Privacy & Data Security Policy

As part of the commitment of Service 111 Business Computing Ltd to protecting the privacy and the data security of our clients, we are updating our privacy policy in accordance with the requirements of the Privacy Protection Law (including Amendment 13).

To meet these requirements, the following officers have been appointed in the organization:

• Data Protection Officer (DPO) - professionally responsible for managing data privacy, responding to inquiries from the public, and serving as the point of contact with the Privacy Protection Authority.
• Chief Information Security Officer (CISO) - responsible for information security and protection against risks.

Protecting the Data and Its Ownership

This document is intended to clarify how data stored in the systems of Service 111 Business Computing Ltd is managed, used and protected in the course of providing managed IT (MSP) services.

Internal databases - the company maintains a database containing basic business information about its clients (business name, manager's name, company registration no. / licensed dealer no., contact details, invoices, receipts, service history, technical information about computing equipment), as well as information collected in the course of providing services - such as documentation of requests and incidents in our ticketing systems, handling reports and correspondence with the client. The database does not include personal data of special sensitivity, and it is kept in accordance with the law and with professional standards.

Client data - personal or business data belonging to our clients, including data of their end clients, stored on servers, systems or infrastructure that we provide and manage for them. Where present, this data may also include data of special sensitivity (as defined by law: medical, biometric or genetic data, criminal record, salary data, political opinions and more). All data of this kind remains under the ownership and control of the client alone. We act solely as a "Holder" (Processor), handling the data under the service agreement and in accordance with the provisions of the law, with no further use, viewing or transfer to a third party - unless an explicit, verified instruction to perform such an action has been received from the client.

In this arrangement, the client is the controller of its data and of its end clients' data, and the company serves solely as a Holder of the data, processing it only according to the client's instructions and in accordance with the provisions of the law.

Types of Data Collected or Stored

We do not collect, at our own initiative, medical, financial, demographic or any especially sensitive data. However, such data may be stored on systems, servers or infrastructure that we provide and manage for our clients.

In addition, we keep technical and operational data required to provide the services - such as IP addresses, technical equipment details, logs and usage data - and protect it in accordance with strict standards.
As an MSP, information provided to us or collected in the course of handling incidents, projects or maintenance work (such as documentation in a ticketing system, log files handed to us, and work instructions from the client) is kept in our systems for service continuity and professional documentation.

Duty of Notification When Collecting Personal Data

We do not collect personal data of our clients' end clients.
We do collect personal data concerning our clients themselves at the time of engagement and during the service, when the clients provide us with the data for the purpose of operating the service - such as contact details, payment details, technical information about the computing environment, and documentation of interactions in the course of incident handling.

When collecting personal data from our clients themselves (and not from their end clients), we will inform the client of:

• The purpose for which the data is provided (delivery of the services).
• Our identity and the contact details of the DPO.
• To whom the data may be disclosed and the purposes of such disclosure (for example, subcontractors required for delivering the service, such as remote-access software vendors and the like).
• The client's rights to review the data and to request its correction or deletion.
• If a request to delete or correct data is refused, explicit notice will be given in accordance with Section 14(c) of the law.

Purposes of Data Use

The data we keep is used for:

• Operating and supporting the systems under our management.
• Maintenance, information security and disaster recovery.
• Client relationship management, billing and service documentation.
• Compliance with legal requirements and statutory obligations.

Client Responsibility

The client is the controller of, and solely responsible for, the data belonging to it, whether it is stored on the client's premises or on infrastructure that we provide. We act solely as a Database Holder, and process the data in accordance with the client's instructions and for the client's purposes.

Sharing with Third Parties

We do not transfer data to third parties unless this is required for delivering the service and in accordance with the client's instruction, or under a legal obligation. We use services from leading vendors (Microsoft, AWS, Google and others) and verify, as far as possible, that they comply with the data security regulations and with the requirements of Israeli and European law. We operate by the principle of Data Minimization.

Data Security and Compliance Controls

We operate a combination of technological measures, internal procedures and management controls: permission management, data encryption, system monitoring, periodic testing, risk assessments, maintaining Processing Records, and performing Data Protection Impact Assessments (DPIA) where needed.

Data Subject Rights and the Limits on Our Actions

Any person whose personal data is collected or stored by us is entitled to review it and to request its correction or deletion, in accordance with the provisions of the law and within the timeframes it sets (up to 30 days).

As for data that belongs to a client and is held in our systems - we, as Holders of the data, are not permitted to perform any action on this data (including viewing, updating, copying, deleting or transferring it) without an explicit, verified instruction from the client who owns the data. Any action on such data is performed solely at the client's instruction and subject to the service agreement and the law.

If a request for correction or deletion is refused, the client will receive a reasoned notice of the refusal, as required by law.

DPO Contact Details

Name: Lior Levi
Email: [email protected]
Phone: 072-2281396

Policy Updates

This policy will be updated as needed to reflect changes in the law, in technology or in our services, and will be published prominently on the website. We will notify clients directly of material changes.

We will be glad to answer any question or clarification - you can contact Lior, our Data Protection Officer, or use the "Contact" form on the website.

The certification certificates of our information security and privacy protection officers, and the results of the ISO audit we passed, are shown on the Standards & Certifications page.

Update Following Amendment 13 to the Privacy Protection Law (2026)

In accordance with Amendment 13 to the Privacy Protection Law, 5741-1981, we apply the following principles on our website and in our services:

• Data minimization: our website forms collect only the details needed to get back to you (name, business name, phone, email and the content of your message).
• Purpose of use: the details are used solely to respond to your inquiry and are not transferred to any third party.
• Data security: communication with the website is encrypted (TLS), and the data is managed under procedures aligned with the ISO 27001 and 27799 standards, with CISO and DPO oversight.
• Your rights: you may request to review, correct or delete data you have provided to us - by contacting us at the contact details at the bottom of this page.