Privacy notice

01 Who I am

ToolWright is a trading name of Joe Thorp, a sole trader based in the United Kingdom. I build custom web applications for small businesses.

For the purposes of UK data protection law I am the data controller for the personal data described in this notice — except for data held inside a client's own system, where I act as a processor (see section 5).

I am registered with the Information Commissioner's Office. Registration number: ZC211900.

02 What data I collect

If you're a business I've contacted

• Your name and job title
• Your work email address
• The name, registered number and address of the company you work for
• Where I found those details — usually your company website, Companies House, or a public business directory
• A record of emails sent to you and any reply, including any request to stop

If you get in touch with me

• Your name, email address and telephone number if you give it
• Anything you choose to write in your message
• Any file you send me, including spreadsheets — which may contain personal data about your staff, customers or suppliers

If you become a client

• Everything above, plus billing details and company information needed to raise an invoice
• A record of payments received (I do not see or store your card or bank details — payment is by bank transfer or a payment provider who handles that themselves)
• Correspondence relating to your project

I do not collect special category data (health, ethnicity, religion, biometrics and similar), and I do not want it. If a file you send me happens to contain any, tell me and I'll delete it.

03 Why I use it, and my lawful basis

Where I rely on legitimate interests, my interest is finding and serving business customers. I've assessed this against your interests and rights, and concluded the impact is low: I contact people in their professional capacity only, at work addresses, about something relevant to their job, at a small volume, and I stop immediately when asked. You can ask me for a copy of that assessment.

04 Business emails I send you

I send a small number of emails each day to UK limited companies whose details are publicly listed. If you've received one:

• Where I got your address. Your company website, Companies House, or a public business directory. Tell me and I'll confirm exactly which.
• How to stop it. Reply with "stop", or email joe@toolwright.co.uk. That's the end of it — no confirmation loop, no follow-up campaign.
• What happens then. I keep your email address on a suppression list so you're never contacted again. That's the only reason I keep it, and it's why I can't simply delete it entirely.
• Objecting. You have an absolute right to object to direct marketing. If you object, I stop. No balancing test, no argument.

I don't use tracking pixels, read receipts, or link tracking in my emails. I know whether you replied. I don't know whether you opened it.

05 Data inside your spreadsheet

This section matters if you're a client, because it's where most personal data actually sits.

To rebuild your spreadsheet as an application, I need the spreadsheet. It usually contains personal data belonging to other people — customer contacts, supplier names, staff initials, delivery addresses. For that data:

• You are the controller. I am the processor. It's your data. I only handle it because you've asked me to.
• I act on your instructions only, and use the data solely to build, test and support your application.
• I don't use it for anything else — not for analysis, not for training anything, not for my own purposes.
• I keep it confidential and apply the security measures in section 9.
• I tell you within 24 hours if I become aware of a breach affecting it, with enough detail for you to meet your own reporting duties.
• I help you respond if one of your customers or staff exercises their rights over data held in your system.
• I return or delete it on request, and delete my working copies when the project ends.
• I don't use sub-processors for your content beyond the hosting and email providers listed in section 6, and I'll tell you before that changes.

Where required, these terms are set out in full in the data processing terms that form part of my terms of business.

06 Who else sees it

I don't sell data, I don't share it for anyone else's marketing, and there's no sales team to pass it to. It is seen by the following service providers, each acting on my instructions:

My bank is included above for transparency, but it acts as an independent controller of your payment data under its own privacy notice and banking regulation, not on my instructions.

I may also disclose data to HMRC, my accountant, my insurers or professional advisers where I'm required to, or to a court or regulator if the law obliges me.

07 Data outside the UK

Some of the providers above are based in, or store data in, the United States. Where personal data is transferred outside the UK, it is protected by one of the safeguards recognised under UK law — typically the UK's adequacy regulations for the US Data Privacy Framework, or the International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses.

You can ask me which safeguard applies to a particular provider and I'll tell you.

08 How long I keep it

The six-year periods reflect HMRC record-keeping requirements and the ordinary limitation period for contract claims. Anything held beyond its period is deleted.

09 How it's kept safe

• Devices are encrypted and password-protected, with automatic locking
• Multi-factor authentication is on every account that supports it
• Data is transmitted over encrypted connections only
• Client files are stored in a single controlled location, not scattered across devices or personal cloud accounts
• Access is limited to me; nobody else works on client data
• Working copies of client data are deleted once the project completes
• Client applications are built to keep data within the client's own control wherever the design allows

No system is completely secure. If a breach occurs that's likely to risk your rights and freedoms, I'll report it to the ICO within 72 hours of becoming aware of it and tell you directly where the law requires.

10 Your rights

Under UK data protection law you can ask me to:

• Give you a copy of the personal data I hold about you
• Correct it if it's wrong or incomplete
• Delete it, where there's no overriding reason for me to keep it
• Restrict how I use it while a query is sorted out
• Hand it over to you or another provider in a usable format, where it's held on the basis of contract or consent
• Stop using it, where I rely on legitimate interests — and I must stop entirely if the purpose is direct marketing

Email joe@toolwright.co.uk. It's free, and I'll respond within one month. I may ask you to confirm your identity first, and I'll say so if a request is one I can only partly action and why.

If your request concerns data held inside a client's application, I'll pass it to that client, since they control it.

11 Cookies and this website

This website sets no cookies. There is no analytics, no advertising tag, no tracking pixel and no social media embed. Nothing follows you around after you leave.

Fonts and stylesheets are served from this domain rather than from a third party, so viewing the site doesn't hand your IP address to anyone else.

My web host keeps standard server logs, including IP addresses, for security and to keep the site running. These are held briefly and used for nothing else.

12 Complaints

If you're unhappy with how I've handled your data, tell me first — most things are quicker to fix directly.

You also have the right to complain to the Information Commissioner's Office at any time:

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

13 Changes to this notice

If this notice changes, the version number and date at the top change with it. Where a change materially affects how I use data I already hold, I'll tell affected clients directly rather than relying on you to check the page.