Privacy policy
This explains what personal information Nodal collects, why, who sees it, how long we keep it, and your rights. We collect as little as we can, we never sell it, and this website uses no tracking.
1. Who we are
Nodal is the trading name of Nodal Systems Ltd, which is being registered in England and Wales. Its company number and registered office address will be added here once registration is complete. We are the "controller" of the information described here. Questions or requests: hello@nodalhq.co.uk.
2. What we collect
When you send an enquiry: your name, business name, email address, phone number (optional), how you handle enquiries today, and anything you write to us.
To stop spam: your IP address, kept for up to 24 hours to limit repeated form submissions, then deleted automatically. Our hosting provider also keeps short-lived technical logs to keep the site secure and working.
If you become a client, through your private client portal:
- your signed agreement, with the name you typed, your email, the date and time, your IP address and browser, and a fingerprint of the exact text you agreed to, so there is a reliable record of what was signed;
- your questionnaire answers about how your business works;
- any files you upload, such as logos, photos and spreadsheets;
- payment records. When online payments are introduced, card and bank details are handled by our payment provider, Stripe. We never see or store your full card or bank details.
Data inside the systems we build for you. When we build and host a CRM or website for your business, the information about your own customers belongs to you. We process it only on your instructions, as your "processor", under the terms of your client agreement. Your customers should look at your own privacy notice.
3. Why we use it, and our legal basis
| What we do | Legal basis (UK GDPR) |
|---|---|
| Reply to your enquiry | Our legitimate interest in responding to people who contact us, and taking steps you ask for before a contract |
| Build, host and support your website or CRM | Performing our contract with you |
| Keep financial and contract records | Legal obligation (for example tax law) |
| Keep the website secure and stop spam | Our legitimate interest in protecting our service |
We don't send marketing emails unless you've asked for them, we don't sell or rent your information, and we don't make automated decisions about you.
4. Who we share it with
Only the service providers we need to run Nodal, each bound by data protection terms:
- Cloudflare: hosts this website, the client portal, our database and file storage.
- ntfy: sends instant alerts to our own phone when an enquiry arrives. Alerts contain only a first name and business name, never contact details.
- Resend: delivers our automatic emails, such as enquiry confirmations, once switched on.
- Stripe: takes payments, once online payments are introduced.
- Professional advisers, such as our accountant, where needed, and authorities if the law requires it.
5. Information leaving the UK
Some of these providers store or process information outside the UK, for example in the United States or the European Economic Area. When that happens it is protected by UK adequacy regulations (including the UK–US data bridge where the provider is certified) or by the UK International Data Transfer Agreement or Addendum.
6. How long we keep it
- Enquiries that don't go further: deleted automatically 24 months after we last heard from you.
- Client records, including signed agreements and payment records: 6 years after our contract ends, as UK tax and contract law requires.
- Spam-protection IP addresses: 24 hours.
- Files you upload: for as long as we work together, then deleted or returned when the work ends, unless you ask us to keep them.
7. Your rights
You can ask us to give you a copy of your information, correct it, delete it, restrict how we use it, object to how we use it, or send it to you or someone else in a usable format. Email hello@nodalhq.co.uk. It's free, and we'll reply within one month. Some information we must keep for legal reasons, such as invoices; if so, we'll tell you.
8. Complaints
If you're unhappy with how we've handled your information, please tell us first so we can put it right. You can also complain to the UK regulator, the Information Commissioner's Office: ico.org.uk or 0303 123 1113.
9. Keeping it safe
Everything is sent over encrypted connections. Our CRM needs a password, uploaded files are stored privately, and client portal links are long, random and can be cancelled at any time.
10. Cookies
This website uses no tracking or advertising cookies. See our cookie policy.
11. Changes
If we change this policy, we'll update the date at the top. Significant changes will be made clear on this page.