Privacy Policy

Data Controller: FLINDOR LIMITED (Company No. 16669506)

Registered Office: 3 Pool Road, Leicester LE3 9GH, United Kingdom

Privacy Contact: Hello@flindor.co.uk

ICO Registration Reference: ZC063881

Effective Date: 23 October 2026

1. About Flindor Limited & Who We Are

This Privacy Policy explains how FLINDOR LIMITED (“we”, “us”, “our”, or “Flindor”) collects, uses, stores, and protects personal information when you visit our primary corporate website (https://flindor.co.uk), use our private enterprise platform Flindor OS (https://os.flindor.co.uk), or engage our digital, software engineering, and technical consultancy services.

Flindor Limited is a private limited company incorporated and registered in England and Wales:

  • Company Registration Number: 16669506
  • Registered Office: 3 Pool Road, Leicester LE3 9GH, United Kingdom
  • Operational Base: Leicester, Leicestershire, England, United Kingdom
  • Nature of Business (SIC Codes): 62012 (Business software development), 62020 (IT consultancy), 74100 (Specialised design)
  • Supervisory Authority: Registered as a data controller with the UK Information Commissioner’s Office (ICO) under registration reference ZC063881.

2. Scope of this Policy

This Privacy Policy applies to personal information processed by Flindor Limited in connection with:

  1. Public Website Visitors: Individuals who browse https://flindor.co.uk or submit technical and commercial enquiries through our forms or email channels.
  2. Business Clients & Commercial Partners: Representatives, contact persons, and personnel of prospective, current, and former corporate clients, partners, and suppliers.
  3. Flindor OS Platform Users: Authorised workforce members, directors, and administrative personnel accessing our private enterprise operating platform.
  4. Commercial Marketplace Integrations: Order fulfillment and inventory data governance relating to authorized commercial e-commerce channels, including our planned read-only eBay integration.

This policy does not govern third-party websites, applications, or external services linked to or from our website, which operate under their own independent privacy notices.

3. How to Contact Us & Privacy Enquiries

If you have questions about this Privacy Policy, wish to exercise statutory data rights, or have an enquiry regarding our data handling, please contact us:

  • By Email: Hello@flindor.co.uk
  • By Post: FLINDOR LIMITED, 3 Pool Road, Leicester LE3 9GH, United Kingdom
  • Privacy Lead: All data protection enquiries are handled by the Privacy Lead, Flindor Limited, reachable at our email or postal address.

4. Categories of Personal Information We Collect

Depending on your relationship with us, we collect and process the following categories of personal information:

  • Website Enquiry Data: Full name, business email address, company name, telephone number (optional), service interest, and enquiry message.
  • Commercial & Financial Records: Client representative contact details, billing/trading addresses, invoices, VAT identifiers, and commercial bank transaction records (currently processed through standard direct B2B corporate banking and invoices; automated Open Banking feeds are a planned future capability).
  • Enterprise Platform Data (Flindor OS): Staff identifiers, full names, business emails, role privileges, cryptographic password hashes (one-way salted hashes; plain passwords are never stored), and session tokens.
  • Technical & Security Telemetry: IP addresses, request timestamps, browser family, operating system, and security audit logs in Flindor OS.
  • Commercial Marketplace Data: For retail orders placed through marketplace integrations, customer delivery names, shipping addresses, purchased items, package tracking numbers, and sales summaries.

5. How We Collect Personal Information (Sources)

  • Directly from You: When you submit a contact form on flindor.co.uk/contact, email us, enter commercial discussions, or sign into Flindor OS.
  • Automatically via Server Infrastructure: Web servers automatically log standard HTTP requests for operational stability and security defense.
  • From Authorised External Platforms: When an authorised commercial integration is active, order and fulfillment information is received directly from the marketplace platform’s APIs to dispatch orders.
  • Public & Statutory Registers: Corporate registries such as Companies House for B2B commercial verification.

