1Who we are
1.1
Innov8 Workflows ("we", "us", "our") builds and maintains websites and runs digital marketing for businesses in the UK. This policy explains what personal information we collect, why we collect it, and what rights you have over it.
1.2
For the information described in this policy, Innov8 Workflows is the data controller. That means we decide what is collected and why, and we are responsible for looking after it.
1.3
Innov8 Workflows is a sole trader business operated by Jamie Barlow, based in England.
1.4
For any question about this policy or your data, email jamie@innov8workflows.co.uk.
2What this policy covers
2.1
This policy covers personal information we collect through innov8workflows.co.uk, through direct contact with us by email, phone, WhatsApp or social media, and in the course of providing services to our clients.
2.2
It does not cover websites we have built for our clients. On those sites, our client is the data controller and their own privacy policy applies. Our role there is described in section 8.
2.3
Our website links to other websites. We are not responsible for how those sites handle your data, so check their own policies.
3What we collect
We collect different information depending on how you interact with us.
If you enquire with us
- Your name, business name, email address and phone number
- The content of your enquiry and any messages you send us
- Information about your business relevant to the work, such as trade, service area and existing website
If you become a client
- Billing contact details and business address
- Records of the services we provide and the work we do for you
- Correspondence between us, including email, WhatsApp, call notes and meeting notes
- Login and account details for services we manage on your behalf, such as domains, email hosting, Google Business Profile and advertising accounts
- Payment records. We never see or store your full card details. Those are handled directly by Stripe
If you visit our website
- Your IP address, browser type, device type and operating system
- Which pages you viewed, how long for, and where you arrived from
- Cookie data, as described in section 10
In plain English
Broadly: what you tell us, what we need to bill you and do the work, and some basic technical information about your visit. Your card details go straight to Stripe and never touch our systems.
4Why we use it, and our lawful basis
UK data protection law requires us to have a lawful basis for using your personal information. Ours are set out below.
| What we do with it | Lawful basis |
|---|---|
| Reply to your enquiry and prepare a quote | Legitimate interests: responding to someone who has contacted us |
| Deliver the services you have signed up for | Performance of a contract |
| Take payment and manage your subscription | Performance of a contract |
| Provide support and communicate about your account | Performance of a contract |
| Keep accounting and tax records | Legal obligation |
| Understand how our website is used and improve it | Consent, through cookie choices |
| Send you occasional marketing about our services | Consent, or legitimate interests where you are an existing client |
| Protect our systems and prevent fraud or abuse | Legitimate interests |
| Establish, exercise or defend legal claims | Legitimate interests |
5Marketing
5.1
If you are an existing client, or you have enquired about our services, we may occasionally email you about related services we offer.
5.2
Every marketing email has an unsubscribe link. You can also just reply and tell us to stop, or email jamie@innov8workflows.co.uk.
5.3
Opting out of marketing does not stop service messages about your account, billing, or your website. We still need to send those.
5.4
We do not sell your information to anyone, and we never will.
7Sending data outside the UK
7.1
Some of our providers are based outside the UK, mainly in the United States and the EU. This means your information may be processed abroad.
7.2
Where that happens, we rely on safeguards recognised under UK law, either a UK adequacy decision for the country concerned or the International Data Transfer Agreement or Addendum in the provider's contract terms.
7.3
Ask us if you want details of the safeguards applying to a specific provider.
8Data on our clients' websites
8.1
When someone submits an enquiry form or clicks to call on a website we built for a client, that information belongs to our client, not to us.
8.2
For that data, our client is the data controller and we act as their data processor. We handle it only on their instructions and only to keep their website running.
8.3
If you are a member of the public who contacted a business through a website we built, and you want to know what happens to your information, contact that business directly. Their privacy policy applies, not this one.
8.4
If you cannot reach them, get in touch and we will point you in the right direction.
In plain English
Leads that come through a client's website are the client's data. We only look after the plumbing. If you are a customer of one of our clients, speak to them about your information.
9How long we keep it
| Information | How long we keep it |
|---|---|
| Enquiries that do not become clients | 12 months from last contact |
| Client account and project records | For the length of the relationship, then 6 years |
| Invoices, payments and accounting records | 6 years, as required by HMRC |
| Correspondence with clients | 6 years after the relationship ends |
| Website analytics | No longer than 14 months, in line with the retention setting on our Google Analytics account |
| Marketing contacts | Until you unsubscribe, then a minimal record so we do not contact you again |
9.1
We keep records for six years after a client relationship ends because that is the period in which a legal claim could be brought, and because HMRC requires it for tax records.
9.2
Once a retention period ends, we securely delete or anonymise the information.
11How we protect it
11.1
We use encrypted connections, access controls, two-factor authentication on business-critical accounts, and reputable providers with their own security standards.
11.2
No system is completely secure. We cannot guarantee that information sent over the internet is entirely safe in transit, but we take reasonable steps to protect it once we have it.
11.3
If a breach happens that is likely to put your rights at risk, we will tell you and report it to the Information Commissioner's Office within 72 hours as the law requires.
12Your rights
Under UK data protection law you have the following rights over your personal information.
| Right | What it means |
|---|---|
| Access | Ask for a copy of the personal information we hold about you |
| Rectification | Ask us to correct anything inaccurate or incomplete |
| Erasure | Ask us to delete your information, where we have no ongoing reason to keep it |
| Restriction | Ask us to pause using your information while a concern is resolved |
| Portability | Ask for your information in a portable format, or sent to another provider |
| Object | Object to us using your information on the basis of legitimate interests, or for marketing |
| Withdraw consent | Withdraw consent at any time, where consent is the basis we rely on |
12.1
To use any of these rights, email jamie@innov8workflows.co.uk. There is no charge.
12.2
We will respond within one month. If a request is complicated we may need longer, and we will tell you if so.
12.3
We may need to confirm who you are before acting on a request, to make sure we are not handing your data to someone else.
13Complaints
13.1
If you are unhappy with how we have handled your information, tell us first at jamie@innov8workflows.co.uk and we will do our best to put it right.
13.2
You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk or on 0303 123 1113.
13.3
You do not have to come to us first, but we would appreciate the chance to sort it out.
14Children
14.1
Our services are for businesses and are not directed at children. We do not knowingly collect information about anyone under 18.
14.2
If you believe we hold information about a child, contact us and we will delete it.
15Changes to this policy
15.1
We update this policy when our services, our providers or the law change.
15.2
The version and date at the top of this page always show which policy is current.
15.3
For significant changes affecting how we use your information, we will contact clients directly.
16Contact us
| jamie@innov8workflows.co.uk | |
| Phone | 07718 155997 |
| Website | innov8workflows.co.uk |
| Postal address | 27 Henley Close, Alfreton, Derbyshire, DE55 7SS |
See also our Terms of Service.