Privacy notice
Plain-English privacy notice for I-OSCC Ltd under the UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025.
Version 1.0 (October 2026).
1. Who we are (the data controller)
I-OSCC Ltd ("I-OSCC", "we", "us", "our") is the data controller for the personal information described in this notice. We build websites and small apps for local UK businesses and look after them on monthly care plans.
- Company number: 17005013 (registered in England and Wales)
- Registered office: 9 Penntiow Golf, Cott Road, Lostwithiel, PL22 0FB
- Email: [email protected] • Phone: 07908 253479
- ICO registration number: Application ref C2071599 (registered 28 October 2026; public ZB certificate number added upon issue)
Where we build, host or look after a website or app for one of our business clients, that client is the data controller for their own visitors’ and customers’ personal data, and we act as their data processor under a separate Data Processing Agreement (Article 28 UK GDPR). This notice covers personal data where I-OSCC Ltd is the data controller.
2. What personal data we collect and where it comes from
- Website visitors and enquirers (Article 13 UK GDPR): when you contact us by phone, email or our enquiry form, we collect your name, business name, email address, phone number, the service you are asking about and your message.
- Technical hosting logs: our hosting provider (Cloudflare Pages) automatically logs technical information needed to deliver and protect the website, such as your IP address, browser type, pages requested and time of access.
- Business clients and suppliers: if you become a client, we keep your contact details, role, order form and contract records, project emails, billing and payment records (via Tide, GoCardless and Xero), and support history.
- Prospective B2B clients (Article 14 UK GDPR): to introduce our services to local businesses, we research publicly available business contact details from the business’s own website, Companies House, Google Business Profile and public local directories. Before calling any business number, we screen it against the Telephone Preference Service (TPS) and Corporate TPS (CTPS) registers.
We do not ask for or intend to collect special category personal data (such as health or biometric data). Please do not send sensitive personal data through our contact form.
3. Why we use your data and our lawful bases (Article 6 UK GDPR)
| Purpose | Data used | Lawful basis |
|---|---|---|
| Replying to your enquiry and preparing a quote | Name, business name, email, phone, enquiry details | Contract (taking steps at your request before a contract) for sole traders/partners, or Legitimate interests (answering business enquiries). |
| Providing website builds, monthly care plans and billing | Client contact details, order forms, correspondence, payment records | Contract for sole traders/partnerships; Legitimate interests for staff/directors of corporate clients. |
| B2B outreach to local businesses (TPS/CTPS-screened calls, and emails to limited companies/LLPs under PECR) | Public business contact details, role, website review notes | Legitimate interests (promoting our B2B services responsibly). We only send marketing emails to sole traders or ordinary partnerships with prior consent or valid soft opt-in. |
| Keeping our do-not-contact (suppression) list | Name, business name, email or phone, date of opt-out | Legal obligation under PECR regulations 21–23 and UK GDPR Article 21(3) so we do not contact you again after an opt-out. |
| Accounting, tax and company records | Invoices, bank and Direct Debit records, contracts | Legal obligation under the Companies Act 2006 and HMRC tax rules. |
| Website hosting and security | IP address, request logs, browser headers | Legitimate interests (keeping our website secure and working properly). |
4. How we use automated and AI tools
We use artificial intelligence (AI) and automated software tools to help research public business websites, draft emails and website code, and organise routine upkeep. A real person at I-OSCC Ltd reviews and approves every outgoing email, quote and website before it is sent or published. We do not make solely automated decisions that have a legal or similarly significant effect on you, and we configure our tools so customer personal data is not used to train public AI models.
5. Who we share personal data with
We never sell your personal data. We share data only with service providers who help us run I-OSCC Ltd under written contracts:
- Cloudflare, Inc. (Cloudflare Pages): website hosting and security.
- Microsoft Corporation (Outlook & OneDrive) and Google Workspace (Gmail): business email and document storage.
- Tide Platform Limited (and ClearBank): business banking and invoice payments (UK).
- GoCardless Ltd: collecting monthly Direct Debit care plan payments (UK).
- Xero (UK) Ltd: accounting and bookkeeping software (UK / EEA / New Zealand adequacy & UK GDPR safeguards).
- AI and form handling providers: Cloudflare Inc. (website hosting, security and form routing), Google Workspace (business email at [email protected]), Microsoft 365 (internal administration and document storage), and our automated brief and operations assistants.
Where a provider processes data outside the UK, we ensure it is protected by a UK adequacy regulation (such as the UK-US Data Bridge) or the ICO’s International Data Transfer Agreement (IDTA) / UK Addendum to EU Standard Contractual Clauses.
6. Cookies and storage technologies
This website is built with lightweight static HTML and CSS. We do not use advertising pixels, cross-site tracking or third-party marketing cookies. Cloudflare may set strictly necessary security cookies (such as __cf_bm or cf_clearance, lasting up to 30 minutes) only if needed to protect the site from automated bot traffic.
7. How long we keep your data
- Enquiries that do not lead to a contract: kept for 12 months after our last contact, then deleted.
- Prospective B2B outreach records: reviewed and removed after 12 months if there is no reply, or kept on our suppression list if you ask us not to contact you again.
- Client contracts, invoices and payment records: kept for 6 years plus the current financial year (up to 7 years) after our contract ends for tax, accounting and legal limitation rules.
- Website technical logs: kept for up to 30 days for security and troubleshooting.
8. Your rights and how to complain
Under the UK GDPR you have the right to access a copy of your personal data, correct inaccurate data, ask for deletion or restriction in certain circumstances, and object to our use of your data where we rely on legitimate interests (including an absolute right to stop direct marketing at any time). To exercise your rights, email [email protected]. We will reply within one calendar month.
If you are unhappy with how we handle your data, please email [email protected] first so we can put things right. Under the Data (Use and Access) Act 2025, we will acknowledge data protection complaints within 30 days and tell you the outcome without undue delay. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or by calling 0303 123 1113.