Privacy notice
Controller: gtl works trading as spendguard (“SpendGuard”, “we”, “us”). England and Wales. Company number: none (sole trader). A limited company may be formed later. ICO registration number to be added when registered, if required. Stripe UK setup still being confirmed by Gary.
This notice explains how SpendGuard (“we”, “us”) handles personal data for the £99 Software Cost Audit and related enquiries, in plain language under the UK GDPR and the Data Protection Act 2018.
We do not rely on California CCPA, US CAN-SPAM, or other non-UK regimes as our primary privacy/marketing framework.
1. What we collect
Depending on how you use the service, we may collect:
| Category | Examples |
|---|---|
| Contact & order | Name, work email, organisation name, billing/contact details you provide |
| Inventory content | Software names, vendors, seats/licences, spend figures you send us |
| Payment metadata | Payment status, amount, Stripe customer/payment references (not full card numbers) |
| Communications | Messages you send us about delivery, refunds, or questions |
| Technical (if our site logs them) | Basic server or analytics data such as IP address, browser type — only if enabled; none assumed at draft stage |
We do not collect passwords, MFA codes, API keys, or credentials, and we do not ask for access to your accounts.
2. Why we use it (purposes & lawful bases)
| Purpose | Lawful basis (typical under UK GDPR) |
|---|---|
| Take payment and deliver the Audit | Contract |
| Communicate about delivery, human-approved recommendations, and support | Contract / legitimate interests |
| Process refunds where applicable | Contract / legal obligation |
| Improve our service using aggregated or non-sensitive feedback | Legitimate interests |
| Meet legal/accounting duties (including records HMRC may expect) | Legal obligation |
| Electronic marketing to individuals (if ever used) | Consent or soft opt-in where PECR allows — see §8 |
We process inventory data to produce your audit. Inventory is mainly business information; where it includes personal data, we use it only as needed to deliver the service.
3. Who we share it with
- Stripe (Stripe UK / Stripe Payments UK where applicable) — processes card payments. We do not receive or store your full card number.
- Service providers we use for email, storage, or report delivery (to be listed when tooling is finalised) — only as needed to provide the service: [PROVIDERS TO CONFIRM].
- Legal, tax, or regulatory bodies if required by UK law.
We do not sell your personal data. We do not use your credentials (we never hold them).
4. International transfers
If a provider stores data outside the UK, we will use appropriate UK-approved safeguards (e.g. UK adequacy regulations or the UK International Data Transfer Agreement / Addendum) and will update this notice when providers are confirmed: [PROVIDERS / TRANSFER DETAILS TO CONFIRM].
Solicitor flag: confirm transfer tools once the provider list is final.
5. Retention
| Data | Typical retention |
|---|---|
| Order, payment references, invoice records | As required for UK tax/accounting (often up to 6 years) — verify with a UK accountant |
| Inventory and audit working files | Kept long enough to deliver the report and handle follow-ups; then deleted or anonymised on a schedule [RETENTION PERIOD TO CONFIRM] |
| Support emails | Reasonable period for dispute handling, then deleted |
| Marketing preferences / suppression | Kept as needed to honour opt-outs under PECR |
Exact periods will be confirmed before go-live.
6. Your rights (UK GDPR / Data Protection Act 2018)
You can ask us to:
- Access your personal data
- Correct inaccurate data
- Erase data (where applicable)
- Restrict or object to certain processing
- Receive a portable copy (where applicable)
- Withdraw consent (where we rely on consent)
To exercise rights: hello@getspendguard.co.uk
You may also complain to the Information Commissioner’s Office (ICO) — ico.org.uk. We would appreciate the chance to resolve concerns first.
7. Security
We take reasonable technical and organisational steps to protect data. We never request passwords, MFA, or API keys. The Audit is inventory-only; we do not log into your tools.
8. Electronic marketing (PECR)
If we send marketing emails or similar electronic marketing to individuals, we will follow the UK Privacy and Electronic Communications Regulations (PECR) as well as UK GDPR. In practice that means:
- No bought cold-email lists presented as “consent”
- Clear identity of the sender and a simple unsubscribe / opt-out
- Rely on consent or, where lawful, the PECR soft opt-in for similar products/services to existing customers — solicitor/marketing compliance flag before any outbound campaign
- Business-to-business corporate subscriber rules differ from individual subscribers; Scout/outbound must use a PECR-safe policy before sends
Transactional messages about your paid Audit (receipts, delivery, refunds) are not treated as marketing.
9. Children
SpendGuard is aimed at UK SMBs and business buyers. We do not knowingly offer the service to children.
10. Changes
We may update this notice. The “Last updated” date will change. Material changes will be reflected on this page before publish.
11. Contact
Privacy questions: hello@getspendguard.co.uk
Controller details: gtl works trading as spendguard
ICO registration: [ICO NUMBER TO CONFIRM — do not invent]
Draft only. Not published. No fake ICO number or address. Confirm retention/VAT record-keeping with a UK accountant; PECR outbound and transfer clauses with a UK solicitor before go-live campaigns.