Privacy notice
Version 2026-11-v1. Last updated 2 November 2026.
This notice explains how Clarwyn IT uses personal data in this portal. Our website privacy notice covers the rest of our business and applies as well.
1. Who is responsible
Jamie Castle trading as Clarwyn IT, 20 Sidbury Hill Avenue, Tidworth, Wiltshire, SP9 7JN, United Kingdom. Email support@clarwyn.co.uk. Jamie Castle is the controller of the personal data described in this notice. We are registered with the ICO, number ZC285129. For personal data in a Care client's own systems or requests that we handle on the client's behalf, the client is the controller and we are the processor (see the data processing terms).
2. What we collect, why, and our lawful basis
| Data | Why | Lawful basis (UK GDPR Art 6) |
|---|---|---|
| Name, email address, business name, passkey details (public key and device name) | To create and secure your account and sign you in | Contract (6(1)(b)); for security, also legitimate interests (6(1)(f)) |
| What you type in a request or ticket, screenshots you email to us, our replies, our notes and the timeline, and diagnosis reports | To provide the help you asked for | Contract (6(1)(b)) |
| Order and payment records: what you bought, amount, date, the agreements you ticked and when, refunds, and Stripe's reference. We never see your card number. | To take payment, give refunds, show we followed consumer law, and keep accounts | Contract (6(1)(b)); legal obligation to keep accounting records (6(1)(c)); legitimate interests in handling disputes (6(1)(f)) |
| Emails we send you (confirmations, sign-in links, replies, reminders) and whether they were delivered | To run the service and prove what we told you | Contract (6(1)(b)) |
| IP address, browser type and security logs (sign-ins, failed attempts, changes made) | To keep the portal secure, spot abuse and fraud, and investigate problems | Legitimate interests (6(1)(f)): keeping a service holding client data secure. You can object, see section 8. |
We do not send marketing emails from the portal. We do not use your data for advertising, and we do not sell it. No decision about you is made by a computer without a person being involved: any automated sorting of requests only makes suggestions to us.
3. Where it comes from
From you, or from your employer if you are a Care client's staff member and they set up your account. Stripe tells us whether a payment succeeded.
4. Who we share it with
Only the companies that help us run the portal (our "processors"), and others where the law requires.
| Who | What for | Where |
|---|---|---|
| Cloudflare, Inc. (and its UK and Irish group companies) | Hosting, the database, file storage, security checks on sign-in forms, and sending our emails | Data is stored in Cloudflare's European region where we can choose; Cloudflare also processes data in the United States |
| Stripe Payments UK Ltd and Stripe group companies | Taking card payments and refunds. Stripe is a separate controller for its own fraud-prevention and legal duties, under its own privacy notice. | UK, EEA and United States |
| AI assistant service used to help us run Clarwyn IT's administration (provided by Anysphere, Inc.) | Helping us read and draft replies to requests. A person reviews and sends everything. | United States and possibly other countries |
| Our professional advisers, insurers, and authorities such as the ICO, courts or the police | Only where needed or required by law | UK |
5. Transfers outside the UK
Some of those companies process personal data outside the UK, mainly in the United States. We rely on UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework, for companies that are certified to it) or on the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, which those companies include in their standard terms. You can ask us for more detail.
6. How long we keep it
| Data | How long |
|---|---|
| Screenshots and files you email to us | Deleted when no longer needed for the request, and in any case within 12 months of it closing |
| One-off requests: conversation, notes, timeline and report | Deleted 2 years after the request is closed |
| Orders, payment and consent records, and the invoices we issue | 6 years after the end of the tax year (tax and accounting law, and the time limit for a claim) |
| Account details (name and email) | While you have an account, and for as long as we keep your order records. You can ask us to delete your account sooner; we then keep only the records we must |
| Care client tickets and accounts | For as long as the Care plan runs, then deleted or handed back within 30 days of it ending as the data processing terms say, apart from records we must keep |
| Sign-in links, sessions and security challenges | Removed within 30 days of expiring |
| Email delivery log | 90 days |
| Security audit log (who did what, and when) | 6 years |
7. How we protect it
Passkey sign-in, encryption in transit, encrypted storage, limited access (only the people and assistants working for Clarwyn IT), and a record of security-relevant actions. If a personal data breach puts people at risk we will report it to the ICO within 72 hours, and tell the people affected where the law says we must.
8. Your rights
You can ask us to: give you a copy of your data, correct it, delete it, restrict how we use it, give you it in a portable form, or stop using it where we rely on legitimate interests. You can also ask for a person to review any automated decision. Email support@clarwyn.co.uk. We reply within one month, and we may need to confirm who you are first. These rights have some limits: for example we cannot delete records we must keep by law.
9. Complaints
Please tell us first, and we will try to put it right and reply within 30 days. You can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. You can also go to court.
10. Cookies
We use only the cookies the portal needs to work. See the cookie notice.