Privacy Policy¶

1. About this policy¶

This Privacy Policy explains how TWOFOX Limited, trading through twfx.dev ("we", "us" or "our"), uses personal data in connection with the twfx.dev website (the "Website") and our software-development and technical-consultancy Services.

TWOFOX Limited is the controller of personal data covered by this policy where we decide why and how that data is processed. This includes personal data of Website visitors, people who contact us, and Clients and their representatives in relation to an enquiry or Project.

TWOFOX Limited has appointed a Data Privacy Manager. If you have a question about this policy or want to exercise a data-protection right, please contact the Data Privacy Manager through our contact page.

This policy does not replace any Project-specific data-processing terms. Where we process personal data for a Client as part of a Project, those terms may set out additional information about the processing.

2. Personal data we collect¶

The personal data we collect depends on how you interact with us. It may include:

• identity and contact data, such as your name, business or organisation, email address, telephone number and business address;
• enquiry and correspondence data, such as the content of messages, requested Services, quotations, specifications and other information you choose to provide;
• Project data, including information in Project files, technical material, support requests, feedback and communications;
• billing and transaction data, such as invoice information, payment status and transaction references; and
• technical and security data generated when you use the Website, such as IP address, browser and device information, server-log information, and security or anti-abuse information associated with the contact form.

We collect data directly from you when you use the Website, send an enquiry or correspond with us. We may also receive it from a Client, a person acting for a Client, a payment provider, or another person who has authority to provide it in connection with a Project.

Please do not provide personal data that is not relevant to your enquiry or Project. In particular, do not send special-category personal data unless it is necessary and we have agreed an appropriate way to handle it.

3. How we use personal data and our lawful bases¶

We use personal data only where the law permits. Depending on the purpose, we rely on one or more of the following lawful bases: taking steps at your request before entering into a contract or performing a contract; complying with a legal obligation; and our legitimate interests in operating, protecting and developing our business, provided those interests are not overridden by your rights and interests.

We do not use contact details for marketing mailing lists. Project-related email communications are used for enquiries, Projects, support and related business administration.

4. Project data and data-protection roles¶

During a Project, a Client may provide personal data in specifications, datasets, files, systems or support material. The role of TWOFOX Limited in relation to that data depends on the circumstances and the agreed Project scope.

Where we process personal data solely on a Client's documented instructions in order to provide the Services, the Client will normally be the controller and TWOFOX Limited will act as its processor. The parties will put appropriate data-processing terms in place where required. Those terms, rather than this policy, govern that processing relationship.

We do not routinely engage subcontractors to process Client Project data. If this becomes necessary for a Project, it will be addressed in the applicable Project and data-processing terms.

5. Who we share personal data with¶

We may share personal data only where necessary for the purposes described in this policy. Recipients may include:

• providers of website hosting, email and storage services;
• PayPal or Stripe where a Client chooses to use the relevant service to make a payment. Those providers process payment-related personal data under their own privacy notices and terms;
• professional advisers, insurers, banks and other service providers where needed to run our business or deal with a legal claim;
• public authorities, regulators or other parties where disclosure is required by law or necessary to protect legal rights; and
• a purchaser, successor or adviser in connection with a proposed or completed reorganisation, sale or transfer of all or part of our business.

We do not sell personal data or share it with third parties for their direct marketing purposes.

6. International transfers¶

Some of our service providers, including payment providers, may process personal data outside the United Kingdom. Where a transfer is subject to UK data-protection law, we will use an appropriate transfer mechanism recognised by that law and take supplementary measures where required.

You may contact us using the details in section 1 if you would like further information about the safeguards applicable to a particular transfer.

7. Retention¶

We keep personal data only for as long as it is needed for the purpose for which it was collected, including legal, accounting and reporting requirements. Our usual retention periods are:

• enquiries that do not lead to an engagement: 12 months after the enquiry is closed; and
• completed Project records, including related correspondence and ordinary business records: 6 years after the Project is completed.

We may retain information for longer where necessary to establish, exercise or defend legal claims, comply with a legal obligation, or deal with an unresolved issue. Secure backup copies may remain until they are replaced or overwritten under normal backup processes.

8. Security¶

We use appropriate technical and organisational measures intended to protect personal data against accidental or unlawful loss, access, use, alteration and disclosure. Access is limited to people and service providers who need it for a legitimate business purpose.

No method of transmission or storage is completely secure. If we become aware of a personal-data breach, we will take the steps required by applicable law, including notifying affected people or regulators where required.

9. Your rights¶

Subject to applicable law, you may have the right to:

• request access to your personal data;
• ask us to correct inaccurate or incomplete data;
• ask us to erase data in certain circumstances;
• ask us to restrict processing in certain circumstances;
• object to processing based on legitimate interests;
• request portability of data you provided, where the right applies; and
• withdraw consent at any time where we rely on consent. Withdrawal does not affect processing already carried out before it was withdrawn.

To exercise a right, contact the Data Privacy Manager as described in section 1. We may ask for information needed to verify your identity. We normally respond within one month, subject to the extensions permitted by law for complex or numerous requests.

You also have the right to complain to the UK Information Commissioner's Office (ICO). We would appreciate the opportunity to address your concern first. Information about making a complaint is available on the ICO website.

10. Cookies and third-party websites¶

Our Cookie Policy explains the Website's use of cookies and similar technologies. The current Website does not use cookies for analytics, advertising or visitor tracking during normal anonymous browsing. The contact form uses Cloudflare Turnstile to help protect the Website from spam and abuse; this can involve processing technical information even where no cookies are set.

The Website may link to third-party websites. Their privacy practices are governed by their own policies, and we are not responsible for them.

11. Changes to this policy¶

We may update this policy from time to time to reflect changes to our processing activities or legal requirements. We will publish the updated policy on this page and change the "Last updated" date below.

Last updated: 2026-09-21