Privacy policy

This policy explains how WODHouse SW20 (“we”, “us”, “our”) collects, uses and protects personal information. It applies to this website, to any website, app or service we run under our own name, and to the information we hold about our clients and the people we talk to about work. Where a product has its own privacy notice, that notice adds to this one.

1. Who we are

WODHouse SW20 is a small studio based in London, UK, that designs, builds, hosts and maintains websites, apps and internal systems. For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), we are the controller of the personal information described in this policy.

You can contact us about anything in this policy at hello@wodhouse.co.uk.

2. Systems we build and host for clients

When we build or host a website, app or system for a client, the client decides what personal information it collects and why. In that case the client is the controller and we act as their processor: we only handle that information on their instructions and under a written agreement with them. If you use a site or app we run on someone else’s behalf, their privacy notice applies, and you should contact them first about your information. We will help them respond.

3. Information we collect

Depending on how you deal with us, we may collect:

• Contact details, such as your name, email address, phone number, company and job title, when you get in touch, book a call or become a client.
• What you tell us, such as the content of emails, messages, call notes and project briefs.
• Account information, such as a username, password (stored only in hashed form) and preferences, if you create an account on one of our apps or services.
• Billing information, such as invoicing address and payment records. Card payments, where we take them, are handled by a payment provider and we do not see or store full card numbers.
• Usage and technical information, such as IP address, browser and device type, pages or screens viewed, and error logs, collected automatically when you use our websites and apps.
• Content you add to an app or service of ours, such as files, messages or records you choose to store.

We only collect health or other sensitive information through products built to handle it, as described in section 5. Otherwise, please don’t send it to us unless we’ve specifically asked for it and explained why.

4. How we use it, and our lawful basis

• To reply to you and discuss work, because it’s in our legitimate interests to respond to enquiries, or because you’ve asked us to take steps before entering into a contract.
• To deliver our services, including building, hosting, supporting and billing for them, because it’s necessary to perform our contract with you.
• To run, secure and improve our websites, apps and services, including fixing faults, preventing abuse and understanding how they’re used, based on our legitimate interests.
• To send service messages, such as security alerts, outage notices and account emails, because they’re necessary to provide the service.
• To send occasional news or marketing, only where you have agreed or where the law otherwise allows it. You can opt out at any time.
• To meet legal obligations, such as keeping accounting records and responding to lawful requests.

Where we rely on your consent, you can withdraw it at any time. We do not sell personal information, and we do not use it for automated decision-making that has legal or similarly significant effects on you.

5. Health and other sensitive information

Some of our products, or products we build for clients, may handle information that the law treats as especially sensitive. This includes information about physical or mental health, as well as genetic and biometric data, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, sex life or sexual orientation, and criminal convictions or offences.

Where a product handles this kind of information:

• We tell you up front. The product’s own privacy notice will say what sensitive information it collects, why, and who can see it.
• We have a specific legal basis. As well as one of the bases in section 4, we rely on a condition that allows sensitive information to be used. Usually that is your explicit consent. Sometimes it is another condition the law allows, such as providing health or social care, and the product notice will say which.
• We collect only what’s needed. We ask only for the sensitive information the product needs to work, and use it only to provide that product to you.
• We assess the risks first. Before launching, we carry out a data protection impact assessment and keep the policy documents the law requires.
• We protect it more tightly. We encrypt it in transit and at rest, limit access to the few people who need it, keep a record of who accesses it, and host it in the UK or under the safeguards in section 8.
• We never use it for marketing or advertising. We don’t sell it or share it for those purposes, and we don’t use it to profile you for anything unrelated to the service.
• You stay in control. If you withdraw consent, we will stop using the information and delete it, unless the law requires us to keep it. This may mean parts of the product stop working for you.

When we handle sensitive information as a processor for a client (see section 2), we do so under a written agreement with extra security and confidentiality terms. The client remains responsible for having a lawful basis to collect it.

Unless a product clearly says otherwise, our products are not medical devices and do not give medical advice. They are no substitute for a qualified professional, and in an emergency you should contact the emergency services.

6. Cookies and similar technologies

This website does not set cookies and does not use analytics or advertising trackers. It loads fonts from Google Fonts, which means your browser sends your IP address to Google when the page loads.

Some of our apps and services may use cookies or local storage that are strictly necessary for them to work, such as keeping you signed in. If any product uses optional cookies, for example analytics, we will tell you and ask for your consent first.

7. Who we share it with

We share personal information only where we need to, with:

• Service providers who help us operate, such as hosting and cloud infrastructure, email, file storage, payment processing, accounting and error monitoring. They may only use it to provide their service to us.
• Professional advisers, such as accountants, lawyers and insurers, where needed.
• Authorities, where we are required by law or need to protect our rights, our users or the public.
• A buyer or successor, if our business or part of it is sold or restructured, under the same protections as this policy.

8. International transfers

Some of our service providers store or process information outside the UK. Where that happens, we make sure the transfer is covered by appropriate safeguards, such as a UK adequacy decision, the UK International Data Transfer Agreement or Addendum, or equivalent protections.

9. How long we keep it

We keep personal information only as long as we need it for the purposes above:

• Enquiries that don’t lead to work: up to 2 years after our last contact.
• Client and contract records: for the life of the relationship plus 6 years, to meet tax and legal requirements.
• Account data in our apps: while your account is active, then deleted or anonymised within a reasonable period after you close it.
• Server and security logs: normally no more than 12 months.

Backups are overwritten on a rolling cycle, so deleted information may persist in them for a short time.

10. How we protect it

We use appropriate technical and organisational measures to protect personal information, including encryption in transit, access controls, strong authentication, regular updates and backups. No system is completely secure, but if a breach affects your information in a way that poses a risk to you, we will tell you and the regulator where the law requires it.

11. Your rights

Under UK data protection law you have the right to:

• ask for a copy of the personal information we hold about you;
• ask us to correct information that is wrong or incomplete;
• ask us to delete your information;
• ask us to restrict how we use it;
• object to us using it on the basis of legitimate interests, and to direct marketing at any time;
• ask us to transfer information you gave us to you or another organisation;
• withdraw consent, where we rely on it.

To use any of these rights, email hello@wodhouse.co.uk. We may need to confirm your identity first. We’ll respond within one month, and there’s normally no charge.

12. Children

Our websites and services are not aimed at children under 13 and we do not knowingly collect their information. If you think a child has given us personal information, please contact us and we will delete it.

13. Links to other sites

Our websites and apps may link to sites and services run by others. We’re not responsible for how they handle your information, so please read their privacy notices.

14. Changes to this policy

We may update this policy as our services change. The date at the top shows when it was last revised. If a change significantly affects how we use information you’ve already given us, we will tell you directly where we can.

15. Complaints

If you’re unhappy with how we’ve handled your information, please talk to us first at hello@wodhouse.co.uk. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.