Privacy notice
Last updated 1 September 2026
This explains what we do with personal information when you contact us, send us a brief, or become a client. TCFIRM LTD is the data controller. Company No. 16513044, registered office 200 Knutsford Road, Warrington, England, WA4 1AU.
What we collect
When you send us a brief: your name, business name, email, phone number, what you do, the areas you cover, your services and prices, and anything else you type into the form.
When you become a client: the above, plus your logo, photographs, domain details and payment records.
When you pay: Stripe handles the card transaction. We receive the amount, status, billing name and email. We never see or store your full card number.
Why we have it, and our legal basis
- To reply to you and build your project — because we're taking steps to enter into, or perform, a contract with you
- To keep records of payments and invoices — because the law requires us to
- To operate and improve the service — because we have a legitimate interest in running the business securely and effectively, balanced against your privacy
We don't send marketing emails. If that ever changes, we'll ask you first and you'll be able to opt out at any point.
Who else sees it
Only the services we need to run the business:
- Supabase — securely stores website briefs, editable content and payment records
- Vercel — hosts and delivers the website
- Resend and our email provider — deliver service emails and correspondence
- Stripe — processes payments when an online payment link is used
Some of these are outside the UK. Where that happens, transfers are covered by the safeguards those providers have in place, such as the UK International Data Transfer Agreement.
We do not sell your data. We do not share it with advertisers. We do not add you to a marketing list you did not ask to join.
How long we keep it
- Enquiries that don't become projects — up to 12 months, then deleted
- Client project files and correspondence — for the length of the working relationship and 12 months after
- Payment and invoice records — six years, because HMRC requires it
Your rights
Under UK GDPR you can ask us to:
- Show you what we hold about you
- Correct anything that's wrong
- Delete it, where we're not required to keep it
- Stop or limit how we use it
- Send it to you, or to someone else, in a portable format
- Object to us using it on legitimate-interest grounds
Message us on WhatsApp or email tcfcommission@gmail.com. We'll respond without undue delay and normally within one month.
If you're unhappy with how we've handled it, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Systems we build for clients
When we host a booking, enquiry or operational system for a client, the client will normally be the controller for its customer data and TCF will normally act as processor under the written service scope. The exact roles and instructions must be confirmed for each implementation.
You'll need your own privacy notice covering it. We'll help you understand what your system collects so you can write one accurately.
Cookies
This website does not set tracking or advertising cookies. Its fonts are hosted with the website rather than requested from Google in your browser. Supabase Auth sets only the cookies needed when an approved TCF administrator signs in.
Changes
If we change this notice, the date at the top changes. If the change is significant and we hold your details, we'll tell you.