Last updated: 30-MAR-2026
This Privacy Policy explains how Pokkit Ltd (“Pokkit”, “we”, “us”, “our”) collects, uses, stores, shares and protects personal data when you:
We are committed to handling personal data in accordance with the UK GDPR, the Data Protection Act 2018, and, where relevant, the Privacy and Electronic Communications Regulations 2003 (PECR).
If you have any questions about this Privacy Policy or how we handle personal data, please contact:
Data Controller: Pokkit Ltd
Registered address: Hub8 MX, Chester Walk, Cheltenham, GL50 3JY
Email: hello@Pokkit.tech
DPO / privacy contact: Not appointed
Pokkit is a cyber support service designed to help individuals, sole traders, micro businesses and small organisations with practical cyber guidance, triage and support. Depending on how the service is provided, we may act as a controller of personal data, and in some situations we may act as a processor on behalf of a reseller, channel partner, managed service provider, or customer.
This Privacy Policy applies where we act as a controller unless we say otherwise.
We may collect and use the following categories of personal data.
We ask users not to share passwords, one-time codes, payment card details, bank details, government ID numbers, or special category personal data unless strictly necessary and specifically requested through a secure process.
In some cases, users may choose to share information that reveals personal circumstances, health information, or other sensitive details. If that happens, we will handle it with additional care and only where we have a lawful basis and, where required, an additional condition for processing.
The ICO states that you must identify a lawful basis for processing personal data, and if you process special category data you must also meet an additional condition under the law. High-risk processing is more likely to require a DPIA.
We collect personal data:
We use personal data to:
The UK GDPR requires a lawful basis for each processing activity. The ICO’s guidance confirms that at least one lawful basis must apply whenever you process personal data.
Depending on the context, we rely on one or more of the following lawful bases:
We process personal data where it is necessary to:
We may process personal data where it is necessary for our legitimate interests, provided those interests are not overridden by your rights and freedoms.
Our legitimate interests may include:
Where we rely on legitimate interests, we seek to ensure the processing is proportionate, has minimal privacy impact, and is not unexpected. The ICO says legitimate interests can be used only where that balance is appropriate, and that those interests should be clearly explained in the privacy notice.
We rely on consent where required, including for:
You can withdraw consent at any time, but this will not affect the lawfulness of processing before withdrawal.
We may process personal data where necessary to comply with legal or regulatory obligations.
In exceptional cases, we may process personal data where necessary to protect someone’s vital interests.
Pokkit may use AI-assisted systems to:
We use AI to support service delivery, efficiency, consistency and triage. We do not intend for Pokkit to make solely automated decisions that produce legal or similarly significant effects on individuals without appropriate safeguards.
ICO guidance explains that individuals have additional protections if an organisation carries out solely automated decision-making with legal or similarly significant effects, including transparency requirements and safeguards such as the right to human intervention in relevant cases.
Where appropriate, we may:
AI outputs may be inaccurate, incomplete, or inappropriate in some cases. Pokkit should be used as a support and guidance service and not as the sole basis for high-risk, legal, regulated, employment, insurance, medical, or financial decisions.
If you use Pokkit through WhatsApp or a similar messaging channel, your messages may be processed by us and by the messaging provider in accordance with that provider’s own terms and privacy practices.
Please note:
Where appropriate, we may use measures such as limited retention, summarisation, or case closure workflows to reduce unnecessary exposure of chat content.
We may use cookies and similar technologies on our website for:
Under PECR, consent is generally required for non-essential cookies and similar technologies. The ICO states that PECR applies to cookies and similar technologies, and consent requests should be specific and granular.
Where required, we will ask for your consent before placing non-essential cookies on your device.
You can manage cookie preferences through our cookie banner or your browser settings.
You should also maintain a separate Cookie Policy and consent mechanism if you use analytics, ad tech, or other non-essential trackers.
We may send service-related communications where necessary to administer the service.
We may also send marketing communications about our products, services, events, updates or partner offers where:
You can opt out of marketing at any time by using the unsubscribe link in our emails or by contacting us.
Marketing by email, text and similar channels is also subject to PECR rules.
We may share personal data with:
We require service providers acting on our behalf to handle personal data under appropriate contractual and security controls.
Some of our providers or partners may process personal data outside the UK.
Where we transfer personal data internationally, we will take steps to ensure it is protected in accordance with UK data protection law. Depending on the destination, this may include:
ICO guidance notes that where a transfer is covered by adequacy, information can flow without additional transfer safeguards.
You can contact us for more information about the safeguards we use.
We take appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.
These measures may include:
However, no method of transmission over the internet or electronic storage is completely secure.
We aim to collect only the personal data we need for the relevant purpose.
Users should not submit:
If you need to provide higher-risk information, we may direct you to a more appropriate and secure channel.
The UK GDPR’s core principles include lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity/confidentiality, and accountability.
We keep personal data only for as long as reasonably necessary for the purposes set out in this Privacy Policy, including to:
Retention periods may vary by category of data. For example:
We may anonymise data so it can no longer identify you, in which case we may use it for longer.
Under UK data protection law, you may have the right to:
The ICO’s “right to be informed” guidance explains that transparency is one of the core UK GDPR requirements, and Articles 13 and 14 set out the minimum privacy information individuals should receive.
To exercise your rights, contact us at hello@pokkit.tech.
We may need to verify your identity before responding.
You also have the right to complain to the Information Commissioner’s Office (ICO):
ICO website: ico.org.uk
Pokkit is not intended for children under [16] unless explicitly stated otherwise.
We do not knowingly collect personal data from children without appropriate authority or another lawful basis. If you believe a child has provided personal data to us inappropriately, please contact us so we can investigate.
Our website or service may link to third-party websites, platforms or services. This Privacy Policy does not apply to those third parties. You should read their privacy notices before providing personal data to them.
We may update this Privacy Policy from time to time.
When we do, we will update the “Last updated” date above. If the changes are material, we may take additional steps to notify you.
If you have questions about this Privacy Policy or how we handle personal data, contact:
Pokkit Ltd
Email: hello@pokkit.tech
Address: Hub8 MX, Chester Walk, Cheltenham, GL50 3JY
Privacy contact: Pokkit Founder Team