Privacy notice

Who is responsible

The controller is Swiss Aring Solutions Ltd, which runs ClearSource in the United Kingdom (see the imprint). For privacy requests, use the contact form and choose “Privacy request”.

This notice follows the UK GDPR and the Data Protection Act 2018.

What is processed when you visit

Our hosting and security provider delivers the site. Its logs can include your IP address, browser, referrer and the page requested. Lawful basis: our legitimate interest in a working, secure site (UK GDPR Art. 6(1)(f)).

ClearSource sets no analytics cookies. Our hosting provider counts visits, pages, countries and device types for us, in totals that are not linked to a person. ClearSource’s own statistics are described in the next section. Fonts, logos and images come from this site.

Statistics and partner links

ClearSource counts on its own server how the site is used: pages viewed, marked buttons and links clicked (for a link to another site, only its host name), site searches and a few fixed events, such as opening the cost calculator or a partner profile. For your first page, only the host name of the site you came from is recorded. Searches are stored in lower case, at most 60 characters; one with an @ or more than six digits is not recorded. Form text and seat counts never are.

Each record holds only the page, the day, the language and that item. No IP address, browser details, cookie or identifier is stored, and nothing is stored on your device, so records cannot be linked to you. This is for statistics about how the site is used, to improve it (Art. 6(1)(f)). If your browser sends Global Privacy Control or Do Not Track, nothing is counted.

Single records are kept by our hosting provider for three months; daily totals of the fixed events stay in our database. Reports to IT partners show totals only, never figures below 5. Campaign tags in the address you arrive on (utm_…) are recorded too; they name a campaign, not a person.

Links to IT partners’ websites go through this site’s /go/ address, which counts the click and forwards you. The partner sees only this site’s home address as the referrer, with the tags utm_source=clearsource, utm_medium=referral and a utm_campaign for where the link was. Nothing else about you is passed on.

Cost calculator

The calculator works in your browser. Your selection sits in the page address (the “?m=…” part) and in your browser’s storage. ClearSource does not receive it.

Contact form

The form asks for your name, company, business email, a topic, your message and, if you like, a phone number. We use them only to answer you and never pass them to IT partners. Lawful basis: your consent, given with the checkbox (Art. 6(1)(a)).

We email you a link, and your message reaches us only once you confirm. Until then it sits in our database. The form checks for spam and bots, for example how often one IP address sends and whether your email domain can receive mail (only the domain is looked up). If a security check is shown, our hosting provider looks at technical data of your browser to spot bots; it never reads what you type.

The link is valid for 24 hours. An unconfirmed message is deleted after 7 days at the latest. A confirmed message is removed from the database once delivered and kept in our mailbox only as long as needed. Our email log keeps a one-way hash of your address, never the address.

Cookies and local storage

No analytics or advertising cookies. Security checks use technical cookies that are strictly necessary. Your theme, display settings, shortlist and calculator setup stay in your browser’s storage and are not sent to us. More on the Cookies page.

You can block or delete them in your browser. The site still works, but your settings are not remembered.

IT partner directory

The directory is about companies, each entry with its public sources. It holds nothing about you as a visitor. Your shortlist for comparing stays in your browser; the comparison page lists the chosen IT partners in its address.

Data about IT partners and their contact persons

Some directory data can relate to people, for example a sole trader’s or partnership’s name. ClearSource lists company-level details only, from Microsoft’s partner directory and the company’s own website, including the company number as the company publishes it. It does not list directors or staff by name. An IT partner that claims its listing may add a named contact person, with that person’s agreement.

Purpose and lawful basis: showing businesses which IT partners in the UK sell Microsoft licences and how to reach them, a legitimate interest of those businesses, the listed companies and ClearSource (Art. 6(1)(f)). The pages are public, so search engines and AI services can read them and use them in answers and to train AI models (see the terms of use).

If you are named, you can object or ask for a correction or deletion at any time: use the contact form with “Data correction” or “Privacy request”.

Requests for offers

If you ask for offers through the “Get quotes” form, ClearSource processes what you enter: your company’s name, region, size and industry (optional), your name, role (optional), business email, phone (optional), the licences and seats, your situation and timing, the contract terms you prefer, any comment, and which IT partners you picked or asked about.

Lawful basis: your consent, given with the checkbox and confirmed with the link in our email (Art. 6(1)(a)), and the steps you ask for before a contract with an IT partner (Art. 6(1)(b)). Nothing is acted on until you confirm. You can withdraw consent at any time for the future.

Who receives it: while no IT partner in the UK takes part, your request goes to ClearSource only, and the form says so. We contact you, ask IT partners in the UK for offers on your behalf and pass your details to one only with your agreement in each case.

