What we collect, why we collect it, who sees it and the rights you have under UK GDPR.
This policy explains what personal information WRKFLW collects, why we collect it, who we share it with and the rights you have. We’ve written it in plain English. If anything is unclear, email hello@wrkflw.co.uk and we’ll explain.
1. Who we are
WRKFLW is the trading name of Michael Parr, a sole trader based in England. In this policy, “WRKFLW”, “we”, “us” and “our” mean Michael Parr trading as WRKFLW.
We are the controller of the personal information described in this policy. That means we decide how and why it is used, and we are responsible for looking after it under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
- Contact: Michael Parr, owner
- Email: hello@wrkflw.co.uk
- Office hours: Monday to Friday, 09:30 to 17:30
2. Who this policy covers
This policy covers people who visit our website, contact us, book a call, become a client, or work with us as a supplier or freelancer.
When we build or run systems for a client, we sometimes handle information about that client’s customers or staff. In that case the client is the controller and we act as their processor, following their instructions under our Terms and Conditions. The client’s own privacy notice applies to that information.
3. The information we collect
| When | What we collect |
|---|---|
| You fill in a form on our website | Your name, business name, email address, phone number (optional), what you need help with, a rough budget (optional) and anything you write in the message box. |
| You book a call | Your name, email address, the time you choose and any notes you add. |
| You use the live chat | Your messages, plus your name and email if you give them. |
| You email or call us | Your contact details and whatever you choose to tell us. |
| You become a client | Contact and billing details, project notes, logins or access you give us, and records of the work and payments. |
| You browse our website | Technical information such as your IP address, browser, device and the pages you visit. Analytics and chat tools only run if you accept them in our cookie banner. See our Cookie Policy. |
We don’t ask for special category information (such as health, religion or ethnicity). Please don’t send it to us unless a project genuinely needs it and we’ve agreed how it will be handled.
4. How we use it, and our lawful basis
Data protection law says we must have a lawful basis for each use of your information. These are ours:
| What we use it for | Lawful basis |
|---|---|
| Replying to your enquiry and arranging your free call | Steps you ask us to take before entering a contract, and our legitimate interest in responding to people who contact us. |
| Keeping a record of enquiries and follow ups in our CRM | Legitimate interests: running our business and keeping track of conversations. |
| Delivering the work you hire us for, including support and hosting | Performance of our contract with you. |
| Sending invoices, keeping accounts and meeting tax rules | Legal obligation, and performance of our contract. |
| Understanding how people use our website so we can improve it | Consent (given through our cookie banner). |
| Keeping our website and systems secure and preventing spam | Legitimate interests: protecting our business and visitors. |
| Dealing with complaints or legal claims | Legitimate interests, and legal obligation where it applies. |
Where we rely on legitimate interests, we have balanced our interests against yours. You can object at any time (see section 9).
Marketing: we don’t currently send marketing emails. If we start, we will only email people who have agreed to it or, for existing clients, about similar services, and every email will have an unsubscribe link.
5. Who we share it with
We never sell your information. We only share it with trusted providers who help us run the business, and only what they need. Each one is bound by a contract that requires them to protect it.
- HubSpot (CRM, website forms, meeting booking and live chat). Our HubSpot account is hosted in HubSpot’s EU data centre.
- Google Workspace (business email, calendar and file storage).
- Google Analytics (website statistics, only if you accept analytics cookies).
- Cloudflare (website security, spam protection and fast delivery of the site).
- Our web hosting provider (stores the website and form emails on its servers).
- AI providers: OpenAI, Anthropic, Google (Gemini) and xAI (Grok). We use these to draft, analyse and build, and only send personal information when a task needs it. Our AI Use Policy explains the safeguards.
- Freelancers who help on some projects. They work under written confidentiality and data protection terms and only see what their part of the job needs.
- Professional advisers such as our accountant, insurer or lawyer, where needed.
- Authorities such as HMRC or the police, but only where the law requires it.
6. Sending information outside the UK
Some of our providers are based in, or use servers in, the United States or the European Economic Area. Where information leaves the UK we make sure it is protected by one of the safeguards UK law allows: a UK adequacy decision (including the UK Extension to the EU-US Data Privacy Framework for certified US companies), or the UK International Data Transfer Agreement or Addendum built into the provider’s contract.
7. How long we keep it
| Information | How long |
|---|---|
| Enquiries that don’t lead to work | Up to 24 months after our last contact, then deleted. |
| Client records, contracts and invoices | 6 years after the end of the tax year the work finished, as UK tax law requires. |
| Project files and client data held for a project | Returned or deleted within 90 days of the project or support ending, unless you ask us to keep them or the law says otherwise. |
| Website analytics | 14 months in Google Analytics. |
| Chat conversations | Up to 24 months. |
8. Keeping it safe
We use strong passwords and two-factor authentication on our business accounts, encrypted connections (HTTPS), access limited to the people who need it, and regular updates and backups. No system is perfectly secure, but if a breach happens that puts your rights at risk, we will tell you and the Information Commissioner’s Office (ICO) as the law requires.
9. Your rights
You have the right to:
- Access the personal information we hold about you and get a copy.
- Correct anything that’s wrong or incomplete.
- Delete your information, where we have no reason to keep it.
- Restrict how we use it while a concern is looked into.
- Object to us using it on the basis of legitimate interests, and to direct marketing at any time.
- Move information you gave us to another provider (data portability).
- Withdraw consent at any time, for example by changing your cookie settings.
To use any of these rights, email hello@wrkflw.co.uk. It’s free, and we’ll reply within one month. We may ask you to confirm who you are first.
10. Automated decisions
We don’t make decisions about you that are based only on automated processing and that have legal or similarly significant effects.
11. Complaints
If you’re unhappy with how we’ve handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint or 0303 123 1113.
12. Children
Our website and services are for businesses and are not aimed at children under 18. We don’t knowingly collect their information.
13. Changes to this policy
We may update this policy when our services or the law change. The date at the top shows when it was last updated, and we’ll tell clients about any important changes.