Privacy Policy

GRAYBYTE LIMITED is the controller of the personal data described in this policy. We are registered in England and Wales under company number 17400790, with our registered office at 128 City Road, London, United Kingdom, EC1V 2NX.

We trade as TradeFlow and operate tradeflowsync.com. For any privacy question, contact hello@tradeflowsync.com.

This policy explains how we handle personal data when you visit our website, get in touch, or work with us as a client. It is written to meet the UK GDPR and the Data Protection Act 2018.

When you contact us. Your name, email address, company, and whatever you choose to tell us about your project.

When you become a client. Contact details for the people we work with, billing details, and records of the engagement including correspondence and invoices.

If you hold an account. Your email address, authentication credentials in hashed form, and basic account activity such as sign-in times.

When you visit the site. Aggregated, privacy-friendly analytics covering pages viewed, referrer, approximate country and device type. Our analytics provider does not set advertising cookies and we do not use the data to identify individual visitors.

Client system data. While delivering an engagement we may be given access to systems that contain personal data belonging to your business. We access it only to carry out the work. For that data you are the controller and we act as your processor under a separate written data processing agreement.

We do not sell personal data, and we do not use it for automated decision-making or profiling.

We use a small number of service providers who process data on our behalf under contract:

We may also share data with our professional advisers, or where we are required to by law. We do not share your data with anyone else for their own purposes.

Some of our providers process data outside the UK. Where that happens, we rely on UK adequacy regulations or on the International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses, together with appropriate safeguards, so your data keeps essentially the same protection it has in the UK.

• Enquiries that do not become engagements: up to 12 months from last contact.
• Client and engagement records: for the duration of the relationship and 6 years afterwards, in line with UK limitation periods.
• Financial and tax records: 6 years from the end of the accounting period they relate to.
• Account data: for as long as the account is active, then deleted on request.
• Aggregated analytics: retained in non-identifying form.

We use encryption in transit, access controls, hashed credentials and database-level access rules so that accounts can only reach their own data. We limit access to personal data to those who need it to do their job.

No system is completely secure. If a breach affects your rights and freedoms, we will notify the Information Commissioner's Office and, where required, you.

Under the UK GDPR you have the right to:

• ask what personal data we hold about you and get a copy
• have inaccurate data corrected
• ask us to delete data where there is no good reason to keep it
• ask us to restrict how we use it
• receive data you gave us in a portable format
• object to processing carried out on the basis of legitimate interests
• withdraw consent at any time, where we rely on consent

To exercise any of these, email hello@tradeflowsync.com. We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive.

If we hold data about you as a processor for one of our clients, please contact that client directly — we will refer your request on to them.

We use cookies that are strictly necessary to operate the site, including keeping you signed in if you hold an account. These cannot be switched off without breaking the site.

Our analytics are privacy-friendly and do not use cookies to track you across websites or build an advertising profile. We do not run third-party advertising or marketing trackers.

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the UK supervisory authority:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF — ico.org.uk

We may update this policy from time to time. We will post the revised version here and update the date at the top. Where a change materially affects you, we will make reasonable efforts to tell you directly.

GRAYBYTE LIMITED, 128 City Road, London, United Kingdom, EC1V 2NX — or email hello@tradeflowsync.com.