit in line with Google’s privacy policy. You can find our office without the map: the address is on the page and in the footer of every page.
Apart from these, the website sets no cookies.
Who we share information with
We do not sell personal information and we do not share it with third parties for their marketing. We share it only:
- with the people in Odyssey who need it to deal with your enquiry, proposal or application;
- with suppliers who process it on our behalf, such as the providers of our email, business systems and web hosting, under contracts that require them to protect it and use it only on our instructions;
- where the law requires it, or to establish, exercise or defend legal claims.
We keep the information on systems in the United Kingdom. Where a supplier stores it elsewhere, we rely on the safeguards the UK GDPR provides for international transfers.
How long we keep information
We keep personal information for no longer than we need it for the purpose it was collected for.
- Enquiries and proposal requests are kept while we deal with them and for a period afterwards in case you come back to us, then deleted.
- Job applications are kept for the recruitment exercise they relate to. If you are unsuccessful, we delete your application and CV six months after the decision unless you ask us to keep them for future vacancies. If you join Odyssey, your application becomes part of your employment record. We do not send CVs to any automated reading or scoring service.
- Broadband checks: the device’s address is deleted after 48 hours, and the full postcode and the address after 30 days unless you asked us to get in touch. The rest of the record (the postcode area and the result) is deleted after 12 months.
- Server logs are kept for a short period for security and then deleted.
- Google Analytics data, collected only with your consent, is kept for 14 months and then deleted.
- Microsoft Clarity recordings, collected only with your consent, are kept by Microsoft for 30 days and then deleted.
How we protect information
Personal information from this website is held on systems that are access controlled, protected by firewalls and kept up to date, and is reached only by staff who need it. Odyssey holds ISO 27001 certification for information security, assessed by NQA.
Your rights
You have the right to ask us for a copy of the personal information we hold about you, to have it corrected if it is wrong, to have it deleted, to restrict or object to how we use it, and to receive it in a portable form where it was provided to us electronically. You may withdraw any consent you have given at any time. To exercise any of these rights, contact us using the details below. We will respond within one month.
If you are unhappy with how we have handled your information, please tell us first so that we can put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or by writing to Wycliffe House, Water Lane, Wilmslow SK9 5AF.
Links to other websites
This website links to other websites, including our service status page and Hub, which you reach with your own log-in. Those services and any other linked websites have their own privacy policies, and this policy does not apply to them.
How to contact us
Odyssey Systems Limited
Lockheed Court
Preston Farm Industrial Estate
Stockton-on-Tees
TS18 3SH
Tel: 01642 661888
Or use the contact form and mark your message as a privacy request.
Registered in England and Wales: 02517487