Privacy Policy

Who we are

This site, toflin.co.uk, is run by Toflin, a trading name of Anthony Flynn, a sole trader (“we”, “us”). We are based in Lanarkshire, Scotland. You can write to us at 13 Clyde Street, Carluke, ML8 5EF, or email hello@toflin.co.uk.

For the information described below, we are the “controller”, which means we decide how it is used. The one exception is information about our customers’ own customers, which we cover under “Information about your customers” further down.

What we collect, and why

If you get in touch. When you fill in our Contact form, email us or phone us, we collect your name, email address, phone number if you give it, and your message. We use it to reply to you and to talk about working together. We do this because it is in our interests, and yours, to answer an enquiry.

If you ask for our free guide. We collect your name and email address so we can send you the guide. The form emails your details to us and emails the guide link to you. If you tick the box to say you want more tips, we add you to our mailing list, which we run through Hostinger Reach, and we will send you the odd tip. You can unsubscribe at any time using the link in any of our emails, or by replying to ask us to stop. We do this with your consent.

If you buy from us. You pay through Stripe. Stripe collects your name, email address, phone number, billing address and payment details. Your card details go straight to Stripe and we never see them. We receive your name, email address, what you bought and when. We keep your name, email address and order reference on our website so we can send your welcome email, send a renewal reminder on a yearly plan, and know who a cancellation belongs to. We do this to carry out our contract with you and to keep the business records the law requires.

If you send us your website details. Our details form asks for your business name, trade, location, contact details, logo, services, experience, accreditations and photos, and anything else you choose to add. We use it to build and run your website. The form sends everything to us by email and sends you a copy as a receipt. Photos are made smaller in your browser before they are sent. The form does not keep a copy of your details on the website itself.

If we run your services. If we manage your social media, ads or website, we also hold the messages, approvals and access details you give us so we can do the work. We do this to carry out our contract with you.

Records and accounts. We keep invoices, payment records and similar details because tax and accounting rules require it.

When you visit the site. Our hosting provider keeps basic technical records, such as your IP address, to keep the site secure and working. Our Cookies Policy covers cookies. Anything beyond the strictly necessary cookies only runs once you accept it on the cookie banner.

Who we share it with

• Stripe, who take payments. Stripe also uses your details for its own fraud checks and legal duties.
• Hostinger, who host our website, and GoDaddy, who handle our email.
• Our accountants, who see invoices and payment records.
• People who help us do the work, such as a designer or developer, who must keep your details confidential and only use them for your job.
• Platforms you ask us to work with, such as Meta (Facebook and Instagram) and Google, when we manage your pages, profiles or ads.
• HMRC and other authorities, if the law says we must.

We never sell your details, and we do not pass them to anyone for their own marketing.

Sending information outside the UK

Some of the companies above, such as Stripe, Hostinger, Meta and Google, may handle information outside the UK. When they do, they use safeguards the UK law accepts, such as an approved data transfer agreement.

How long we keep it

• Enquiries that do not lead to any work: up to 12 months, then we delete them.
• Free guide requests: up to 12 months, then we delete them. If you asked for more tips, until you ask us to stop.
• Customer details, order records and invoices: while you are a customer and for six years after, because of tax and accounting rules.
• Text, logos and photos you send for your website or social media: while we are working for you. We delete them within 90 days after the work ends, unless you ask us to send them back or delete them sooner.

Information about your customers

If we build or run a website, social media or ads for you, we may handle information about your own customers, such as enquiries sent through your website, reviews or leads from your ads. In that case you decide what is done with it and we only use it on your instructions, to do the work. We keep it secure and delete it or hand it back when our work ends. Our Terms and Conditions say more about this.

Keeping it safe

Our website uses HTTPS. We only give access to the people who need it, and we use well-known providers for hosting, email and payments. No system is perfect, so if we ever find out that your information has been put at risk, we will tell you and the regulator where the law says we must.

Your rights

Under UK GDPR, you can ask us to: show you what we hold about you, correct anything that is wrong, delete your details, restrict or object to how we use them, or send you a copy you can take elsewhere. Where we rely on your consent, you can take it back at any time. To use any of these, email hello@toflin.co.uk. If you are unhappy with how we have handled your details, you can also complain to the Information Commissioner’s Office (ico.org.uk).

Who this is for

Our services are for businesses. We do not knowingly collect information about children.

Changes to this policy

If we change what we collect or how we use it, we’ll update this page and change the date at the top.