Privacy policy

This policy explains what personal information we collect, why we collect it and how we look after it. We've kept it as short and clear as we can.

Who we are

Bit19 is a trading name of Soxsoftware Ltd, a company registered in England and Wales (company number [company number]). Our registered office is [registered office address].

Soxsoftware Ltd is the data controller for the personal information described in this policy. If you have any questions about it, email us at [privacy contact email].

What we collect

When you use our contact form

• your name and email address
• your business name, if you give it
• the package you're interested in and your message
• your IP address and browser details, which we use to prevent spam and abuse

When you're a client

If you become a client, we also hold:

• the contact details of the people who use your client account, such as names, email addresses and phone numbers
• the requests and messages you send us, and our replies
• files you upload, such as text, images and documents for your website
• records of the time we spend on your requests, so we can track your monthly edit allowance
• sign-in and security information, such as when you last logged in

When you visit our website

Our servers and our security provider automatically record technical information, such as your IP address, browser type and the pages you request. We use this to keep the website secure and working properly.

Why we use it, and our lawful basis

• Replying to your enquiry: our legitimate interest in answering people who contact us, or taking steps you've asked for before entering into a contract.
• Providing our services, including your client area, support requests and edit allowance: to perform our contract with you.
• Keeping our website and systems secure, including preventing spam: our legitimate interests.
• Keeping business and accounting records: to meet our legal obligations.

We don't sell your personal information. [Placeholder: confirm whether you will send marketing emails and, if so, how consent is collected.]

Who we share it with

We use a small number of trusted service providers (processors) who handle data on our behalf, under contracts that require them to keep it safe:

• Our hosting provider, [hosting provider name], runs the virtual private server (VPS) our website and client area live on, located in [the UK / the EU].
• Cloudflare protects our website from attacks and helps it load quickly. It processes visitors' IP addresses and technical request data.
• Resend sends our emails, such as replies to enquiries, client invitations and notifications.

Some providers may process data outside the UK. Where they do, we rely on appropriate safeguards recognised under UK law. [Placeholder: confirm the transfer safeguards for each provider.]

We may also share information when the law requires it.

How long we keep it

• Enquiries that don't lead to work: [12 months] after our last contact.
• Client account data, including requests, messages, files and time records: while you're a client, then [6 months] after you leave, so we can help with any handover.
• Accounting records: for as long as UK law requires, currently [6 years].
• Server and security logs: [up to 30 days].

How we keep it safe

We use encrypted connections (HTTPS), store uploaded files privately, protect our admin area with two-factor authentication, and only give access to people who need it. [Placeholder: review and add any further measures.]

Your rights

Under UK data protection law (the UK GDPR and the Data Protection Act 2018) you have the right to:

• ask for a copy of the personal information we hold about you
• ask us to correct information that's wrong or incomplete
• ask us to delete your information
• object to, or ask us to restrict, how we use it
• ask us to transfer your information to another organisation

To use any of these rights, email us at [privacy contact email]. We'll reply within one month.

Complaints

If you're unhappy with how we've handled your information, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk.

Cookies

We only use cookies that are strictly necessary for the website to work:

• a session cookie, which keeps you signed in to the client area and remembers form messages between pages
• a security cookie (XSRF-TOKEN), which protects our forms against cross-site request forgery

Cloudflare may also set a strictly necessary security cookie to help spot malicious traffic.

We don't use analytics, advertising or tracking cookies. Because we only use strictly necessary cookies, we don't need to ask for your consent, so you won't see a cookie banner.

Changes to this policy

We may update this policy from time to time. The date at the top of this page shows when it last changed.

Contact us

Soxsoftware Ltd (trading as Bit19)
[Registered office address]
[Privacy contact email]