Privacy policy.

Who we are

This website is run by Truffle, a trading name of Truffle Technology Ltd, a company registered in Scotland (company number SC904506), with its registered office at Park Lane, Whitburn, West Lothian, EH47 8NJ. For the information described here, we’re the data controller. You can contact us about anything in this policy at [email protected].

We’re registered with the Information Commissioner’s Office. Our registration number is ZC269336.

What we collect

• When you contact us: your name and email address, and anything else you choose to give us, such as your phone number, business name and message. We also record the page you sent it from, and your IP address to help stop spam.
• When you visit our websites: your IP address and basic technical details, which our hosting and security services process to deliver the site and keep it safe. Our server logs are deleted after 30 days.
• Visitor numbers: we use Cloudflare Web Analytics to count visits and see which pages are popular. It doesn’t use cookies, doesn’t follow you across other websites, and we only keep daily totals.
• If you’re a client: the details we need to provide our services and bill you, such as your name, email address and business details, and, if you use our client portal, your login details and the requests you send us.

Why we use it, and our lawful basis

• Replying to enquiries: our legitimate interest in responding to people who contact us.
• Providing our services: to perform our contract with you, or to take the steps you ask for before entering into one.
• Running and protecting our websites, including security and visitor numbers: our legitimate interest in keeping our websites working, safe and useful.
• Keeping business and tax records: to meet our legal obligations.

We don’t use your information for marketing unless you’ve asked us to, and we don’t make decisions about you by automated means.

How long we keep it

• Enquiries: 12 months, unless you become a client.
• IP addresses stored with enquiries: 30 days.
• Server logs: 30 days.
• Client records: for as long as you’re a client, then for six years afterwards, as the law requires for business and tax records.

Who we share it with

We don’t sell your information. We use a small number of trusted services to run our business, each acting on our instructions:

• Hetzner Online, in Germany, which hosts our websites and stores our data.
• Cloudflare, which delivers and protects our websites and provides our visitor numbers.
• Postmark, in the United States, which sends our emails, such as notifications of new enquiries, portal invitations and booking confirmations.
• Google Fonts and Fontshare, which supply the typefaces our websites use. Your browser requests the fonts from them, which shares your IP address with them.
• Stripe, if you’re a client, which handles payments. We don’t see or store your full card details.

We may also share information if the law requires it.

Information leaving the UK

Some of these services are based outside the UK, including in the European Economic Area and the United States. Where that happens, we rely on the UK’s adequacy regulations, or on safeguards in our contracts with them, such as the UK’s international data transfer agreement or standard contractual clauses.

If we’ve written to your business

We find businesses that might want our help from public records, mainly Companies House, which lists every company’s name, registered office and directors. If we write to your business, we use:

• Your business’s details: its name, address, website and what it does.
• A director’s name and role, from Companies House, so the letter reaches the right person. We don’t collect directors’ dates of birth or home addresses.
• A work email address, only if it’s published for business enquiries, and only to email limited companies. We don’t email sole traders or partnerships unless they’ve asked us to.

Our lawful basis is our legitimate interest in telling businesses about services that may help them. We keep these details while we’re in touch, and delete them if you’re not interested, unless you ask us not to contact you again, in which case we keep just enough to make sure we don’t.

Concept websites: our letter may include a link to a private concept of a new homepage for your business. When it’s opened, we record the date and time, the kind of device, and the IP address, which we delete after 30 days. We also record how the concept is used, such as the pages viewed, how far down they’re read and whether the booking panel is opened, so we can improve it. This is linked to the visit, not to you by name. If you book a call or send a message from the concept, we keep your name and the phone number or email you give us, to arrange it. No cookies are used other than one that keeps the concept open for you.

To stop hearing from us, email [email protected] or write to us. We’ll stop straight away, and won’t contact your business again.

Websites we run for our clients

We build and host websites for other businesses. When you contact one of them through their website, that business is the data controller for your information, and we process it on their behalf under a written agreement. Their own privacy policy explains how they use it, and you should contact them about it first.

Your rights

You have the right to ask for a copy of the personal information we hold about you, and to ask us to correct it, delete it, restrict how we use it, or send it to you or someone else in a portable format. You can also object to us using it where we rely on our legitimate interests. Where we rely on your consent, you can withdraw it at any time.

To use any of these rights, email [email protected]. We’ll reply within one month. If you’re unhappy with how we’ve handled your information, please tell us, and you can also complain to the Information Commissioner’s Office at ico.org.uk.

Changes to this policy

If we change how we use your information, we’ll update this page and the date at the top.