Home/Privacy
Privacy notice
This notice explains what personal data StratoFlow Ltd collects, why we collect it, how long we keep it and what rights you have over it.
1. Who we are
StratoFlow Ltd (“StratoFlow”, “we”, “us”) is a logistics consultancy and software development company registered in England and Wales under company number 17058105, with its registered office at 4 Cavendish Court, South Parade, Doncaster, DN1 2DJ, United Kingdom.
We are the data controller for the personal data described in this notice. We are registered with the Information Commissioner’s Office (ICO) under registration number ZC222556.
You can reach us at hello@stratoflow.co.uk or +44 (0) 330 520 2004.
2. What this notice does and does not cover
It covers personal data where we decide why and how it is processed: visitors to this website, people who make an enquiry, and our contacts at client and supplier organisations.
It does not cover personal data we handle inside a client’s own systems during an engagement — staff records in a warehouse management system, for example, or customer records in an order platform we are integrating. There we act as a processor on the client’s documented instructions, under the data protection terms in our engagement contract. In those cases the client is the controller and their own privacy notice applies.
3. The personal data we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Enquiry data | Your name, company, email address, phone number and the content of your message | You, through the contact form or by emailing us |
| Client and supplier contacts | Names, job titles and business contact details of the people we work with | You, your colleagues, or public business sources |
| Engagement records | Correspondence, meeting notes, reports, timesheets and invoices | Created in the course of the work |
| Technical data | IP address, browser type, pages requested and timestamps, in standard web server logs | Your browser, automatically |
| Preference data | Whether you chose the light or dark version of this site | Stored in your own browser — see our cookie policy |
We do not knowingly collect special category data (health, ethnicity, political opinions and similar), and we ask that you do not include any in an enquiry.
4. Why we use it, and our lawful basis
Under UK GDPR we must have a lawful basis for each purpose. Ours are:
| Purpose | Lawful basis |
|---|---|
| Replying to your enquiry and discussing possible work | Legitimate interests — responding to people who choose to contact us |
| Delivering the services we have been engaged to provide | Performance of a contract; or legitimate interests where the contract is with your employer |
| Managing the relationship, raising invoices and collecting payment | Performance of a contract; legitimate interests in being paid |
| Keeping accounting, tax and corporate records | Compliance with a legal obligation |
| Keeping this website secure, available and free from abuse | Legitimate interests in protecting our systems |
| Occasional relevant updates to existing business contacts | Legitimate interests in business development, with an unsubscribe link in every message |
Where we rely on legitimate interests we have considered whether those interests are overridden by your interests, rights and freedoms, and concluded they are not. You can object at any time — see section 9 — and for direct marketing we will always stop on request.
We do not carry out automated decision-making or profiling that produces legal or similarly significant effects.
5. Cookies
This site sets no tracking cookies and runs no analytics or advertising. The full detail is in our cookie policy.
6. Who we share it with
We do not sell personal data and we do not share it for anyone else’s marketing. We do share it with:
- Service providers acting as our processors — website hosting, email, file storage and accounting software. They act only on our instructions and are bound by contract.
- Professional advisers — accountants, lawyers and insurers, where genuinely necessary.
- Regulators, courts or law enforcement, where we are legally required to do so.
- A purchaser or successor, if we sell or reorganise the business, on terms that protect your data.
7. Where your data is stored, and international transfers
We host this website and store working files in the United Kingdom or the European Economic Area wherever practical. Some of our suppliers may process data outside the UK. Where that happens we rely on UK adequacy regulations, or on the ICO’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any additional safeguards the transfer requires.
One transfer happens simply by visiting this site: the typeface is served by Google Fonts, so your browser connects to Google’s servers and Google receives your IP address. See the cookie policy for how to avoid that.
8. How long we keep it
| Data | Retention period |
|---|---|
| Enquiries that do not lead to work | Up to 24 months from our last contact, then deleted |
| Client engagement records | For the length of the relationship, then 6 years — the limitation period for contract claims in England and Wales |
| Accounting and tax records | 6 years from the end of the relevant accounting period, as required by the Companies Act 2006 and HMRC |
| Website server logs | A short rolling period set by our hosting provider, typically weeks |
| Your theme preference | Stays in your browser until you clear your site data |
9. Your rights
You have the right to:
- be told how we use your data, which is what this notice does;
- ask for a copy of the personal data we hold about you;
- have inaccurate data corrected, or incomplete data completed;
- ask us to delete data where there is no good reason for us to keep it;
- ask us to restrict how we use it while a concern is resolved;
- object to processing based on legitimate interests, and to direct marketing at any time;
- receive data you gave us in a portable, machine-readable format; and
- withdraw consent, where we relied on consent, without affecting earlier processing.
To exercise any of these, email hello@stratoflow.co.uk. We will respond within one month. If a request is complex we may extend that by a further two months and will tell you if so. There is normally no charge. We may need to verify your identity first.
10. Complaints
If you are unhappy with how we have handled your data, please tell us first — we would like the chance to put it right. You also have the right to complain to the ICO at any time:
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF · Helpline 0303 123 1113 · ico.org.uk
11. How we keep it secure
Data is encrypted in transit using TLS. Access is limited to the people who need it, on accounts protected by strong, unique credentials and multi-factor authentication where the service supports it. We assess suppliers before we use them, avoid keeping copies of client data we do not need, and delete working data at the end of an engagement unless we are required to retain it.
12. Changes to this notice
If we change this notice we will update the date below, and we will tell affected people directly where a change is significant.
Last updated: August 2026. Questions about this page? Email hello@stratoflow.co.uk or call +44 (0) 330 520 2004.