1Who we are
DevSpin is the trading name of DEVSPIN LTD, a company registered in England and Wales under company number 17442742. Our registered office is 19 Greenhead Road, Huddersfield, England, HD1 4EN.
DEVSPIN LTD is the data controller for the personal information described in this policy. This means we decide why and how that information is used.
Our Chief Executive Officer oversees privacy matters. You can contact us at info@devspin.io or write to our registered office, marked “Privacy — DevSpin”.
We handle personal information in accordance with applicable data protection law, including the UK General Data Protection Regulation and the Data Protection Act 2018, as amended.
2What this policy covers
This policy covers personal information used for:
- Operating and securing devspin.io.
- Responding to enquiries through our website, email, telephone or WhatsApp.
- Arranging consultations and appointments through Calendly.
- Preparing proposals and administering client relationships and projects.
- Maintaining necessary contractual, financial and accounting records.
- Handling privacy requests, complaints and legal matters.
It applies to individual customers and to people who contact us on behalf of a business or another organisation.
Where a client instructs us to process personal information within its own systems or datasets, the client may be the controller and DevSpin its processor. That processing must be covered by the relevant project arrangements and data-processing terms. This policy does not replace the client's own privacy notice.
3Information we collect
The information we collect depends on how you interact with us. It can include:
- Contact and identity details: your name, email address, telephone number and any business name or role you provide.
- Enquiry and project information: the service you are interested in, your project description, requirements, correspondence and information you choose to share with us.
- Appointment information: your booking details, chosen date and time, time zone, contact details and answers to scheduling questions.
- Communication information: emails, messages, attachments, relevant call notes and WhatsApp contact or profile details visible to us. Call notes are different from audio or video recordings.
- Client and financial records: proposal and contract details, billing information, invoices, payment status and records needed for accounting.
- Technical information: connection and security information processed by our website infrastructure, which can include IP addresses, browser details, access times, requested pages and technical error information.
We normally obtain information directly from you. We also receive information through services you use to contact or book with us, such as Calendly and WhatsApp. A colleague or representative may provide your business contact details in connection with an enquiry or project.
If you provide another person's information, share only what is necessary and ensure you are entitled to provide it. Please direct that person to this policy where appropriate.
Please do not send passwords, full payment-card details, identity documents, health information or other sensitive personal information through an ordinary enquiry form, email or WhatsApp message. If a project requires access to sensitive information or systems, appropriate arrangements must be agreed first.
You can choose not to provide information. However, without sufficient contact or project details, we may be unable to answer your enquiry, arrange a consultation or provide the requested service. Information required for a contract or a legal obligation will be identified when relevant.
4How and why we use your information
We use a lawful basis appropriate to each activity. Sending us an enquiry does not automatically enrol you in marketing or amount to consent to every possible use of your information.
Our purposes and lawful bases
| Purpose | Lawful basis |
|---|---|
| Answering your enquiry, discussing requirements and preparing a proposal for you personally. | Taking steps at your request before entering into a contract, where applicable. For general enquiries, our legitimate interest in responding to people who contact us. |
| Communicating with you as a representative of a business or organisation. | Our legitimate interests in managing business enquiries, providing services and maintaining effective client relationships. |
| Scheduling consultations and sending appointment confirmations or changes. | Pre-contractual steps or performance of a contract with you, where applicable; otherwise our legitimate interest in organising requested meetings. |
| Administering and delivering a service contracted with you personally. | Performance of our contract with you. |
| Issuing invoices, recording payments and keeping required tax and accounting records. | Compliance with legal obligations; contract performance or legitimate interests for related billing administration, as applicable. |
| Protecting our website and communications, investigating misuse and resolving technical problems. | Our legitimate interests in maintaining secure, reliable systems and preventing fraud or abuse. |
| Responding to data protection requests, investigating complaints and complying with binding legal requirements. | Compliance with legal obligations; legitimate interests where needed to investigate other complaints or establish, exercise or defend claims. |
When relying on legitimate interests, we consider the necessity of the processing and its effects on your rights and reasonable expectations.
If we introduce an activity that requires consent, we will explain it and obtain that consent before the relevant processing begins. You can withdraw consent at any time. Withdrawal does not affect processing that was lawful before you withdrew it.
5Storage, access and sharing
Website enquiries are received and retained in our email system. Relevant details are entered into an Excel spreadsheet used to manage enquiries and follow-up. We also retain relevant correspondence within the communication or booking service used.
Our Chief Executive Officer handles customer information. Our Pakistan-based team members are not given access to customer information. This internal restriction does not prevent necessary processing by the service providers described below.
Who may receive information and why
| Recipient | Purpose |
|---|---|
| Hostinger and its relevant service providers | Website hosting, email delivery and storage, security and associated technical services. |
| Calendly | Collecting and administering appointment details when you book a consultation through Calendly. |
| Providing the messaging service when you choose to communicate with us through WhatsApp. | |
| Accountants, legal advisers and other professional advisers, where needed | Necessary accounting, tax, legal or professional advice, subject to appropriate confidentiality obligations. |
| Regulators, courts, law-enforcement bodies or other legally entitled recipients | Meeting a legal obligation or responding to a lawful request, or where disclosure is otherwise necessary and lawful to protect rights. |
We share only information relevant to the purpose. Providers processing information on our behalf are subject to applicable data-processing arrangements.
Some providers also process information independently for their own purposes, such as operating their accounts or maintaining the security of their services. Their notices explain that processing:
We do not sell your enquiry or client-administration information or provide it to other organisations for their own direct marketing.
6International processing
The providers used to operate our website, email, scheduling and messaging services may process information outside the United Kingdom. Restricting access within DevSpin does not mean that all provider processing takes place in the UK.
