Privacy notice

This notice explains what personal data we collect, why, how long we keep it and what you can ask us to do about it.

We are Software Builders Ltd, a company registered in England and Wales, company number 17431696, whose registered office is 66 Chertsey Road, Windlesham, England, GU20 6HP. We trade as Foundation. For the data described here we are the controller, which means we decide what is collected and why.

Ask us anything about this at hello@foundationbuilds.com.

1. When you fill in a form on this site

The enquiry form asks for your name and email address, and optionally your phone number, what you need, your budget and a message. It also records which page you came from.

• Why: to answer you. That is the whole purpose.
• Our lawful basis: legitimate interests — you asked us to get in touch, and replying to an enquiry is what you would expect.
• How long: while we are talking, and then for two years in case you come back. If you become a customer it moves onto your client record and is kept as described in section 2.

The form has a hidden field no person ever sees, and we score submissions for signs of automation. Anything that looks like a bot is filed separately rather than deleted, so that a real person caught by mistake is not lost. That filing decision is automated, but nothing about it affects you legally — the worst case is that we reply more slowly, and we review the filed ones.

2. If you become a customer

We keep what we need to do the work and to run a business properly:

• Your contact details — name, business name, email, phone.
• The work itself — your project, its status, milestones, updates, and messages you send us through the client portal.
• Invoices and payments — what was billed, what was paid, when.
• If you take hosting — the site address, your project reference, which version of the hosting terms you agreed to and the moment you ticked the box.

Our lawful basis is performance of a contract with you, and for the accounting records, a legal obligation.

How long: for as long as you are a customer, and then six years after the end of the relationship, which is how long HMRC expects records to be kept.

3. If you tick the box for occasional emails

The enquiry form has an optional tickbox for hearing from us a few times a year. If you tick it we record **the fact you consented, the date, and where you did it** — because under the privacy rules on electronic marketing, what matters later is being able to show when and from where consent was given.

• Our lawful basis: your consent.
• How to stop: one click, no login, from the link in every one of those emails. You can also just reply and ask.
• How long: until you unsubscribe. When you do we mark you as unsubscribed rather than deleting you, because deleting would lose both the proof you once consented and the record that you asked us to stop — which is the thing we would most need to show.

We do not sell your details, and we do not share them with anyone for their own marketing.

4. If you are a customer of one of our customers

Where we have built or host a system for a business, that business decides what it collects about its own customers. **They are the controller and we are their processor** — we hold the data on their behalf and act on their instructions.

If your details are in a system we host for someone else, **please contact that business**, not us. We will help them answer you, but it is not our data to give out or delete.

5. Where your data is held

• Websites and systems we host for clients run on our own servers in the United Kingdom (London) or the United States (New York). The client chooses which when they sign up; if they express no preference we use the one matching their billing address, and we tell them which. A client who chooses a region outside their own is making that decision as the controller of their own data, and we say so plainly before they do.
• Our client management system, which holds everything in sections 1 to 3 above, runs on a server in the United States, whoever you are.

That second one is a transfer outside the UK. It is made under the safeguards in our server provider's data processing agreement. If you would rather your enquiry was not held outside the UK, say so when you contact us and we will deal with you by email and telephone only.

6. Who else is involved

We keep the list of companies who touch your data short, and it is this:

• DigitalOcean — the servers everything runs on.
• Stripe — card payments. Your card details go to Stripe directly and never reach us; we see the last four digits and the expiry date.
• Resend — sending email, including invoices and anything you have opted into.
• Namecheap — domain registration, DNS and our own mailboxes.
• Google Fonts — the typefaces on this site are served by Google, which means your browser requests them and Google sees your IP address when it does.
• Meta (Facebook and Instagram) — only if you accept cookies. See section 7.

Each is bound by a contract that lets them use your data only to provide the service to us. We do not use analytics cookies.

7. Cookies

We advertise on Facebook and Instagram, and we use the Meta pixel to see which of those adverts lead to an enquiry or a sign-up. **It is not loaded unless you accept it** in the banner at the bottom of the page, and if you decline it is never loaded at all. Nothing else on this site sets cookies.

If you accept, the pixel sets Meta's own cookies (_fbp, and _fbc if you came from an advert) and tells Meta which pages you visited and whether you sent an enquiry or started a sign-up. We also send those same events to Meta from our own server, which Meta calls the Conversions API, so that adverts are measured properly when a browser blocks the pixel. Where that includes your email address or phone number it is hashed first, so Meta receives a one-way fingerprint rather than the value itself, and it only happens with the same consent. Meta uses this under its own terms, at facebook.com/privacy/policy.

Your choice is remembered in your browser so we do not ask again. That record holds only "accepted" or "declined" and is strictly necessary to honour it. Change your cookie choice.

If you log into the client portal at hq.foundationbuilds.com, that stores a sign-in token in your browser so you stay logged in. It is strictly necessary for the service and is removed when you sign out.

8. Your rights

Under the UK GDPR you can ask us to:

• Show you what we hold about you.
• Correct anything that is wrong.
• Delete it, where we do not have a legal reason to keep it — accounting records being the usual exception.
• Restrict or object to what we are doing with it.
• Hand it over in a portable format, or send it to someone else.
• Withdraw consent at any time, where consent is what we relied on.

Email hello@foundationbuilds.com and we will respond within one month. There is no charge.

If you are not happy with how we have handled it, you can complain to the Information Commissioner's Office at ico.org.uk, by telephone on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. We would rather you came to us first so we can put it right.

9. Changes to this notice

We will update this page when what we do changes. Each version is numbered and dated at the top. If a change materially affects you and we hold your contact details, we will tell you.

Software Builders Ltd, trading as Foundation
66 Chertsey Road, Windlesham, England, GU20 6HP
Company number 17431696