Privacy

Who we are

Cliff Software Solutions Ltd is the data controller for the personal information described in this notice. The company is Registered in England and Wales, company number 09959705. The registered office is 3 Shrieves Walk, Sheep St, Stratford-upon-Avon CV37 6GJ.

Questions about this notice, or about how we handle personal information, go to hello@cliffsoftware.co.uk.

What this notice covers

This notice covers personal information Cliff Software Solutions collects through this website and in the ordinary course of running the business. In practice that means enquiries, and correspondence with clients and prospective clients.

It does not cover personal data held inside a client's own systems that we work on during an engagement. There the client is the controller and we act on their instructions. There is a section on that below.

Information we collect

When you contact us

If you use the contact form we collect your name, your email address, and whatever you choose to write in the message. If you email us directly, or message us on LinkedIn, we hold that correspondence and the contact details in it.

When you visit this site

The site is served by Cloudflare, which records technical request data including IP address, the time of the request, the page requested, and basic browser information. This is standard server logging. It is used to deliver the site and to protect it from abuse, not to build a profile of you.

Cookies and analytics

This site uses Google Analytics to understand how people find and use it. Google Analytics sets cookies in your browser and records a randomised identifier, the pages you look at, roughly where you are, worked out from your IP address, and basic device and browser information. Google Ireland Limited processes this for us as our processor.

Analytics cookies are set only if you agree to them. You can decline, and you can change your mind at any time using cookie settings here or in the footer of any page. The site works exactly the same either way. We run no advertising trackers and no social media pixels, and the site sets no other cookies of its own. Cloudflare may set strictly necessary cookies as part of protecting the site from automated traffic, which under the Privacy and Electronic Communications Regulations do not require consent.

You can also opt out of Google Analytics across every site you visit using Google's browser add on.

Why we use it, and our lawful basis

Under the UK GDPR there has to be a lawful basis for each thing we do with personal information. Ours are as follows.

• Replying to an enquiry. Legitimate interests. The interest is in answering people who approach the business about work, which we could not do otherwise.
• Carrying out an engagement. Performance of a contract where you are the client, or legitimate interests where the contract is with your organisation rather than with you personally.
• Meeting accounting and tax obligations. Legal obligation.
• Keeping this site available and secure. Legitimate interests, in running a site that stays up and is not abused.
• Understanding how the site is used. Consent. Analytics cookies are set only after you agree to them, and you can withdraw that at any time.

We do not use personal information for automated decision making or profiling. We do not sell it, and we do not share it for anyone else's marketing.

Who we share it with

A small number of service providers process personal information on our behalf, each under a contract that limits what they may do with it.

• Cloudflare. Hosting, content delivery and security for this site.
• Google. Delivery of messages sent through the contact form.
• Google. Analytics, where you have agreed to analytics cookies.

Beyond that we share personal information only where the law requires it, or where we need professional advice and are ourselves bound by confidentiality.

Where your information is held

Our providers operate internationally, so some information is processed outside the United Kingdom. Where that happens the transfer is covered either by UK adequacy regulations for the country concerned, or by the UK International Data Transfer Addendum to the European Commission's standard contractual clauses.

How long we keep it

• Enquiries that do not lead to work are kept for 12 months from the last contact, then deleted.
• Correspondence and records relating to an engagement are kept for seven years after the engagement ends. That is the period needed for tax and accounting purposes and for professional indemnity cover.
• Server logs are held by Cloudflare for a short period as part of its standard service, then discarded.
• Analytics data is retained by Google for 14 months from your last visit, then deleted automatically.

Your rights

Under UK data protection law you can ask us to:

• give you a copy of the personal information we hold about you
• correct anything that is wrong or incomplete
• delete information where we have no continuing reason to hold it
• restrict how we use it, or object to us using it where we are relying on legitimate interests
• provide it in a portable form, where that right applies

To exercise any of these, email hello@cliffsoftware.co.uk. We will respond within one month. There is no charge unless a request is clearly unfounded or excessive. Where we rely on consent for something you can withdraw it at any time, and that does not affect anything done before you withdrew it.

Complaints

If you are unhappy with how we have handled your information, tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection.

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
Helpline: 0303 123 1113.
ico.org.uk

Personal data in client work

During an engagement we sometimes have access to personal data held in a client's systems, for example when reviewing a platform or working on integration code. There the client is the controller and Cliff Software Solutions is a processor. We act only on the client's documented instructions, under the data processing terms in the engagement contract. We do not use that data for any purpose of our own, access is limited to what the work requires, and it ends when the engagement ends.

Changes to this notice

We update this notice when what we do changes. This version is dated 05/09/2026.