Privacy notice

Who is responsible

The controller is Mathew Glendenning, trading as Proof Systems, in the United Kingdom.  Contact mat@proofsystems.co.uk for privacy questions, rights requests or complaints.

Founding diagnostic applications

The application collects your name, business email, company, role or decision-making authority, a general description of the workflow and desired outcome, optional approximate hours lost, and your consent to contact.  It is used only to assess the application and respond about the founding diagnostic.  Please do not submit customer names, passwords, confidential documents, detailed financial data, special-category information or other sensitive personal data.

Paid B2B enquiries and client work

If you enquire about paid work, or become a client, I may also keep the information needed to qualify the enquiry, prepare a quote or contract, deliver the work, provide support, handle a complaint and keep required business, legal and tax records.

That typically includes:

• contact and company details, your role and correspondence;
• the general workflow, scope and commercial information you choose to share;
• quote, contract, invoice and payment-administration records;
• working files, notes and handover material created for the engagement;
• complaint, claim, security and statutory records where they arise;
• a recording or transcript only if that is separately agreed for a particular conversation.

I am the controller of the personal information I keep to run that business relationship.  If an engagement later involves processing other people’s personal data on your instructions, that would be agreed separately and is not the default.

Why the information is used

I use personal information only for the purpose I collected it, or a closely related purpose you would reasonably expect.

• Founding diagnostic applications: your consent to use the details to assess the application and contact you about it.
• Where you yourself are the contracting party, such as a sole trader: taking steps you have asked for before a contract, and performing that contract.
• Where you act for a limited company or another separate business entity: my legitimate interests in responding to the enquiry and in administering, delivering and supporting the B2B work, where that use is necessary and those interests are balanced against your rights.
• Operational and security records, and complaint handling: my legitimate interests in running a careful B2B practice, keeping the work secure and dealing with concerns.  Those interests are balanced against your rights and do not rely on consent as a blanket permission.
• Invoices, tax and other required records: a legal obligation where the law requires me to keep them.
• Optional extras such as recording a conversation, producing a transcript, using AI on client material, or any contact beyond the original purpose: only with a separate permission or other clear lawful basis for that specific use.

Website contact consent is not permission to record a conversation, produce a transcript, put your material into an AI service or reuse evidence publicly.

What is not collected by default

Ordinary engagements do not involve special-category data, criminal-offence data, significant automated decisions about you, or standing access to your systems.  Please do not send that kind of information unless we have agreed a specific, controlled arrangement.

Where system access is needed, it is granted to named people, time-bounded and reauthorised rather than left standing.

How it is handled

Applications are processed through Netlify Forms and may be delivered to Proof Systems by email using Google Workspace.  Access is limited to Mathew Glendenning and the service providers needed to receive, store and administer the relevant record.  Information is not sold or used for unrelated marketing.

I also keep restricted business records of enquiries, contracts, invoices, delivery, support and complaints.  Direct email enquiries to mat@proofsystems.co.uk are handled in the same way as other correspondence.

I may use AI tools in my own work.  Client material is not put into an AI service unless the engagement and applicable safeguards permit it.

Netlify Forms and Google Workspace may process information outside the United Kingdom.  Netlify’s published privacy and data-processing material currently identifies the UK Extension to the EU-US Data Privacy Framework and contractual clauses as applicable transfer mechanisms.  Google Workspace’s published Cloud Data Processing Addendum incorporates UK contractual safeguards for restricted transfers.  I do not claim a particular country, contracting entity or account configuration beyond that published material.  Email mat@proofsystems.co.uk if you want the current provider and transfer details.

This website does not use advertising or analytics cookies, and I have not added tracking scripts.  The hosting or form service may set a strictly technical cookie needed to operate the site.  I have not published a full cookie list because I do not have a verified provider list to quote.

How long it is kept

I keep information only while a stated purpose continues, then review it and delete it when that purpose ends, unless a hold or another continuing purpose applies.  Deletion is controlled and approval-gated.  I do not promise automatic deletion.

• Unprogressed enquiries and founding applications are reviewed and deleted after 90 days unless a hold or continuing purpose applies.
• Recordings are deleted within 14 days after checked notes exist.
• Transcripts are deleted within 90 days after a checked summary or handover exists.
• Client working files are reviewed 12 months after handover or termination and then deleted, or deliberately retained for a recorded reason.
• Contract, invoice, complaint, claim, security and statutory records may be retained longer where required.

Your rights

UK data-protection law gives you rights in the personal information I hold.  You can usually ask for a copy, ask me to correct inaccurate information, object to some uses, ask me to restrict how I use it, or ask for it to be deleted.  Where I use consent, you can withdraw that consent.  Where the law allows, you can also ask for information you provided to be passed to you or another organisation in a reusable form.

These rights can depend on the circumstances and on the lawful basis I am using.  There is not an absolute right to deletion where I still need the record for a contract, a legal duty, a complaint, a claim or another continuing purpose.

Email mat@proofsystems.co.uk to make a request.  You do not need legal language.  I may need to check your identity in a proportionate way before responding.

Complaints

If you are unhappy with how I have used your information, email mat@proofsystems.co.uk.  I will acknowledge the complaint and look into it.  I aim to acknowledge it within 30 days and to tell you the outcome without undue delay.

You also have the right to complain to the UK Information Commissioner’s Office.  Use the official ICO complaints page: https://ico.org.uk/make-a-complaint/.