6. Purposes and Lawful Bases for Processing

Under the UK GDPR and the Data Protection Act 2018, every processing activity is grounded in an applicable lawful basis under Article 6(1):

Processing Purpose Categories of Data Lawful Basis (UK GDPR)
Responding to Website Enquiries Name, email, company, message Legitimate Interests (Art. 6(1)(f)) in responding to commercial enquiries and project requests.
Commercial B2B Client Communications Representative names, titles, business emails, phones Legitimate Interests (Art. 6(1)(f)) in administering and executing contracts with corporate clients.
Individual Client / Sole Trader Contracts Individual contractor names, billing details Contractual Necessity (Art. 6(1)(b)) where the individual is a direct contract party.
Flindor OS Workforce Management Staff names, emails, role privileges, logs Contractual Necessity (Art. 6(1)(b)) & Legitimate Interests (Art. 6(1)(f)) for platform access.
Statutory Accounting & Tax Compliance Invoices, ledger records, bank statements, VAT Legal Obligation (Art. 6(1)(c)) under UK Companies Act 2006 and HMRC rules.
Platform Security & Infrastructure Defense IP addresses, timestamps, audit logs Legitimate Interests (Art. 6(1)(f)) in protecting information security and network integrity.
Marketplace Order Fulfillment & Stock Reconciliation Customer shipping names, addresses, items purchased, fees Legitimate Interests (Art. 6(1)(f)) in fulfilling customer orders, managing inventory, and recording retail sales.
Marketplace Deletion Webhook Processing Marketplace deletion notices, user references Legitimate Interests (Art. 6(1)(f)) in complying with developer platform contractual terms and honoring consumer privacy preferences.
Statutory Erasure Compliance Associated customer personal data (where non-exempt) Legal Obligation (Art. 6(1)(c) & Art. 17 UK GDPR) to erase records upon statutory notice, except where retention is legally mandated.

7. Data Controller versus Data Processor Responsibilities

As a Data Controller: Flindor Limited acts as the Data Controller for website enquiries submitted to flindor.co.uk, commercial business contacts, Flindor OS employee accounts, marketplace retail order fulfillment, and statutory corporate records.

As a Data Processor: When providing bespoke software engineering, dedicated cloud databases, or custom platform infrastructure to enterprise clients, we may process client-hosted personal data strictly on behalf of and under documented client instructions. In such arrangements, data governance is governed by formal Data Processing Agreements (DPAs).

8. Customer, Staff & Platform Data Partitioning

Flindor OS enforces multi-tier access controls:

  • Director & Administrative Tier: Full access to financial records, master integration settings, and administrative controls is restricted to statutory directors and designated senior administrators.
  • Operational Staff Tier: Workforce personnel possess restricted views limited to timesheets, project tasks, and operational work orders. Confidential financial and marketplace credential vaults are restricted by role-based access controls.
  • Data Integrity Invariant: We enforce strict separation between isolated sandbox test fixtures and genuine commercial business records. Mock demonstration data is excluded from live operational datasets.

9. Third-Party Marketplace & Retail Integrations (eBay UK)

Flindor OS incorporates an integration architecture for our commercial retail operations on eBay UK (EBAY_GB).

A. Purpose & Operational Scope

When active, this integration allows Flindor Limited to manage its commercial e-commerce retail operations by:

  1. Reconciling inventory quantities across retail channels to prevent overselling.
  2. Viewing orders and customer delivery addresses strictly to package, dispatch, and fulfill purchased items.
  3. Reviewing transaction fees and sales summaries for statutory bookkeeping.

Our integration is designed strictly for internal inventory management and order fulfillment. The application does not publish, alter, or delete live retail listings, does not modify live product pricing, and does not initiate payments or financial disbursements.