Once IT partners take part, the form shows before you send which of them receive your request: those you picked, or those that fit your region and licences, by fixed rules. Taking part means a claimed listing with ClearSource’s partner terms accepted, and it is free; nobody pays to receive requests. A partner first sees your region, company size, timing, terms and licences, and your company name and contact details only once it accepts. Each IT partner then processes your details as an independent controller under its own privacy notice.

Our hosting, database and email providers process the request on our behalf (see “Service providers and transfers”). Our inbox receives a copy as soon as you send the form. Our email log keeps a one-way hash of the address, never the address.

Retention: a request not confirmed within 7 days expires and is deleted. The personal data in a confirmed request is anonymised 12 months after the request. What IT partners keep is governed by their own notices.

Seven days after you confirm, we ask you once by email whether you received offers, only to check the service; a link in that email stops these emails.

Accounts for IT partners

Staff of IT partners sign in with an email address, using a password or a sign-in link sent to that address, or with Microsoft. We process the email address, the password (only as a salted hash), a second sign-in step if set up, the company and role, and sign-in times. Purpose: access to the partner portal, kept secure. Lawful basis: the contract with the IT partner, the steps you ask for before one, and our legitimate interest in secure access (Art. 6(1)(b) and (f)).

To link an account to a company, you claim its listing or ask for a new one, with your name, role (optional), phone, an optional message and, for a new listing, the company’s name, website, region and company number (optional). We use these only to check the request, may call the number, and do not publish them.

Processors: our hosting provider, our sign-in and database provider (Zurich) and our email service (European Union); see “Service providers and transfers”.

Sign-in with Microsoft: if you choose it, Microsoft learns that you are signing in to ClearSource and passes us your email address and, where it has it, your name. We never receive your Microsoft password. Microsoft acts as an independent controller under its own privacy notice and processes data in the USA, among other countries.

Signing in sets cookies strictly necessary for it, never used for tracking. They keep you signed in until you sign out, for at most 400 days; while a sign-in with Microsoft runs, one more remembers that choice for at most 10 minutes. Asking for a sign-in or reset link, or starting a sign-in with Microsoft, sets one that secures it, for at most 400 days. Visitors who do neither get none.

Feedback: signed-in users can send feedback with one picture, its metadata (such as location) removed. Only our administrators read it. It is deleted after 24 months, or with the account.

You can delete your account at any time under “Account and security”. The account, its company memberships and its open requests go at once; a company left without an owner goes back to an unclaimed listing.

Account data is kept while the account exists. Claims never confirmed are deleted 7 days after the link expired, decided claims 12 months after the decision. The audit log, which records changes in the admin area and the portal, keeps only an internal account number for portal users and is deleted after 24 months.

Service providers and transfers

Our processors act on our instructions under a data processing agreement: Cloudflare for hosting, security and the visit totals (USA, with data centres worldwide; a request is usually served from the nearest one); Supabase for the database and sign-in, stored in its eu-central-2 region in Zurich, Switzerland, which UK law treats as giving adequate protection; Brevo for sending email, in the European Union, also treated as adequate. Where a provider also acts as an independent controller, this notice says so.

Where data can reach the USA or another country without that status, the safeguard is the provider’s data processing agreement, with the UK addendum to the standard contractual clauses or the UK extension of the EU-US Data Privacy Framework where the provider relies on them.

If a security check is shown, Cloudflare also uses technical data of your browser as an independent controller to improve its bot detection.

Security

Connections are encrypted, the database denies access by default and is reached only through our server, and admin accounts use two-step verification. Our security provider checks requests (IP address, browser, page), limits very frequent ones and filters attacks, for the site’s security (Art. 6(1)(f)). Request counts expire after seconds and the site’s own security logs are kept only briefly.

Retention

We keep personal data only as long as needed. Contact messages, requests for offers and accounts follow the periods in their sections. A directory entry stays while the company is listed.

Visits by search-engine and AI crawlers are recorded by their software’s name, the address, the response and the day, without an IP address, and kept for three months.

No marketing

ClearSource sends no newsletters and no marketing by email, text or phone, to visitors or to listed companies.

Sale of data

Personal data is not sold, rented or passed on for anyone else’s marketing.

Your rights

Under the UK GDPR you can ask for a copy of your data, have it corrected or deleted, restrict its use, receive it in a common format, object to processing based on legitimate interests and withdraw consent at any time for the future. ClearSource makes no decision about you based solely on automated processing.

Use the contact form with “Privacy request”. We may ask you to confirm who you are, and we answer within one month.

Complaints

You can complain to the Information Commission (the ICO, formerly the Information Commissioner’s Office), the UK’s data protection regulator, at ico.org.uk. We would like to hear from you first, but you do not have to.

Changes

We update this notice when our processing changes. The date at the top shows the latest version.