Privacy policy

What the finished policy must cover

• Who we are: the operating company, registered office, company number and ICO registration number (all to be confirmed in src/data/site.ts).
• What we collect through the enquiry form: where you live, your debt band, the kinds of debt you have, work and housing situation, monthly income, what you could afford, any creditor action, name, phone, email and preferred call time.
• Partial enquiries: if you leave the form after giving a phone number or email, the answers you gave so far are sent to us. The policy must state the lawful basis for this (likely legitimate interests, with a balancing test on file), that it is used for one follow-up only, that it is never passed to a partner firm, and how long it is kept.
• Who we share it with, and why. This section carries more weight than usual: the consent tick-box on the form only says “I agree to TrustDeeds.co.uk contacting me”, so this policy is where people learn that their answers go to an insolvency practitioner firm. It must name the firm, its address and its own privacy notice, state the lawful basis for sharing (for example, steps taken at the person’s request before entering into a contract, or legitimate interests with a balancing test on file), say that the firm may contact them by phone, email or text about the enquiry, and explain how to object or withdraw.
• Marketing: the form collects no marketing consent, so no marketing emails or texts are sent from it.
• Special category data: the form does not ask about health or vulnerability. If you tell us about either on the phone, how it is recorded and who sees it.
• Retention periods for completed enquiries, partial enquiries and call recordings.
• Processors: hosting (Vercel), email delivery (Resend), any CRM, analytics (Ahrefs Web Analytics is cookieless and collects no personal data), and Google Tag Manager plus whatever tags are published through it.
• International transfers, if any processor stores data outside the UK.
• Your rights under UK GDPR: access, correction, erasure, restriction, objection, portability, and withdrawing consent at any time.
• Data protection complaints procedure: required from 19 June 2026 under the Data (Use and Access) Act. How to complain to us first, and then to the Information Commissioner’s Office.

Before publication

The operating company, ICO registration and partner firm must be confirmed first, because every section depends on them.