Privacy Policy

1. Who controls your data

Holdback ("we", "us") is the data controller for the personal data described in this policy.

For any question about this policy or your data, contact hello@holdback.uk.

2. Data we collect

• Account data: name, email, phone number, and login credentials.
• Business data: your company name, company number, and registered address, used to identify you as sender on any correspondence generated on your behalf.
• Contract and job data: job names, main contractor names and contact details, contract values, retention percentages, and relevant dates that you enter to build your ledger.
• Main contractor and public register data: company details, filing status, director records, and court judgment records relating to main contractors, drawn from Companies House and equivalent public registers.
• Correspondence data: the content of letters generated through the Service, and any reply information you record against a contract.
• Usage data: log and device information generated automatically when you use the dashboard, such as IP address and browser type, used for security and diagnostics.

3. Why we use it, and our legal basis

• To provide the Service — maintaining your ledger, calculating what's claimable, and generating and sending correspondence you instruct us to send. Basis: performance of our contract with you.
• To monitor contractor risk — checking public register signals against the main contractors you're exposed to and surfacing alerts. Basis: our legitimate interest in providing the risk-monitoring feature you've signed up for, balanced against minimal impact on the contractor individuals whose public filings are involved.
• To bill you — processing subscription and recovery-fee payments. Basis: performance of our contract with you.
• To keep the Service secure — detecting abuse, fraud, and technical issues. Basis: legitimate interest in protecting the Service and its users.
• To meet legal obligations — such as tax, accounting, and responding to lawful requests from authorities.

4. Who we share data with

We share personal data only where necessary to run the Service:

• Companies House, whose public API we query to retrieve company and filing information about main contractors.
• Infrastructure providers hosting our database and application (currently Amazon Web Services), under standard data processing terms.
• The main contractor you instruct us to correspond with, who receives the letter content you've approved, addressed to the contact details you or they provided.
• Professional advisers, such as a solicitor, where a claim is disputed or escalates beyond commercial correspondence and you've asked us to prepare an evidence pack.

We do not sell personal data, and we do not share it with advertisers or data brokers.

5. International transfers

Our infrastructure providers may process data outside the UK. Where that happens, we rely on appropriate safeguards recognised under UK data protection law, such as standard contractual clauses or an adequacy decision covering the destination.

6. How long we keep data

We retain account and contract data for as long as your account is active, and for a reasonable period afterward to meet accounting, tax, and legal obligations and to resolve any dispute about a claim. Public register data cached about a main contractor is refreshed periodically and is not treated as a permanent record.

7. Your rights

Under UK data protection law, you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• ask us to delete data we no longer have a lawful reason to keep;
• restrict or object to certain processing, including processing based on legitimate interest;
• receive your data in a portable format; and
• complain to the Information Commissioner's Office (ico.org.uk) if you're unhappy with how we've handled your data.

To exercise any of these rights, email hello@holdback.uk.

8. Security

We use technical measures including encrypted connections, access controls, and credential hashing to protect the data we hold. No system is completely secure, and we continue to improve these measures as the Service develops.

9. Cookies

We use only the cookies strictly necessary to keep you signed in and to remember basic preferences. We do not use third-party advertising or tracking cookies.

10. Changes to this policy

We may update this policy as the Service changes. Material changes will be notified by email or an in-product notice ahead of taking effect.