B. Marketplace Personal Data Processed

For customers who purchase items from Flindor Limited through eBay, we process:

  • Customer name and delivery address (for shipping and dispatch)
  • Purchased item details and quantities
  • Order reference numbers and delivery tracking details
  • Financial transaction summaries associated with the sale

C. Marketplace Account Deletion & Consumer Erasure

In compliance with marketplace platform terms and UK GDPR Article 17, Flindor OS maintains an active endpoint to receive official customer erasure and account deletion notifications:

  • Contractual Platform Compliance: Receiving and logging deletion notifications fulfills our contractual commitments under developer marketplace terms based on our legitimate interests (Art. 6(1)(f)).
  • Statutory Erasure Rights: Where Flindor Limited holds personal data regarding the affected customer, we review and delete or anonymize personal records pursuant to UK GDPR Article 17, subject to statutory exemptions where retention is required by law (such as commercial sales records mandated under UK Companies Act and HMRC tax regulations).

10. Service Providers & Data Processors

We do not sell, rent, or trade personal information. We engage trusted service providers who assist in operating our website, infrastructure, and business applications:

  • Infrastructure & Hosting: Hostinger International Ltd (Provides Virtual Private Server infrastructure for Flindor OS and managed web hosting for flindor.co.uk).
  • Website Enquiry Processing: Formspree Inc. (Delaware, USA). Formspree provides contact form transmission infrastructure for enquiries submitted via flindor.co.uk/contact. Enquiries are received by Formspree and routed directly to our designated mailbox. Formspree processes submissions under its standard commercial Terms of Service and Privacy Policy, which include data protection and confidentiality commitments.
  • Source Code & Deployment Management: GitHub, Inc. (Provides encrypted repository hosting for application source code and deployment management).

Where service providers process personal data on our behalf, we rely on established commercial terms, standard online data protection commitments, or applicable vendor agreements.

11. International Data Transfers

Our primary Flindor OS application server and database infrastructure are hosted in data centers located within the United Kingdom and European Union (via Hostinger).

Certain third-party service providers we engage operate infrastructure in countries outside the UK and European Economic Area (EEA), notably the United States:

  • Formspree Inc. (Website enquiry routing)
  • GitHub, Inc. (Software deployment management)

Where personal data is transferred outside the UK or EEA, transfers are conducted subject to appropriate safeguards recognised under UK data protection law, such as standard contractual clauses (SCCs) with the UK Addendum or approved international data transfer mechanisms. We review our service providers to ensure reasonable safeguards remain in place.

12. Data Retention Schedules & Disposal Criteria

We retain personal information only for as long as reasonably necessary to fulfill the purposes for which it was collected, or to satisfy statutory legal, accounting, and reporting requirements:

Data Category Retention Criteria & Practice Disposal Mechanism
Website Enquiries Retained as needed to address the enquiry, evaluate commercial opportunities, or maintain correspondence history (typically reviewed after 12 months). Periodic administrative deletion from enquiry mailboxes and Formspree cache.
Commercial Client Contracts Retained for the commercial relationship plus 6 years following contract conclusion (Limitation Act 1980). Secure digital deletion or archiving following limitation period.
Financial & Tax Accounting Records Retained for at least 6 years following the relevant financial year (UK Companies Act 2006 / HMRC). Secure digital purge following statutory expiration.
Platform Access & Security Logs Retained in size-bounded server logs (typically up to 12 months) for security diagnostics; audit logs retained for security integrity. Automated server log rotation and periodic archival. Backups overwrite on standard cycles.
Retail Order Fulfillment Records Retained for the fulfillment, returns, and warranty period, with transactional accounting records retained for statutory tax periods. Secure deletion or anonymization of delivery address data following warranty expiration.
Marketplace API Credentials Stored strictly for the duration of an authorized connection. Deleted from credential vaults when an integration is disconnected.

13. Technical & Organisational Security Measures

We implement proportionate technical and organizational security measures to protect personal data:

  • Encryption in Transit: Web communications with flindor.co.uk and Flindor OS subdomains utilize Transport Layer Security (HTTPS / TLS), supported by HTTP Strict Transport Security (HSTS) headers.
  • Cryptographic Credential Vaulting (TokenVault): Within Flindor OS, sensitive third-party integration API credentials and tokens are vaulted in an isolated TokenVault utilizing authenticated AES-256-GCM encryption with unique initialization vectors and authentication tags. User account passwords are protected using one-way cryptographic salt-and-hash algorithms.
  • Access Controls: Role-based access control (RBAC) enforced within Flindor OS. Administrative access to production hosting infrastructure is restricted to authorised personnel using cryptographic SSH keys. Password-based root SSH access is disabled.
  • Audit Logging: Critical administrative actions and security events in Flindor OS are recorded in tamper-evident audit trails.
  • Defensive HTTP Headers: Flindor OS implements standard security headers, including X-Content-Type-Options: nosniff, X-Frame-Options: DENY, and Referrer-Policy: strict-origin-when-cross-origin.

