This policy explains how CommerceStream ("we", "us", "our") collects and uses personal data when you visit this website, contact us, apply for a role or work with us. We are the data controller for that data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

If you have any questions about this policy or how we handle your data, email us at info@commercestream.io.

What data we collect

Information you give us

• Enquiries – when you email, call or message us through the contact form, we collect your name, email address, phone number (if provided), company and anything you include in your message.
• Job applications – when you apply for a role, we collect your name, email address, location, experience, CV and any other information you choose to send.
• Newsletter – if you subscribe to our newsletter, we collect your email address.
• Clients – when we work together, we collect the business contact details of the people we deal with and the information needed to deliver, invoice and support our services.

Information collected automatically

If you accept analytics cookies, we use Google Analytics to collect information about how you use the site, such as the pages you visit, how long you stay, the website that referred you, your approximate location (country or city), and your device and browser type. Google Analytics does not give us your name or contact details.

How and why we use your data

• Responding to enquiries and preparing proposals – our legitimate interest in responding to people who contact us, or taking steps at your request before entering a contract.
• Delivering, invoicing and supporting our services – performance of a contract.
• Assessing job applications – our legitimate interest in recruiting, or taking steps at your request before entering a contract.
• Sending our newsletter – your consent.
• Understanding how the site is used so we can improve it – your consent.
• Meeting legal, tax and accounting obligations – legal obligation.

We do not sell your personal data, and we do not use it for automated decision-making or profiling.

Cookies

We only use non-essential cookies if you agree to them. When you first visit the site we ask whether you accept analytics cookies, and nothing is set until you choose.

• _ga (Google Analytics) – distinguishes unique visitors. Expires after 2 years.
• _ga_{ID} (Google Analytics) – keeps track of the current session. Expires after 2 years.

We also store your cookie choice in your browser's local storage so we don't ask you again on every visit. This is strictly necessary to remember your preference.

You can change your choice at any time using the Cookie Settings link in the footer of every page, or by clearing cookies in your browser.

Who we share your data with

We share personal data only where needed, with:

• Service providers who help us run our business, such as website hosting, email, analytics (Google) and accounting providers. They act on our instructions and may not use your data for their own purposes.
• Patchworks and other technology partners, where needed to deliver a project you have engaged us for.
• Professional advisers, such as accountants and lawyers.
• Authorities, where we are required to by law.

International transfers

Some of our service providers, including Google, may process data outside the UK. Where this happens, we make sure appropriate safeguards are in place, such as the UK Extension to the EU–US Data Privacy Framework or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses.

How long we keep your data

• Enquiries – up to 2 years from our last contact, unless we go on to work together.
• Client records – for the length of our relationship and then 6 years, to meet tax and accounting requirements.
• Job applications – up to 6 months after the role is filled, unless you agree to us keeping your details for future roles.
• Newsletter – until you unsubscribe.
• Analytics data – Google Analytics retains event data for up to 14 months.

Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you
• have inaccurate data corrected
• have your data erased
• restrict or object to how we use your data
• receive your data in a portable format
• withdraw consent at any time, where we rely on consent (this does not affect anything we did before you withdrew it)

To exercise any of these rights, email info@commercestream.io. We will respond within one month. There is normally no charge.

Security

We use appropriate technical and organisational measures to protect your personal data, including access controls and encrypted connections. No method of transmission over the internet is completely secure, but we work to protect your data from loss, misuse and unauthorised access.

Complaints

If you are unhappy with how we have handled your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk or on 0303 123 1113.

Changes to this policy

We may update this policy from time to time. The date at the top of this page shows when it was last changed.