1Who we are
Winter Shand Digital Ltd ("we", "us", "our") is a company registered in England and Wales under company number 17387960, with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.
We build custom software for business clients. We are the data controller for the personal data described in this notice.
You can contact us about anything in this notice at privacy@wintershanddigital.com.
2What this notice covers
This notice explains how we handle personal data when you:
- visit wintershanddigital.com;
- receive a business email from us;
- contact us, or apply for a role with us;
- work with us as a client, or for a client that has engaged us.
Where we build or operate software for a client, that client is usually the controller of the data in that system and we act as their processor on their instructions. In that case, the client's own privacy notice governs, not this one.
3The personal data we handle
| Where it comes from | What it is |
|---|---|
| You contacting us | Name, business email, phone, company, role, and whatever you put in your message |
| Business contact data we collect ourselves | Name, business email, job title, employer, company website, and publicly available professional information including professional profile URLs — collected from company websites, professional networks and business directories |
| Job applicants | Name, contact details, CV or work history, right-to-work information, and anything you send us |
| Our website | See section 9 |
| Client engagements | Contact details of the people we work with at a client, and correspondence |
We do not seek or want special category data — health, race, religion, political opinion, sexual orientation, trade union membership, biometric or genetic data. Please do not send it to us.
4Why we handle it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Replying to you when you contact us | Legitimate interests — responding to an enquiry you made |
| Sending business emails about our services to people at organisations we believe may need them | Legitimate interests — direct marketing to business contacts at corporate organisations |
| Providing services under a contract, and managing the relationship | Contract, or legitimate interests where you are a contact at a corporate client |
| Invoicing, accounting and tax records | Legal obligation |
| Recruitment | Legitimate interests, and legal obligation for right-to-work checks |
| Website security and preventing misuse | Legitimate interests |
On the marketing basis specifically. We contact people in a professional capacity, at their work email, about services relevant to their role at their employer. We have carried out and documented an assessment of whether this overrides your interests and rights, and concluded that it does not — but you can disagree at any time, and section 5 tells you how. We do not send marketing to individuals at personal email addresses. We do not use tracking pixels or open tracking in our emails. We do not sell or rent our contact data to anyone.
5Your rights
You have the right to:
- ask what we hold about you and get a copy;
- have inaccurate data corrected;
- ask us to delete it;
- object to processing we carry out on the basis of legitimate interests — including all direct marketing, which we will always stop on request, without question and without needing a reason;
- ask us to restrict how we use it;
- receive it in a portable format, where that right applies;
- withdraw consent, where we relied on consent.
To exercise any of these, email privacy@wintershanddigital.com. We will respond within one month. There is no charge.
To stop receiving emails from us, use the unsubscribe link in any email, or simply reply asking us to stop. Either works, and we act on both.
6Who we share it with
We share personal data only where we need to:
- Service providers who process data on our behalf — email and productivity software, email delivery and outreach tools, website hosting, accounting software, and professional advisers. They act on our instructions and cannot use your data for their own purposes.
- Our contractors, who provide services to us under written agreements containing confidentiality and data protection obligations.
- Professional advisers — lawyers, accountants, insurers.
- Authorities, where the law requires it.
We do not sell your personal data. We do not share it for anyone else's marketing.
A current list of our processors is available on request at privacy@wintershanddigital.com.
7Sending data outside the UK
Some of the people who work for us are based outside the United Kingdom, including in the Philippines. This means your personal data may be accessed or processed outside the UK.
The Philippines is not covered by a UK adequacy decision. Where we transfer personal data there, we do so under a UK International Data Transfer Agreement (IDTA), supported by a transfer risk assessment, so that your data has essentially the same protection as it does in the UK.
You can ask us for details of the safeguards we use at privacy@wintershanddigital.com.
8How long we keep it
| What | How long |
|---|---|
| Enquiries that do not become business | 12 months from last contact |
| Business contacts we have emailed | Kept while relevant to their role, and 12 months after any objection or unsubscribe — we keep a minimal suppression record permanently so we do not contact you again by mistake |
| Client records | Duration of the engagement, then 6 years for legal, tax and insurance purposes |
| Job applicants | 6 months after the decision, unless you ask us to keep you on file |
| Accounting records | 6 years, as UK law requires |
9Our website
We do not use tracking or advertising cookies on this website, and we do not use analytics. We use only what is strictly necessary for the site to work and to keep it secure.
Our hosting provider records standard technical information such as IP address and browser type, for security and reliability.
This site loads a typeface from Google Fonts. Doing so means your browser makes a request to Google's servers, which receives your IP address. No cookie is set by us for this purpose, and we receive no information about you from it.
10Security
We take appropriate technical and organisational measures to protect personal data, including access controls, encryption in transit, multi-factor authentication on our systems, and written data protection obligations in every contractor agreement.
No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights, we will notify the Information Commissioner's Office within 72 hours and tell you where we are required to.
11Complaints
If you are unhappy with how we have handled your personal data, please tell us first at privacy@wintershanddigital.com — we would rather fix it.
You also have the right to complain to the UK supervisory authority:
Our ICO registration reference is ZC234712.
12Changes
We may update this notice. The date at the top shows when it last changed. Material changes will be flagged on this page.