Privacy notice
Effective date: 2 October 2026
Who we are
Controller: BYFORCEUK LTD, trading as BYFORCE. Company number 17395733, registered in England and Wales. Registered office: 66 Paul Street, London, England, United Kingdom, EC2A 4NA. Privacy and data-rights requests can be sent to dan@byforce.uk.
What this notice covers
This notice covers personal data BYFORCE uses for website enquiries, fixed-scope service intake, orders and payments, delivery and support, business administration, security, and relevant business-to-business sales activity. When BYFORCE processes personal data contained in a client's systems solely on that client's instructions to deliver an implementation, the client will generally act as controller and BYFORCE as processor; appropriate data-processing terms will apply where required.
Information we collect
Depending on how you interact with us, we may process your name, job title or business role, employer or company, work email, telephone number, website, systems and tools used, workflow or operational problem descriptions, desired outcomes, timing, correspondence, order and service records, payment/customer identifiers returned by Stripe, and technical/security information generated when our services are used. BYFORCE does not receive full card numbers from Stripe Checkout.
Where information comes from
We receive information directly from people who contact or buy from us. For relevant B2B business development, we may also use business contact information from company websites, professional or business directories, public business sources, professional networks, or business-data providers. We may receive service and payment status information from providers supporting the website or delivery.
Why we use personal data and our legal bases
- Enquiries, scoping and orders: to respond to requests and take steps before entering a contract, and to perform a contract once agreed.
- Delivery, support and account administration: to perform contracts and pursue our legitimate interests in operating and supporting our B2B services.
- Payments, accounting, tax and legal records: to perform contracts and comply with legal obligations.
- Security, fraud prevention and service integrity: for our legitimate interests in protecting BYFORCE, customers and systems.
- Website performance and conversion measurement: for our legitimate interests in understanding which pages, calls to action, demonstrations and purchase steps are useful, using first-party event records designed not to contain form contents or unnecessary personal data.
- Relevant B2B business development: where permitted, for our legitimate interests in finding and contacting businesses that may have a relevant operational need. We assess those interests against the rights and expectations of the business contact and honour applicable objections and opt-outs.
- Consent-based activity: where the law requires consent, we will request it separately and you may withdraw it for future processing.
B2B marketing and opt-outs
BYFORCE may contact business organisations and business contacts about services relevant to their role or company. Marketing messages identify BYFORCE and provide a way to opt out. If you object to direct marketing, we will stop using your personal data for that purpose. We may retain the minimum information needed on a suppression list so that we can respect the opt-out in future.
Who we share information with
We use service providers where needed to operate or deliver the service. These may include Cloudflare for website/application infrastructure, Stripe for checkout and payment processing, our business email provider, and vetted technical subcontractors or specialist providers used for an agreed implementation. We may also disclose information where required by law, to protect legal rights, or in connection with a legitimate corporate transaction. Providers and subcontractors receive only the access reasonably needed for their role and are subject to appropriate contractual, confidentiality and data-protection obligations where required.
International transfers
BYFORCE is a UK company serving customers primarily in the United States, and some providers or project participants may process personal data outside the United Kingdom. Where UK data-protection law requires a transfer safeguard, we use an applicable adequacy regulation or appropriate contractual safeguard, such as the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, as appropriate to the transfer. Contact us if you need further information about safeguards relevant to your data.
How long we keep information
- Enquiries and unsuccessful or out-of-scope prospects: normally up to 12 months after the last meaningful interaction, unless a shorter period is appropriate or we need a record for a dispute, security matter or legal obligation.
- Marketing suppression records: the minimum identifier and opt-out record may be kept for as long as reasonably necessary to ensure the objection continues to be respected.
- Customer, contract and project records: normally up to 6 years after the engagement ends where needed for contractual, legal, accounting or claims purposes.
- Accounting and tax records: retained for the period required by applicable law, which for UK limited-company accounting records is generally 6 years from the end of the relevant financial year and may be longer in specified circumstances.
- Operational and security records: retained only for as long as reasonably necessary for security, troubleshooting and service integrity, subject to provider settings and legal requirements.
We may delete or anonymise information earlier where it is no longer needed, and may retain it longer where there is a legal requirement, active dispute, fraud/security investigation or other documented lawful reason.
Cookies and device storage
The current BYFORCE website does not set analytics or advertising cookies and does not use browser localStorage or sessionStorage for analytics tracking. It records limited first-party conversion events, such as page views, calls to action, demo interactions and purchase-stage transitions, to BYFORCE's own application database. The anonymous visit identifier exists only in page memory and is not persisted in browser storage. The order flow may use sessionStorage for a strictly functional request identifier so retries do not create duplicate orders; that identifier is not used for advertising or cross-site tracking. Infrastructure, security and hosted checkout providers may use storage that is necessary to provide, protect or complete the service requested.
Security
We use technical and organisational measures appropriate to the nature of the service and data, including controlled access, authenticated service endpoints and provider security controls. No internet service can guarantee absolute security.
Your data-protection rights
Depending on the circumstances and lawful basis, applicable UK data-protection law may give you rights to access, correct, erase or restrict your personal data, request portability, or object to processing. Where processing is based on consent, you may withdraw consent for future processing. Rights are not absolute and lawful exemptions may apply. Send requests to dan@byforce.uk.
Your right to object to direct marketing
You have the right to object at any time to the use of your personal data for direct marketing. If you object, BYFORCE will stop using your personal data for that purpose.
Complaints
Please contact us first if you have a privacy concern so we can address it. You also have the right, where applicable, to complain to the UK Information Commissioner's Office (ICO).
Automated decisions
The website may automatically validate form completeness, fixed-scope package boundaries and payment status. Those checks do not make a solely automated decision with legal or similarly significant effect about whether BYFORCE will serve you. Out-of-scope submissions can be routed for human review.
Changes to this notice
We may update this notice when our services, providers or legal obligations change. The effective date above identifies the current version.