Privacy policy

1. Who we are and what this policy covers

This website is operated by FinHub Digital Ltd ("FinHub", "we", "us"). FinHub is a trading name of FinHub Digital Ltd, a private limited company registered in England and Wales under company number 17455964. Registered office: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.

This policy explains how we handle personal data in connection with this website, the enquiries we receive through it or by email, and our business communications. FinHub Digital Ltd is the controller of the personal data described here under the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018 and, where it applies, the EU General Data Protection Regulation ("EU GDPR"). Data we handle inside a client engagement, for example the contents of your CRM, analytics or advertising accounts, is governed by the written agreement for that engagement, as explained in section 9. You can reach us about anything in this policy through our contact form.

2. The short version

• This website sets no cookies and runs no advertising or tracking technologies. It stores nothing in your browser.
• The only personal data we receive is what you choose to send us, through the contact form or by email, plus publicly available business information we may consult when qualifying an enquiry.
• We use it to respond to you, scope and deliver the services you ask about, and send you relevant business communications, which you can opt out of at any time.
• We never sell personal data and never share it with advertisers or data brokers.
• You can ask us at any time what we hold about you, or ask us to correct or delete it.

3. The personal data we collect

Identity and contact data. Your name, work email address, company name, and your role or title if you share it.

Business profile data. What you tell us about your business and the work you need: the services you are interested in, a budget range, your description of the project, and any details about your products, licences, current suppliers, platforms or target markets that you choose to include.

Correspondence. The content of emails, messages and calls between you and us, and our notes of them.

Technical data. When you submit the contact form, our server holds your IP address briefly, in memory only, to limit how many submissions can be sent from one address in a short period. Our hosting provider also records basic technical data about visits, such as IP address, browser type and request timestamps, in server logs used for security and for operating the service. We do not use this data to identify visitors.

Publicly available business data. When qualifying an enquiry we may consult public sources such as company registers, your official website, professional profiles, and sanctions or watch lists, and record what we find.

We do not collect special categories of personal data (such as health, biometric or political data) or data relating to criminal convictions, and we ask that you do not send us any.

4. How we collect it

• Directly from you, when you complete the contact form, email us, or speak with us.
• Automatically, through the rate limiting and server logs described above.
• From public sources, as described in section 3.

5. Cookies and tracking

This website does not set cookies and does not include advertising pixels, social media buttons or fingerprinting techniques. It does not use browser storage either. If we switch on website analytics, we use a cookieless tool that produces only aggregate statistics and stores no identifier on your device, and we say so in our cookie policy. If we ever add a tool that sets non-essential cookies, nothing is set until you accept it through a consent banner.

6. How we use personal data, and our legal bases

We use personal data for the following purposes. The legal basis for each under the UK GDPR and the EU GDPR is noted.

• Responding to and qualifying your enquiry, and preparing a diagnosis, scope or proposal you request: taking steps at your request before entering into a contract, and our legitimate interest in running our business.
• Delivering services under an engagement, including software, search, marketing and advisory work: performance of a contract with your business.
• Managing an ongoing business relationship, including invoicing and record-keeping: performance of a contract, and compliance with legal obligations.
• Operating and securing the website, including rate limiting the contact form: our legitimate interest in running a safe and reliable service.
• Sending relevant business communications, as described in section 7: our legitimate interest in promoting our services to business contacts, or your consent where the law requires it.
• Establishing, exercising or defending legal claims, and complying with law: our legitimate interests and our legal obligations.

7. Business communications and marketing

If you have enquired about our services, we may occasionally email you about services and developments relevant to your enquiry. We send business-to-business communications only, we do not run consumer marketing, and we do not share your details with third parties for their marketing.

You can opt out at any time by replying to any message or telling us through our contact form, and we will stop promptly. Opting out does not affect emails we need to send to handle an active enquiry or an existing engagement.

8. Who we share personal data with

Service providers (processors). Providers who process data on our behalf and on our instructions:

• Netlify (United States): website hosting, the serverless function behind the contact form, and server logs.
• Resend (United States): delivery of contact form submissions to our mailbox.
• Formspree: delivery of contact form submissions on deployments that use it instead of Resend.
• Plausible (European Union): cookieless, aggregate website analytics, only if switched on.
• Proton Mail (Switzerland): the mailbox where your enquiry is read and answered.