Calendly processes booking information in the United States and uses service providers in other locations. Hostinger and WhatsApp also operate through international infrastructure and service providers.
The applicable provider agreements set out protections for this processing. For transfers subject to UK international-transfer restrictions, the relevant protection may be UK adequacy regulations, including an applicable and valid UK Extension to the EU–US Data Privacy Framework, or appropriate contractual safeguards such as the UK International Data Transfer Agreement or the UK Addendum to EU Standard Contractual Clauses. The mechanism must be applicable to the particular transfer.
Hostinger's data-processing addendum includes UK transfer provisions. Calendly's published data-processing terms describe its Data Privacy Framework arrangements and contractual fallback protections. WhatsApp publishes UK-specific business data-transfer terms.
Contact info@devspin.io for further information about the arrangements relevant to your information or to request a copy of applicable safeguards, with confidential information removed where appropriate.
7Cookies and external services
Cookies and similar technologies can store information on, or access information from, your device.
Our website is configured to use only technologies necessary to operate and secure the website or provide a function you request. Optional advertising, behavioural tracking and analytics technologies are not enabled under this policy.
Necessary technologies may support functions such as security, session management or remembering a privacy choice. They are not used by DevSpin to build advertising profiles.
When you follow a link to Calendly, WhatsApp or another external website or application, that service may use its own cookies or similar technologies. Its notices and controls explain those activities. Loading an embedded third-party feature can also involve processing by that provider; features requiring permission must not load before that permission is given.
You can use your browser settings to inspect, delete or block cookies. Blocking necessary technologies may affect website functionality.
Before introducing optional tracking, we will provide information about its providers, purposes and duration, update the relevant notices, and implement the consent or other controls required by law.
8How long we keep information
We retain personal information only for as long as it is needed for the purpose for which it was collected, including applicable contractual, legal and record-keeping requirements.
Our retention schedule
| Record | Retention |
|---|---|
| Enquiries and related consultation records that do not become projects | Normally deleted 12 months after the last meaningful contact. |
| Accepted proposals, contracts and essential project correspondence | Normally retained for six years after the engagement ends, limited to information needed for contractual records or legal claims. |
| Invoices and accounting records | Six years from the end of the financial year concerned, or longer where required by law. |
| Client-provided datasets and system access | Data is returned or deleted, and access revoked, when no longer needed, in accordance with the project and data-processing arrangements. Only information necessary for agreed ongoing support or a legal obligation is retained. |
| Technical and security records | Kept for the period needed to operate and protect the relevant systems, investigate incidents and meet applicable obligations. Relevant incident records may need to be retained separately while an investigation or claim remains open. |
| Privacy requests and complaint records | Kept while the matter is being handled and afterwards only as necessary to demonstrate how it was resolved, meet legal obligations or deal with a related claim. |
We may retain particular records for longer where required by law or where a dispute, investigation or legal claim makes this necessary. We limit any extension to the relevant records and purpose.
Deletion applies to copies within our control, including relevant email and spreadsheet records. Copies in restricted recovery backups may remain until they are overwritten or deleted through the applicable backup cycle. They must not be used as active records; relevant deletion requirements must be reapplied if a backup is restored.
Providers acting independently may retain their own records under their privacy notices and legal obligations.
9Protecting information
We restrict access to customer information and are responsible for maintaining technical and organisational measures appropriate to the information and the risks. This includes managing access to our email accounts, enquiry register and associated systems, and limiting the information shared with others.
No internet service or electronic storage system can be guaranteed completely secure. Please contact us promptly if you believe information relating to DevSpin has been accessed or disclosed without authorisation.
Where a personal data breach occurs, we will assess it and make any notifications to affected individuals and the relevant regulator required by law.
10Your rights
Depending on the circumstances and applicable law, you may have the right to:
- Access your personal information and receive a copy.
- Have inaccurate information corrected or incomplete information completed.
- Request deletion of information.
- Restrict how information is used.
- Receive certain information in a portable format.
- Object to processing based on legitimate interests.
- Withdraw consent where consent is the lawful basis.
- Complain to the relevant data protection regulator.
To make a request, email info@devspin.io or contact us through another available channel. You do not need to use a particular form or legal wording.
We may ask for information reasonably needed to verify your identity or clarify your request. Requests are normally free of charge. We will explain any lawful exception, restriction or permitted fee that applies.
We respond without undue delay and normally within one calendar month. Where the law permits an extension, for example for a complex request or multiple requests, we may extend this by up to a further two months. We will explain the extension and the reasons within the applicable initial response period.
These rights are not absolute. Where we cannot comply fully, we will explain the reason and the options available to you.
11Questions and complaints
If you have a concern about our use of personal information, contact info@devspin.io. Using “Privacy complaint” in the subject line helps us identify your message, but is not a requirement.
We will acknowledge a data protection complaint within 30 days, investigate without undue delay, keep you informed as appropriate and explain the outcome without undue delay. This complaint process is separate from the response periods for exercising your data protection rights.
You also have the right to complain to the UK Information Commissioner's Office. We encourage you to contact us first so that we have an opportunity to address your concern. This does not remove your right to contact the regulator.
Visit ico.org.uk/make-a-complaint. Where applicable, you may also complain to a relevant supervisory authority in your country.
12Children and changes to this policy
Our website is directed at people seeking software, website and related professional services. We do not request children's personal information through our general enquiry channels. If you believe a child has provided information that we should not retain, please contact us.
We may update this policy when our services, practices or legal obligations change. The date at the top shows when it was last updated.
Where a material change affects how we use your information, we will provide appropriate notice and obtain any permission required before making that change. An update to this policy does not itself authorise a new use of your information.