Privacy policy

What the finished policy must cover

• Who we are: the operating company, registered office, company number and ICO registration number (all to be confirmed in src/data/site.ts).
• What we collect through the enquiry form: where you live, your debt band, the kinds of debt you have, work and housing situation, monthly income, what you could afford, any creditor action, name, phone, email, postcode and preferred call time.
• Partial enquiries: if you leave the form after giving a phone number or email, the answers you gave so far are sent to us. The policy must state the lawful basis for this (likely legitimate interests, with a balancing test on file), that it is used for one follow-up only, that it is never passed to a partner firm, and how long it is kept.
• Who we share it with: the named insolvency practitioner firm, only where you tick the consent box. Name the firm, its address and its own privacy notice.
• Marketing: only where you tick the separate, optional marketing box. How to unsubscribe.
• Special category data: the form does not ask about health or vulnerability. If you tell us about either on the phone, how it is recorded and who sees it.
• Retention periods for completed enquiries, partial enquiries and call recordings.
• Processors: hosting (Vercel), email delivery (Resend), any CRM, analytics (Ahrefs Web Analytics is cookieless and collects no personal data).
• International transfers, if any processor stores data outside the UK.
• Your rights under UK GDPR: access, correction, erasure, restriction, objection, portability, and withdrawing consent at any time.
• Data protection complaints procedure: required from 19 June 2026 under the Data (Use and Access) Act. How to complain to us first, and then to the Information Commissioner’s Office.

Before publication

The operating company, ICO registration and partner firm must be confirmed first, because every section depends on them.