SERVE ITSM · LEGAL
Data processing terms
Last updated 12 October 2026
This page is an overview only. Where Serve ITSM processes personal data for a customer, the customer is generally the controller and the contracted service provider is the processor. A signed data processing agreement and service-specific schedules are required before production customer data is processed.
Operator and scope
ServeITSM (company number 17490108), trading as ServeITSM, of 105 Swan Road, Hanworth, Greater London, England, United Kingdom, TW13 6PE. Not VAT registered; no VAT is currently charged. This website and the services described here are for business customers only; no residential consumer service is offered. No VAT number is currently held. Unless a signed customer agreement states otherwise, the law of England and Wales applies and the courts of England and Wales have jurisdiction, subject to mandatory law.
Customer responsibilities
The customer determines its purposes and lawful basis, provides required notices, configures access, minimises information, validates instructions and ensures it has authority to submit personal data to the service.
Processor responsibilities
Under the signed DPA, ServeITSM will process personal data only on documented instructions, ensure authorised personnel are bound by confidentiality, apply agreed technical and organisational security measures, assist with data-subject requests and compliance obligations, notify the customer of personal-data breaches without undue delay, control subprocessors, support audits as agreed, and return or delete data at the end of service subject to legal retention duties.
Security, hosting and retention
The service is hosted on infrastructure provided through Hostinger; Microsoft 365 is used for business email/collaboration. Backups, role-based access controls and encryption are implemented as part of the service security approach. Exact regions, backup windows, recovery targets, encryption details and support commitments depend on the contracted deployment and must be set out in the customer schedule.
The standard ticket lifecycle retains resolved tickets for 30 days, archives them automatically for 90 days, then deletes them, except where a legal hold, law or documented customer instruction requires otherwise.
Subprocessors, AI and transfers
Depending on the customer’s configuration and enabled features, subprocessors may include Hostinger, Microsoft 365, Ollama-hosted/local infrastructure, Microsoft Copilot and OpenAI. Ollama may run within customer-controlled or Serve-managed infrastructure; Copilot and OpenAI processing depends on the selected account and configuration. The applicable DPA schedule must identify the actual provider, purpose, data, location and transfer safeguards before production use. Customers control whether to enable optional AI integrations.
Request the contract
Registered customers and prospective customers can request the current data-processing schedule from info@serveitsm.com.