Privacy Statement
What the Powerful IT Systems customer portal stores, why we hold it, who sees it, and how long we keep it.
Effective September 19, 2026
1. Scope
This statement describes the personal information stored by the Powerful IT Systems customer portal at portal.powerful-it.com, and by the managed services we deliver through it. Powerful IT Systems is the managed service provider responsible for the portal; your organization keeps ownership of its own business records.
It does not cover how your own organization handles its systems, and it does not cover Microsoft, Google, or any other service you sign in with, each of which publishes its own privacy statement.
2. What the portal stores
- Name and contact details
- Your name, work email address, phone number, job title, and department as recorded on your organization's contact record, the client organization you belong to, and the portal role and permissions granted to you.
- Client organization
- The customer account your access belongs to. Everything you can see in the portal is scoped to that account, and customer isolation keeps other client organizations out of it.
- Authentication data
- The sign-in provider you used (Microsoft 365 or Google Workspace), the account identifier that provider returns, the email address it asserts, sign-in and sign-out times, the portal session records that let a session be validated or revoked, and the security details recorded for sign-in attempts and portal requests such as IP address, browser user-agent, and outcome.
- Ticket and request data
- The tickets you raise with their messages and attachments, service requests and forms you submit such as equipment, onboarding, and offboarding, approval decisions and comments, and the status history that shows who decided what and when.
- Device and service information shown to you
- The device inventory, patch and antivirus status, vulnerability findings, backup status, and report snapshots the portal displays for your organization, together with client-visible notes our technicians add.
- Audit and security logs
- Records of portal activity such as sign-ins, downloads, approvals, and settings changes, authentication and authorization events including denied attempts, and the system diagnostics used to operate, secure, and troubleshoot the service. Log entries are tied to the account that performed the action.
- Preferences
- The portal theme you chose, held with your portal account and cached on your device, and the notification preferences you set.
3. Why we hold it
- To deliver the managed services your organization has engaged us for, including support, remote assistance, and reporting.
- To authenticate you, decide what you may see and change, and enforce customer isolation between client organizations.
- To notify you about tickets, approvals, and service events you asked to be told about.
- To keep an auditable record of actions taken on your organization's environment, which is a core part of managed IT service.
- To keep the platform secure and reliable, including detecting abuse and investigating incidents.
- To meet our legal, tax, and record-keeping obligations.
4. Who can see it
We do not sell personal information, and the portal carries no advertising or third-party tracking scripts.
- Your organization: authorized contacts and portal users of your own client organization can see the requests, approvals, and reports published to that organization.
- Powerful IT Systems staff: technicians and administrators who support your organization, working under least privilege and with their own activity logged.
- Service providers: the hosting, email delivery, remote-session relay, push-notification, and identity providers that operate the service under contract with us. They receive only what their function needs.
- Legal and safety: we disclose information where the law requires it, or where it is necessary to protect people, the service, or other clients, and we tell your organization where we are permitted to.
5. How long we keep it
- Account, contact, ticket, and asset records
- Kept while your organization is a client and for the period set by your service agreement, then deleted or handed over as that agreement provides. Recovery copies expire on their normal cycle.
- Audit and security logs
- Kept on a rolling window, typically 90 days, so that activity on a client environment can still be reviewed afterwards.
- Diagnostic telemetry
- Kept for about 10 days for troubleshooting, and local evidence archives for up to 30 days. Archived entries are redacted and used only for support and incident review.
- Request and approval history
- Kept with the ticket or request it belongs to, so the decision trail stays intact for as long as that record is kept.
6. How we protect it
- Encrypted transport (TLS) for portal and API traffic, and encryption at rest for stored secrets such as endpoint credentials.
- Role-based access control: portal users hold a role against their customer contact record, permissions are denied by default, and data is scoped to the customer it belongs to.
- Sign-in through your organization's identity provider, with portal sessions that can be revoked individually.
- Audit logging of administrative and security-relevant actions, retained for later review.
- Ticket email is sanitized before it is stored or displayed, and remote images in an email are not loaded until a user chooses to load them for that message, because loading them would disclose the reader's IP address and request details to the sender.
7. Your choices
Personal information in the portal describes you as a named user of your organization's service, and the records themselves belong to your organization. Requests to access, correct, or delete that information are best routed through your organization's IT contact, and we act on your organization's instructions and on requests sent to us directly.
- Ask your IT contact, or us, to correct inaccurate contact details.
- Ask us to revoke portal access when someone changes role or leaves the organization.
- Ask your organization, or us, about deleting ticket content that belongs to that organization.
- Contact our support team for anything else about this statement.
8. Cookies and local storage
- Required: session cookies that keep you signed in, and a cross-site request forgery cookie that protects form submissions.
- Preferences: browser local storage entries for your theme and page preferences. They stay on your device.
- The portal does not set advertising or analytics-tracking cookies.
9. Children
The portal is a business service for authorized client users and is not intended for use by children.
10. Changes to this statement
We update this statement as the service and the law change, and publish the current version at this address with its effective date. Material changes are notified to your organization's authorized contacts.
11. Contact
For a privacy question, or a request about your own information, contact our support team.
Email support@powerfulitsystems.net
Our website carries the current service and contact details for Powerful IT Systems.