This page explains how Trendfingers Ltd handles personal data under the UK GDPR, the Data Protection Act 2018 and, where it applies, the EU GDPR. The Privacy Policy describes what we collect through this website. This page is about the legal framework around it - including the part that matters most to our clients: the difference between the data we control and the data we merely process for them.
- Registered name
- Trendfingers Ltd
- Registered in
- England and Wales
- Company number
- 12786857
- Registered office
- 35 Goldfinch Drive, Sandy, Bedfordshire, SG19 2SA, United Kingdom
1. We act in two different roles
Confusing these two roles is the most common mistake we see in measurement projects, so we state ours plainly.
1.1 As a controller
We are the controller for personal data we decide to collect for our own purposes: enquiries sent through this website, our business correspondence, supplier and client contact records, and our own accounting records. We decide why and how that data is processed.
1.2 As a processor
When we design, build or operate measurement infrastructure for a client - a server-side container, a conversion API integration, a CRM attribution pipeline - the client is the controller of the end-user data flowing through it, and we are a processor acting on their documented instructions. We do not decide what that data is used for, we do not use it for our own purposes, and we do not combine it with anyone else's data.
2. Lawful bases we rely on as a controller
| What we process | Why | Lawful basis |
|---|---|---|
| Name, email address, company and message from the enquiry form | To read your enquiry and reply to it | Legitimate interests (Art. 6(1)(f)) - responding to someone who contacted us about our services. If it leads to an engagement, performance of a contract (Art. 6(1)(b)). |
| Analytics about pages viewed and traffic sources | To understand which content is read | Consent (Art. 6(1)(a)) for the cookies, as required by PECR regulation 6 |
| IP address and request data in server logs | Security, abuse prevention and troubleshooting | Legitimate interests (Art. 6(1)(f)) - keeping the service available and secure |
| reCAPTCHA signals on form submission | Blocking automated spam | Legitimate interests (Art. 6(1)(f)) - the form is unusable without it |
| Client contact details, contracts and invoices | Delivering the engagement and meeting our statutory accounting duties | Performance of a contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) |
We do not process special category data, and we do not carry out automated decision-making or profiling that produces legal effects for anyone.
3. Sub-processors and recipients
These are the third parties that may process personal data on our behalf in connection with this website and our own business operations:
| Provider | What it does | Where |
|---|---|---|
| Google Ireland / Google LLC | Google Analytics 4, reCAPTCHA, Google Fonts | EU and United States |
| Google LLC (Gmail / Workspace) | Transport and storage of enquiry emails and business correspondence | EU and United States |
| Our hosting provider | Serving this website; web server logs | European Union |
We do not sell personal data, and we do not share it with data brokers or advertising networks.
4. International transfers
Some of the providers above are based in, or route data through, the United States. Where personal data leaves the United Kingdom we rely on one of the following:
- the UK extension to the EU - US Data Privacy Framework, where the recipient is certified under it;
- the International Data Transfer Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment;
- UK adequacy regulations, where the destination country is covered - this includes Hungary and the rest of the EEA.
5. How long we keep things
| Data | Retention |
|---|---|
| Enquiries that do not become an engagement | 24 months from the last contact, then deleted |
| Client records, contracts and correspondence | For the engagement, then 6 years after it ends (limitation period and audit) |
| Invoices and accounting records | 6 years from the end of the accounting period, as required by the Companies Act 2006 |
| Web server logs | Up to 12 months |
| Analytics data in Google Analytics 4 | 14 months (the retention period set on the property) |
6. Your rights
Under the UK GDPR you have the right to:
- be informed about how your data is used - that is what this page and the Privacy Policy are for;
- access a copy of the personal data we hold about you;
- rectification of data that is inaccurate or incomplete;
- erasure of your data, where we have no overriding reason to keep it;
- restrict our processing while a dispute about accuracy or legitimate interests is resolved;
- data portability, for data you gave us under consent or contract;
- object to processing based on legitimate interests, and to direct marketing at any time;
- withdraw consent at any time, where consent is the basis we rely on.
6.1 How to exercise them
Email privacy@trendfingers.com. We reply within one month. If a request is complex we may extend that by up to two further months, and we will tell you within the first month if that happens. There is no charge. We may ask you to confirm your identity before we release personal data.
7. Security
We apply measures appropriate to the risk, including transport encryption (TLS) on this website and on our email, access control on a least-privilege basis, multi-factor authentication on the accounts that hold personal data, secrets kept outside the web root and outside version control, and separation between client environments. No system is perfectly secure, and we do not claim otherwise.
8. Personal data breaches
If a breach is likely to result in a risk to people's rights and freedoms, we notify the Information Commissioner's Office within 72 hours of becoming aware of it, and we notify affected individuals without undue delay where the risk is high. Where we are a processor, we notify the client controller without undue delay so that they can meet their own deadline.
9. Complaints
Please raise anything with us first at privacy@trendfingers.com. You also have the right to complain directly to the UK supervisory authority:
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
ico.org.uk/make-a-complaint
If you are in the European Union, you may instead complain to the supervisory authority of the member state where you live or work.
10. Changes
We update this page when our processing, our sub-processors or the law change, and we change the date at the top. Material changes to how we handle client data are notified to clients under the DPA.