While we take reasonable and appropriate technical steps to safeguard your information, no internet-connected system or electronic storage mechanism can be guaranteed to be completely impenetrable.

14. Cookies & Web Storage Technologies

A. Marketing Website (https://flindor.co.uk)

  • Our public marketing website is hosted on WordPress with Elementor styling assets.
  • Technical & Session Cookies: The underlying web server and WordPress set essential technical session cookies necessary for page delivery, server caching, and navigation. Public browsing does not issue tracking cookies.
  • External Web Fonts: Google Fonts (Roboto, Roboto Slab, Inter) are loaded from Google servers to render website typography. When fonts are requested, your browser transmits standard HTTP request headers (including your IP address) to Google LLC.
  • Formspree: Submitting an enquiry via Formspree may involve technical session identifiers used for anti-spam validation.
  • Cookie Notice: flindor.co.uk does not intentionally deploy third-party advertising or behavioral tracking cookies. Because only essential technical mechanisms are used, an interactive cookie-blocking banner is not currently deployed. If non-essential marketing cookies are introduced in the future, an interactive consent banner will be implemented.

B. Enterprise Platform (https://os.flindor.co.uk)

  • Flindor OS uses secure local web storage tokens and session cookies strictly necessary to authenticate and maintain authorised user sessions.
  • Flindor OS does not use commercial marketing cookies, advertising beacons, or third-party behavioral analytics.

15. Your Rights Under UK Data Protection Law

Under the UK GDPR and the Data Protection Act 2018, you possess statutory rights regarding personal data held about you. These rights are qualified and may be subject to legal conditions and statutory exemptions:

  1. Right of Access: You may request confirmation of whether we process your personal data and obtain a copy.
  2. Right to Rectification: You may request correction of inaccurate or incomplete personal data.
  3. Right to Erasure (“Right to be Forgotten”): You may request deletion of personal data where there is no compelling legal reason for continued processing (subject to legal retentions such as tax records).
  4. Right to Restriction: You may request restriction of processing in specific statutory circumstances.
  5. Right to Portability: Where processing is automated and based on consent or contract, you may request data in a structured, commonly used format.
  6. Right to Object: You may object to processing based on legitimate interests.
  7. Automated Decision-Making: We do not conduct automated decision-making or profiling with legal or significant effects.

Exercising Your Rights: Contact our Privacy Lead at Hello@flindor.co.uk or by post at FLINDOR LIMITED, 3 Pool Road, Leicester LE3 9GH. We respond to verified requests within one calendar month (extendable by up to two further months for complex requests in accordance with UK GDPR Article 12(3)).

16. How to Complain (ICO Information)

If you have any concern regarding our data handling, please contact our Privacy Lead first at Hello@flindor.co.uk so that we can address it promptly.

You also possess the statutory right to lodge a complaint with the UK Information Commissioner’s Office:

  • Supervisory Authority: Information Commissioner’s Office (ICO)
  • Registration Reference: ZC063881
  • Website: https://ico.org.uk/
  • Telephone Helpline: 0303 123 1113
  • Postal Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

17. Children’s Information

Our website, digital services, and enterprise operating platform are directed exclusively at commercial businesses, adult clients, and authorised enterprise personnel. We do not knowingly collect personal information from individuals under the age of 18.

18. Changes & Updates to this Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our legal obligations, operational practices, or service architecture. Updates will be posted to this page with an updated “Last Updated” date.

Official Statutory Policy Copy • FLINDOR LIMITED • Company No. 16669506 • ICO Registration Reference: ZC063881

Scroll to Top