Privacy Policy

Last updated: 25 September 2026

Kilwhiss 365 provides Microsoft 365 security reviews, Copilot readiness and managed tenant services. This notice explains how we handle personal information when you use m365.kilwhiss.group, make an enquiry or discuss our services. It does not replace the data-processing terms agreed with a customer for work inside that customer's Microsoft 365 environment.

Who we are

Kilwhiss Group Limited, trading as Kilwhiss 365, is responsible for the personal information described in this website notice. Our company number is SC886888. Our registered office is Easter Kilwhiss Farm, Ladybank, Cupar, Scotland, KY15 7UR.

For privacy enquiries, contact hello@m365.kilwhiss.group, use our contact form, or write to the address above. You can also call +44 1337 302 170.

Information we collect

When you send an enquiry, we receive the details you enter, which may include your name, business email, organisation, approximate number of users, the service of interest, current Microsoft plan and the information in your message. If you contact us by another route, we receive the details needed to respond. Please do not send passwords, recovery codes, sensitive tenant exports or other secret credentials through the website form.

Our hosted server records access and error logs to deliver and protect the site. These can include the time of a request, the page requested, your IP address, browser information and security events.

If you become a customer, we may hold relevant business contact, proposal, contract, billing and service records. The handling of information within a customer's tenant is defined in the applicable agreement and data-processing terms.

Why we use it and our lawful bases

We use enquiry details to respond, assess whether a service is suitable, arrange a call and prepare a proposal. We normally rely on legitimate interests in responding to a business enquiry, or on steps taken at your request before entering a contract where appropriate. Our legitimate interest is to deal with enquiries relevant to our services; we consider the nature of the contact and your reasonable expectations.

We use customer contact and service details to deliver an agreed service and manage the relationship. The applicable basis may be performance of a contract or legitimate interests, depending on the person and the activity. We keep records required for invoicing, accounting and other legal obligations under the legal obligation basis where applicable.

We use limited technical information to operate, troubleshoot and secure the site under our legitimate interests in maintaining a reliable and secure service.

We do not treat the required enquiry checkbox as permission to send unrelated marketing. If we introduce marketing messages, we will provide a separate choice where required and explain how to opt out.

Who receives information

Authorised staff and service providers may access information where needed to run the website, deliver email and hosting, manage enquiries, provide security and support, or meet legal obligations. We may share an enquiry with the relevant Kilwhiss specialist if the requested work falls within that company's service, and we will explain the handover where appropriate. We do not sell personal information. Where a customer commissions Microsoft 365 work, any access to the customer's systems is governed by the service agreement and applicable data-processing terms.

International transfers

We do not transfer the personal information covered by this website and enquiry notice outside the UK. If that changes, we will update this notice and explain the applicable safeguards.

How long we keep information

We keep enquiry records while we respond and complete reasonable follow-up. If the enquiry becomes a customer relationship, relevant details become part of the customer record. We may retain a record for longer where needed for a legal obligation or dispute. Hosted server access and error logs are kept for 30 days. Customer, financial and contractual records follow the applicable legal and business retention requirements. When information is no longer needed, we delete or anonymise it, subject to backup rotation and legal holds.

Cookies and similar technologies

The site uses only cookies or similar storage needed for essential site functions and security. We do not use optional analytics or marketing cookies on this site.

Your rights

Depending on the circumstances, you may ask to access or correct your personal information, request its deletion or restriction, object to processing based on legitimate interests, or ask for information you supplied to be transferred. Where we rely on consent for a particular activity, you may withdraw it at any time without affecting earlier lawful processing. Some rights have exceptions. Contact us using the details above and we will assess your request.

You have the right to object at any time to direct marketing. You can also object to processing based on our legitimate interests, including the handling of an enquiry, and we will consider your circumstances and any applicable grounds for continuing.

If you are unhappy with our response, you can complain to the Information Commissioner's Office. We would welcome the chance to address your concern first.

Changes to this notice

We may update this notice when our services, suppliers or data practices change. We will publish the revised date here and bring significant changes to your attention where appropriate.