Privacy Policy

This policy explains what personal data WarmFlow Solutions Ltd collects, why we collect it, how long we keep it and what you can make us do with it. It covers this website and our work with clients.

We are the data controller for the data described here. We are registered in England and Wales, with a registered office at 128 City Road, London EC1V 2NX, United Kingdom. You can reach us at contact@warmflowsolutions.uk or +44 7456 044106.

We process personal data under the UK GDPR and the Data Protection Act 2018. Where we work with clients in the EU, the EU GDPR applies on the same terms.

1. What we collect

When you contact us

Through the contact form, the quote form, email or phone:

• Your name and, where given, your business name
• Your email address and, if you provide one, your phone number
• Any website or profile URL you share with us
• The services, package, timeline and budget you indicate an interest in
• The contents of your message

When you become a client

To do the work you are paying for, we also handle:

• Business registration details, trading address and contact information
• Opening hours, service areas, product and pricing information
• Images, logos and other brand material you supply
• Access to, or credentials for, platform accounts — see section 7
• Billing details and invoice records

We ask for identity documents only where a third-party provider requires them for verification — for example a payment gateway's know-your-customer checks. Where that happens we pass the document to that provider and do not retain a copy ourselves.

When you use this website

This site does not run advertising trackers or third-party analytics profiling. It sets two cookies, both strictly necessary, described in our Cookie Policy. Our web server keeps standard access logs (IP address, timestamp, requested URL, browser user agent) for security and diagnostics. Where you submit a form, your IP address and browser user agent are recorded alongside the submission so we can investigate abuse.

2. Why we process it, and our lawful basis

What we do	Lawful basis
Reply to your enquiry and prepare a quote	Steps taken at your request prior to entering a contract (Art. 6(1)(b))
Deliver the services you have engaged us for	Performance of a contract (Art. 6(1)(b))
Invoice you and keep accounting records	Legal obligation (Art. 6(1)(c)) — UK tax and company law
Keep the website secure and prevent form abuse	Legitimate interests (Art. 6(1)(f)) — protecting our systems
Keep a record of work delivered and advice given	Legitimate interests (Art. 6(1)(f)) — defending against future claims

We do not send marketing email. If we ever introduce a newsletter it will be opt-in only, and consent will be the lawful basis for it.

3. Who we share it with

We do not sell personal data, and we do not share it for anyone else's marketing. We use a small number of processors who handle data on our instructions:

• Email and hosting providers — to receive your message and run this website
• Accounting and invoicing software — to issue invoices and keep records
• Payment processors — where you pay us by card

Separately, delivering your project means setting up accounts on third-party platforms such as Google, Meta, TikTok, LinkedIn, Stripe, PayPal, SumUp, Mollie, Shopify or WooCommerce. Those accounts are yours, created in your name. Each platform is an independent controller of the data in that account and its own privacy policy applies. We will tell you which platforms are involved before we create anything.

We may also disclose data where we are legally required to — for example to a regulator, or in response to a valid court order.

4. International transfers

Some of our providers operate outside the UK. Where personal data is transferred outside the UK or the EEA, we rely on UK adequacy regulations or on the International Data Transfer Agreement (or the UK Addendum to the EU Standard Contractual Clauses), together with any additional safeguards needed for that transfer.

5. How long we keep it

Record	Retention period
Enquiries that do not become projects	12 months from last contact, then deleted
Client project files and correspondence	6 years from the end of the engagement
Invoices and accounting records	6 years after the end of the relevant accounting period, as UK tax law requires
Website access and form-submission logs	12 months
Credentials shared for a project	Deleted at handover — see section 7

6. Your rights

Under UK GDPR you have the right to:

• Be informed — which is what this document is for
• Access a copy of the personal data we hold about you
• Rectification of anything inaccurate or incomplete
• Erasure, where we have no overriding obligation to keep it
• Restrict processing while a dispute about accuracy or legitimate interests is resolved
• Data portability for data you gave us, in a machine-readable format
• Object to processing carried out on the basis of legitimate interests
• Withdraw consent at any time, where consent is the basis we rely on

To exercise any of these, email contact@warmflowsolutions.uk or write to the registered office below. We respond within one month. We will not charge you, and we will not ask why.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection. We would rather you raised it with us first, but you are not required to.

7. Credentials and account access

Our work sometimes requires access to accounts that belong to you. Our standing practice is:

1. Wherever a platform supports delegated access, we ask to be added as a manager or collaborator rather than asking for your password. That access is revocable by you in one click.
2. Where a platform offers no alternative, credentials are shared through a time-limited encrypted link, never by plain email or SMS, and never stored in our own notes.
3. At handover we are removed from every account, or downgraded to whatever role you choose to leave us with, and any credentials we held are destroyed.

We will always recommend you change shared passwords at handover, regardless of the above.

8. Security

We use encrypted connections (HTTPS) across this site, multi-factor authentication on the accounts we control, encrypted storage for project files, and access limited to the people working on your project. No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and tell you directly where the risk is high.

9. Children

Our services are provided to businesses and we do not knowingly collect data relating to anyone under 18. If you believe we hold such data, contact us and we will delete it.

10. Changes to this policy

We may update this policy as our services or obligations change. The version shown here is always the current one and is dated at the top of the page. Where a change materially affects how we handle data we already hold, we will tell affected clients directly rather than relying on you to re-read this page.