Privacy Policy
Last updated: 9 August 2026
1. Who we are
This website is operated by Puck App Ltd, a company registered in England & Wales under company number 17306844, whose registered office is at 20c Stavordale Road, London N5 1NE, United Kingdom. In this policy, "we", "us" and "our" mean Puck App Ltd.
Puck App Ltd is the data controller for the personal data described below. We are not currently required to register with the Information Commissioner's Office as a fee-paying controller for the limited processing set out here; if that changes we will update this policy.
2. How to contact us about your data
For any question, request or complaint about personal data, contact us directly — please do not rely on the enquiry form alone:
- Email: [email protected]
- Phone: +44 7848 458 341
- Post: Data enquiries, Puck App Ltd, 20c Stavordale Road, London N5 1NE, United Kingdom
3. What personal data we collect
| Source | Data |
|---|---|
| Enquiry form on this website | Your name, email address, the engagements you tick, and whatever you write in the message field. |
| Email or phone contact | Your name, email address, phone number, and the content of your correspondence. |
| Client relationship | Contact details for the people we work with, project correspondence, invoicing and payment records, and any credentials you choose to share with us for the purpose of delivering the work. |
| Web server logs | IP address, browser type, pages requested and timestamps, recorded automatically by our hosting provider for security and to keep the site running. |
| Cookies | Only a strictly necessary record of your cookie choice. See our Cookie Policy. |
We do not collect special category data (health, biometric, political, religious or similar), and we do not knowingly collect data from anyone under 18. We do not carry out automated decision-making or profiling.
4. Why we process it, and our lawful basis
Under Article 6 of the UK GDPR we rely on the following lawful bases:
| Purpose | Lawful basis |
|---|---|
| Replying to your enquiry and preparing a proposal or quote | Legitimate interests (Art. 6(1)(f)) — you contacted us and expect a reply. Also steps prior to entering a contract (Art. 6(1)(b)). |
| Delivering a project we have been engaged for | Performance of a contract (Art. 6(1)(b)). |
| Invoicing, accounting and keeping statutory records | Legal obligation (Art. 6(1)(c)) — UK tax and company law. |
| Keeping this website secure and available (server logs) | Legitimate interests (Art. 6(1)(f)) — preventing abuse and diagnosing faults. |
| Any analytics or non-essential cookies, if we add them | Consent (Art. 6(1)(a)), given through the cookie banner and withdrawable at any time. |
We do not send marketing emails, and we do not add enquirers to a mailing list.
5. How long we keep it
- Enquiries that do not become projects: 24 months from your last message, then deleted.
- Client project records and correspondence: for the life of the engagement plus 6 years, which matches the limitation period for contract claims in England & Wales.
- Invoices and accounting records: 6 years from the end of the accounting period, as required by UK tax law.
- Server logs: retained by our hosting provider on their standard rolling schedule, typically no longer than 90 days.
- Cookie choice: stored in your own browser for 12 months, or until you clear it.
6. Who we share it with
We do not sell your personal data, and we do not share it for anyone else's marketing. We use a small number of service providers who process data on our behalf under written terms:
- Website hosting — serves this site and generates the server logs described above.
- Email provider — carries correspondence to and from [email protected].
- Accounting software and our accountant — for invoicing and statutory records.
- Source control and project hosting — where project correspondence and code live during an engagement, when the client has not specified their own.
We may also disclose data where we are legally required to, for example in response to a valid request from a regulator, court or law enforcement.
7. International transfers
Our hosting is in the United Kingdom. Some of the providers above — email, accounting and source control — are operated by companies based in the United States, so your data may be transferred outside the UK. Where that happens we rely on the UK adequacy regulations for the country concerned, or on the International Data Transfer Addendum to the European Commission's Standard Contractual Clauses, together with the provider's own technical safeguards. You can ask us for details of the safeguards applying to any specific provider.
8. Your rights
Under the UK GDPR you have the right to:
- Access — get a copy of the personal data we hold about you.
- Rectification — have inaccurate data corrected and incomplete data completed.
- Erasure — ask us to delete data, where we have no overriding obligation to keep it.
- Restriction — ask us to pause processing while a dispute about accuracy or legitimacy is resolved.
- Portability — receive data you gave us in a structured, commonly used, machine-readable format.
- Object — object to processing based on legitimate interests, including at any time.
- Withdraw consent — where processing relies on consent.
Withdrawing consent for cookies
Non-essential cookies only run if you press Accept on the cookie banner. To withdraw that consent, clear this site's data in your browser settings — the banner will reappear and you can choose Decline. Withdrawing consent does not affect processing carried out before you withdrew it. Full detail is in our Cookie Policy.
How to exercise your rights
Email [email protected] or write to the registered office above. We will respond within one month of receiving your request, as required by the UK GDPR. If a request is unusually complex we may extend that by a further two months, and we will tell you within the first month if we do. There is no charge for a request unless it is manifestly unfounded or excessive.
9. Complaints to the ICO
If you are unhappy with how we have handled your personal data, please raise it with us first — we would rather fix it. You also have the right to complain to the UK supervisory authority at any time:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
www.ico.org.uk
10. Security
This website is served over HTTPS. Access to enquiry and client data is limited to the two people who run Puck App Ltd, protected by strong unique credentials and multi-factor authentication where the provider supports it. Client credentials shared with us for a project are held in an encrypted store and destroyed at the end of the engagement unless you ask us to keep them for support.
11. Changes to this policy
If we change how we handle personal data we will update this page and change the "last updated" date at the top. Where a change materially affects you and we hold your contact details, we will tell you directly.