Platforms used in your engagement. When we deliver work for you, we may share relevant details with the platforms and suppliers involved, such as hosting, advertising, analytics or CRM providers, with your knowledge. See section 9.

Professional advisers and insurers. Lawyers, accountants, auditors and insurers, where needed and under duties of confidentiality.

Authorities. Regulators, law enforcement and other authorities, where the law requires or permits it.

Business transfers. If we sell, merge or reorganise our business or its assets, personal data may be transferred to the parties involved under appropriate confidentiality protections, and this policy will continue to apply to it.

We do not sell personal data, and we do not share it with advertisers or data brokers.

9. Client engagements and third-party platforms

When we build software, run campaigns or set up analytics for a client, that work happens in accounts the client owns: advertising platforms such as Google, Meta and LinkedIn, analytics tools, CRMs, hosting providers and similar services. Those platforms process data as independent controllers under their own privacy policies and terms, which the client contracts into directly, and we do not control their practices. Where we handle personal data on a client's behalf inside such an engagement, for example a client's customer records, we act as the client's processor under the data processing terms in the engagement agreement, and the client remains responsible for the lawful basis and the notices given to the people concerned. We remain the controller of our own records of the engagement and of our relationship with the client.

10. International transfers

We are a company registered in England and Wales, and we handle personal data in the United Kingdom. Some of our service providers process data in the United States, the European Union and Switzerland. Where personal data protected by the UK GDPR is transferred to a country not covered by UK adequacy regulations, we rely on appropriate safeguards such as the UK International Data Transfer Agreement, the UK Addendum to the European Commission's Standard Contractual Clauses, or a provider's certification under the UK Extension to the EU-US Data Privacy Framework. Where the EU GDPR applies, we rely on the Standard Contractual Clauses or the EU-US Data Privacy Framework in the same way. You can request more information about the safeguards applied to your data by contacting us.

11. How long we keep personal data

• Enquiries that do not lead to an engagement: typically deleted or anonymised within 24 months of our last contact with you.
• Client relationship records: kept for the duration of the engagement and typically up to 6 years after it ends, to meet record-keeping obligations and handle potential legal claims.
• Rate-limiting records: held in server memory for no more than ten minutes and never written to disk by us.
• Server logs: kept for short rolling periods managed by our hosting provider.

We keep personal data no longer than necessary for the purposes described in this policy, and you can ask us to delete your details earlier at any time, which we will do unless the law requires us to keep them.

12. Automated decision-making

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. The contact form only checks that required fields are complete and filters automated spam; it does not make any decision about you, and every enquiry is reviewed by a person.

13. Security

All traffic to this website is encrypted in transit. Form submissions are validated on the server and protected against automated abuse. Access to enquiry data is limited to the people who need it to respond to you, protected by access controls and multi-factor authentication, and we use reputable providers with established security practices. If a personal data breach occurs, we will notify affected individuals and the relevant authorities where the law requires it. No method of transmission or storage is completely secure, but we take the protection of your data seriously.

14. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy;
• correct inaccurate or incomplete data;
• delete your data (the right to be forgotten);
• restrict or object to our processing, including objecting to direct marketing at any time;
• receive your data in a portable format; and
• withdraw consent where processing is based on it, without affecting processing before withdrawal.

To exercise any of these rights, contact us through our contact form. We do not charge for handling a request unless it is manifestly unfounded or excessive, we may ask you to verify your identity, and we respond within one month, extendable where a request is complex.

You also have the right to complain to a data protection supervisory authority. In the UK that is the Information Commissioner's Office at ico.org.uk. If you are in the EU, you can complain to the supervisory authority in the country where you live or work. We would appreciate the chance to address your concern first.

15. Business audience

Our website and services are intended for businesses and their representatives. They are not directed at children, and we do not knowingly collect personal data from anyone under 18.

16. Third-party websites

Our website and communications may contain links to third-party websites, including the platforms and tools we mention. Those sites have their own privacy policies, and we are not responsible for their content or practices.

17. Changes to this policy

If we change this policy, we will publish the updated version on this page with a new date at the top. Significant changes will be highlighted on the website.

18. Contact

FinHub Digital Ltd (trading as FinHub), company number 17455964, registered office: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. Contact us through our contact form. See also our cookie policy and terms of use.