Privacy Policy
Last updated: 13/09/2006
On this page
- 1. Who we are
- 2. When we are a controller and when we are a processor
- 3. Personal data we collect
- 4. Why we use your data, and our lawful basis
- 5. Marketing
- 6. Cookies
- 7. Who we share your data with
- 8. How long we keep your data
- 9. Your rights
- 12. Complaints
- 13. Third-party websites
- 14. Changes to this policy
1. Who we are
ForgeQA, a sole trader trading as ForgeQA ("ForgeQA", "we", "us", "our"), is the controller of the personal data described in this policy.
- Trading address: Buxton Derbyshire, UK
- Email: forgeqa@btinternet.com
This policy explains what personal data we collect, why we collect it, what we do with it and what rights you have. It applies to our website, our marketing, and our relationships with clients, prospective clients, suppliers and contacts.
2. When we are a controller and when we are a processor
This policy covers the personal data we handle as a controller — where we decide why and how it is used. That includes website visitors, enquiries, client contacts, suppliers and applicants.
Separately, when we provide testing and QA services, we may access personal data held within a client's systems, test environments or test data. In that situation the client is the controller and we act as a processor on their instructions. That processing is governed by the data processing agreement between us and the client, not by this policy. If you are an individual whose data may be held in a client's systems, please contact that organisation directly — we will refer you to them.
3. Personal data we collect
Website visitors
| Data | How we get it |
|---|---|
| IP address, browser and device type, operating system, pages viewed, referring site, time and date of visit | Automatically, via server logs and analytics cookies |
| Cookie preferences | From your choices in our cookie banner |
Enquiries and prospective clients
| Data | How we get it |
|---|---|
| Name, business email, phone number, company name, job title | From you, via our contact form, email, phone or LinkedIn |
| Details of your project, systems or requirements | From you, during enquiry and scoping discussions |
| Records of our correspondence and calls | Generated by us |
Clients and their staff
| Data | How we get it |
|---|---|
| Contact details of your named representatives | From you |
| Billing and payment details, purchase order references | From you |
| Correspondence, meeting notes, project records, time records | Generated by us during the engagement |
| Credentials or access details issued to us for your systems | From you |
Suppliers, subcontractors and associates
Name, contact details, bank details, invoices, insurance and right-to-work or company details, provided by them.
Job applicants and contractor applicants
CV, contact details, work history, qualifications, right-to-work information and interview notes, provided by you or by a recruiter.
We do not deliberately collect special category data (such as health or ethnicity data) or criminal offence data as a controller. Please do not send us such information unless we have asked for it.
4. Why we use your data, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries and preparing proposals | Legitimate interests (responding to a request made to us) or steps at your request before entering a contract |
| Providing our services, managing projects and communicating with you | Performance of a contract, or our legitimate interest in managing our relationship with a corporate client |
| Invoicing, taking payment and chasing unpaid invoices | Performance of a contract, and our legitimate interest in recovering sums owed |
| Keeping accounting and tax records | Legal obligation |
| Sending marketing emails about our services to business contacts | Consent, or legitimate interests where you are an existing client or a corporate business contact (see section 5) |
| Operating, securing and improving our website | Legitimate interests in running a secure and effective website; consent for non-essential cookies |
| Preventing fraud and protecting the security of our systems and our clients' systems | Legitimate interests in security; legal obligation where applicable |
| Establishing, exercising or defending legal claims, and maintaining insurance | Legitimate interests in protecting our legal position; legal obligation |
| Recruiting associates and subcontractors | Steps at your request before entering a contract; legitimate interests in assessing suitability |
Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights and freedoms. You can ask us for details of that assessment.
5. Marketing
We may send you information about our services by email where you have asked us to, or where you are an existing client or a business contact and the message relates to services similar to those you have received or enquired about.
You can also email forgeqa@btinternet.com at any time to opt out. Opting out of marketing does not stop us sending you messages that are necessary for a project or contract.
6. Cookies
Our website uses cookies and similar technologies.
Strictly necessary cookies are required for the site to function (for example, remembering your cookie choices). These do not require consent.
7. Who we share your data with
We do not sell your personal data. We share it with:
- Service providers who process data on our behalf, including: website hosting, email and file storage [e.g. Google Workspace / Microsoft 365], accounting and invoicing software [e.g. FreeAgent / Xero], payment processing Monzo, CRM or email marketing, project and defect tracking tools [e.g. Jira / Linear], and analytics. Each is bound by a written contract requiring them to process data only on our instructions and to keep it secure.
- Subcontractors and associate testers who help deliver services to a client, under confidentiality and data protection obligations.
- Our professional advisers — accountant, insurers, and legal advisers, where necessary.
- Regulators, law enforcement or other authorities where we are required to disclose by law.
- A buyer or successor if we sell or transfer our business or assets.
8. How long we keep your data
| Data | Retention period |
|---|---|
| Enquiries that do not become clients | [12–24] months from last contact |
| Client contract, project and correspondence records | 6 years after the end of the engagement (to match the limitation period for contract claims) |
| Accounting and tax records | 6 years from the end of the relevant tax year, to meet HMRC requirements |
| Marketing contacts | Until you unsubscribe, or [24] months of no engagement, whichever is sooner |
| Website analytics data | [14/26] months |
| Unsuccessful job or associate applications | [6/12] months, unless you agree to us keeping your details longer |
| Client system credentials issued to us | Deleted or revoked at the end of the engagement |
When data is no longer needed, we delete it securely or anonymise it.
9. Your rights
Under UK data protection law you have the right to:
- be informed about how we use your data — which is the purpose of this policy;
- access a copy of the personal data we hold about you;
- rectification of inaccurate or incomplete data;
- erasure of your data in certain circumstances;
- restrict processing in certain circumstances;
- data portability — receive data you gave us in a structured, commonly used, machine-readable format, where processing is based on consent or contract and carried out by automated means;
- object to processing based on legitimate interests, and to object at any time to direct marketing; and
- withdraw consent at any time where we rely on consent, without affecting processing carried out before withdrawal.
To exercise any of these rights, email forgeqa@btinternet.com. We will respond within one month. We may ask you to verify your identity. There is normally no charge, though we may charge a reasonable fee or refuse a request that is manifestly unfounded or excessive.
We do not carry out automated decision-making or profiling that produces legal or similarly significant effects.
12. Complaints
If you have a concern about how we handle your data, please contact us first at forgeqa@btinternet.com and we will try to resolve it.
You also have the right to complain to the Information Commissioner's Office:
- Website: ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
13. Third-party websites
Our website may link to other sites. This policy does not cover them, and we are not responsible for their privacy practices. Please read their privacy policies before providing them with personal data.
14. Changes to this policy
We may update this policy from time to time. The date at the top shows when it was last changed. Where changes are significant, we will notify clients directly.