Privacy Notice
Version 1.0 · effective 25 September 2026
This notice explains what personal data Heatherstack collects, why, and what rights you have over it. It covers heatherstack.com, our customer portal at my.heatherstack.com, and our dealings with customers, enquirers and suppliers.
1. Who we are
Heatherstack Limited is the controller of the personal data described in this notice. We’re registered in England and Wales (company number 17388412), and our registered office is 10 Kingsmead Avenue, Chichester, PO19 6GA.
For any privacy question or request, customers can email [email protected]. Anyone else can use heatherstack.com/contact.
2. Data on websites we host for you
If we host or maintain your website, we also handle personal data about your site’s visitors and customers. For that data we’re the processor and you’re the controller, and our Data Processing Addendum applies. This notice doesn’t cover it.
If you’re a visitor to one of our customers’ websites, please contact that website’s owner about your data.
3. What we collect and why
| What we use it for | Data | Lawful basis | How long we keep it |
|---|---|---|---|
| Replying to enquiries | Name, email, phone, company, your message | Legitimate interests: responding to people who contact us | Up to 3 years after our last contact, unless you become a customer |
| Providing our services and managing your account | Name, company, contact details, portal login, support tickets, project correspondence | Contract | While you’re a customer, then 6 years |
| Billing and accounts | Billing contact and address, invoices, payment records | Legal obligation (tax and company law) | 6 years from the end of the financial year concerned |
| Service and security emails | Name, email | Contract and legitimate interests: keeping your services running and secure | While you’re a customer |
| Occasional news and updates | Name, email | Consent, or legitimate interests for existing customers | Until you unsubscribe |
| Keeping our websites and portal secure | IP address, browser details, server and security logs | Legitimate interests: protecting our systems | Up to 12 months |
| Legal claims and insurance | Any of the above that’s relevant | Legitimate interests: establishing or defending legal claims | As long as the matter needs |
| Blog comments | Name, email, website (optional), your comment, IP address, browser details | Legitimate interests: running our blog and filtering spam | Until you ask us to remove the comment |
Every news or updates email includes an unsubscribe link, and you can opt out at any time.
4. Cookies, analytics and our blog
4.1 Cookies. Our websites and customer portal only use the cookies they need to work, such as keeping you logged in to the portal. We don’t use advertising or tracking cookies.
4.2 Analytics. Where we use analytics tools, we use Umami, a privacy-friendly analytics tool. It helps us to understand how our website is used without jeopardising the privacy of our users. It doesn’t use cookies, doesn’t track you across other websites and doesn’t build a profile of you. We only see anonymous totals, such as page views and which sites sent visitors to us. It runs on our own server in Germany.
4.3 Blog comments. If you comment on our blog, your name and comment are shown publicly. Your email address isn’t. We also record your IP address and browser details to help filter spam. If you tick the box to save your details, a cookie remembers your name and email for next time, for up to a year. You can ask us to remove your comment at any time.
4.4 Gravatar. An anonymised string created from your email address (a hash) may be sent to the Gravatar service to check whether you use it. If you do, your Gravatar profile picture appears next to your comment. Gravatar’s privacy policy is at automattic.com/privacy.
4.5 Logging in. If you log in to our website, it sets cookies to keep you logged in. These last two days, or two weeks if you tick “Remember me”, and are removed when you log out.
4.6 Embedded content. Blog posts may include content embedded from other websites, such as videos. Embedded content behaves exactly as if you’d visited the other website, which may collect data about you, use cookies and track your interaction with it.
4.7 Images. If you upload images to our website, avoid images with embedded location data (EXIF GPS).
5. Who we share data with
We don’t sell personal data. We share it only with providers who help us run the business, under contracts that require them to protect it:
| What they do for us | Where |
|---|---|
| Hosting our websites and customer portal | UK |
| DNS, security and content delivery for our websites | Global; US company |
| Accounting and invoicing | UK |
| Sending our emails and updates | EU |
| Sending automated emails from our systems | EU |
| Business email | Switzerland / EU |
We may also share data with:
- our accountant, insurers and professional advisers;
- subcontractors working on your project, who are bound by confidentiality;
- HMRC, regulators, the police or courts, where the law requires it;
- a buyer or successor, if our business is sold or transferred. We’d tell you first.
6. Transfers outside the UK
Some providers process data outside the UK. Where the destination isn’t covered by UK adequacy regulations, we rely on the provider’s own UK transfer safeguards. These are the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
7. Keeping data secure
We limit access to the people who need it and use encrypted connections. We use two-factor authentication on our business systems and keep our software up to date. If a breach puts your rights at risk, we’ll tell you and the ICO as the law requires.
8. Your rights
You have the right to:
- get a copy of your personal data;
- have inaccurate data corrected;
- have your data deleted, where we don’t need to keep it;
- restrict or object to how we use it, including stopping marketing at any time;
- receive data you gave us in a portable format;
- withdraw consent, where we rely on it.
To use any of these rights, email [email protected] or use heatherstack.com/contact. We’ll respond within one month, and there’s normally no charge.
9. Complaints
If you’re unhappy with how we’ve handled your data, please tell us first and we’ll try to put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk.
10. Changes to this notice
We’ll post any changes here and update the version date. If a change significantly affects how we use customers’ data, we’ll email you about it.