Privacy Notice

1. Who we are

WEYSENS LTD (company number 17447599), registered office 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom, is the controller for the processing described here. Contact director@weysens.co.uk for privacy questions or rights requests.

2. Information we process

We may process business contact details, organisation and role information, enquiry and correspondence content, proposal and agreement records, invoice and payment-administration data, support records, limited security and audit metadata, and operational CSV evidence supplied for an agreed diagnostic. Stripe processes card details; WEYSENS does not request or store full payment-card details.

WEYSENS does not need company names or people’s names inside an operational dataset. Before upload, customers should remove or replace direct identifiers that are not necessary for the agreed diagnostic. Uploaded files are associated with an internal WEYSENS lead, case or file reference. Do not upload passwords, credentials, payment-card data, identity documents, special-category personal data, executable content or raw media. If necessary personal data remains in a file, the customer must have lawful authority to provide it and WEYSENS will process it only for the agreed service and related security, audit and legal purposes.

3. Sources, purposes and lawful bases

We obtain information from you, your organisation, our service providers and system-generated audit records. We use it to respond to enquiries and take requested steps before a contract; form, administer and deliver contracts; invoice and reconcile payments; provide support; maintain legal and financial records; and secure and improve our services.

Our lawful bases are steps at your request before entering a contract, performance of a contract, compliance with legal obligations, and legitimate interests in operating, protecting and improving a proportionate business-to-business service. Where consent is used, it may be withdrawn at any time without affecting earlier lawful processing.

4. Required and optional information

Contact, company, authority, billing and agreed service information is required to prepare and administer an engagement. If it is not provided, we may be unable to issue a proposal or invoice, accept an order, take payment or deliver the service. Optional marketing information is not required to obtain the service.

5. Recipients and service providers

Current provider categories include Cloudflare for the website, application and storage services; Microsoft 365 and SharePoint for business communications and records; Resend for transactional email; and Stripe for payment processing. Railway provides controlled CORE processing in an EU region, including analysis of authorised, minimised operational CSV evidence and PDF report and invoice generation for the agreed business diagnostic. External AI processing of customer data is not approved.

6. International transfers

Some providers may process information outside the United Kingdom. Where a restricted transfer applies, we use an available UK adequacy regulation, the UK International Data Transfer Agreement or UK Addendum, or another legally permitted safeguard. Contact us to request further information about the safeguard relevant to your data.

7. Retention

• Unconverted enquiries are reviewed for deletion after 12 months.
• Transactional email and operational security or audit records are reviewed after 24 months.
• Contract, invoice, accounting and payment records are kept for the period required by law and for legitimate claims.
• Uploaded CSV files are scheduled for deletion within 30 days after the suitability review or engagement ends, unless a shorter period is agreed or continued retention is necessary for the contracted service.

A documented legal hold, dispute, security incident or rights request may require a limited exception. Data is deleted or anonymised when no longer needed.

8. Security and automated decisions

We use access controls, encryption in transit, audit records, data minimisation and controlled release procedures appropriate to the service. No internet service can be guaranteed completely secure. WEYSENS does not use solely automated decisions that produce legal or similarly significant effects. Diagnostic outputs support human review and do not replace the client’s operational, engineering or safety decisions.

9. Your rights

Depending on the circumstances, you may have rights of access, rectification, erasure, restriction, portability and objection. You may also withdraw consent where consent is the basis. Contact us to exercise a right; we may need to verify your identity.

Your right to object

You have the right to object at any time to processing based on legitimate interests, including related profiling. You also have an absolute right to object to direct marketing. Email director@weysens.co.uk.

10. Complaints

Please contact us first so we can address your concern. You may also complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint or telephone 0303 123 1113.

11. Changes

We will publish material changes on this page and update the effective date. A copy can be requested by email.