01 Legal

Privacy Policy

Revision of 10 September 2026

A standing instruction rather than a statement of intent: what happens to personal information at each step, whose hands it passes through, and the date it is destroyed.

1. The controller of record

Prodentra Catalog Workflows Ltd decides why and how the personal information described here is handled, and is therefore the controller for it under UK data protection law.

Prodentra Catalog Workflows Ltd
Registered in England and Wales, company number 17304135
Registered office: 7 High Street, Kington, Herefordshire, HR5 3AX
Email: info@prodentra.org

The company is not required to appoint a data protection officer and has not appointed one. Anything to do with this document, including a request under section 7 below, goes to the address above and is dealt with by the people who run the company. Correspondence is by email.

2. The three ways information reaches us

An email written to us. We receive whatever the sender chose to put in it: a name, a reply address, a company, a description of how product content is handled today and what is going wrong with it.
The enquiry form on the contact page. It is worth describing precisely, because it does not behave like most forms. What is typed stays in the browser. Pressing the button assembles the answers into a message and hands that message to the sender's own email application. Nothing is posted to a server, we receive nothing at that moment, and the page never claims that anything has been sent. If the sender then decides against sending it, no part of the enquiry has left the device.
Material handed to us during an engagement, such as existing product pages, specification sheets, request formats and written instructions. This is ordinary business and product material, and occasionally it names a person as the holder of a role.

A fourth route is automatic rather than chosen: the hosting provider writes a technical log entry for every request to the site, as any web server does.

What your team does

Keep a first enquiry general. Describe the process, not the people. Send no confidential material, no commercially sensitive figures, no health, racial, political, religious, trade union, biometric or criminal record information, and no more personal detail than answering the question needs.

What we do

Use what arrives only to answer the enquiry and carry out the work. Where an enquiry carries more than it needed to, the surplus is used for nothing and deleted with the rest. We buy no marketing lists, run no analytics, set no tracking, load no third-party fonts, and send no marketing email.

3. What each set of information is used for, and the footing under it

Purpose and lawful basis, set out one row per kind of information. Article numbers are those of the UK General Data Protection Regulation.
Information	What it is used for	Lawful basis
Name, email address, company name and the description of the work, as written in an enquiry	Answering the enquiry, asking what else we need to know, and preparing a written quotation	Article 6(1)(b): steps taken at the request of the enquirer before an engagement is agreed
Correspondence, working materials and process documents exchanged while an engagement runs	Carrying out the engagement that was agreed, and answering questions about it afterwards	Article 6(1)(b): performance of the agreed engagement
Names that appear inside supplied material, usually as the holder of a role in an existing process	Describing the process accurately enough to redraw it; the documents we produce name roles rather than people	Article 6(1)(f): our legitimate interest, and that of the organisation asking for the work, in describing a working process as it really runs
Invoices, payment references and accounting entries	Keeping the accounting record the company is required to keep	Article 6(1)(c): a legal obligation under company and tax law
Server logs written by the hosting provider: an internet protocol address, the page requested, the time of the request	Keeping the site available and protecting it from abuse	Article 6(1)(f): our legitimate interest in a website that stays up and is not attacked

Material supplied to us is never used to train any model, is never sold, and is never published as an example without written permission. The worked examples on this website are fictional throughout, and no individual is named anywhere on it.

4. Whose hands it passes through

Information is handed on only where the work cannot be done otherwise, and only as much as the recipient needs. Each of these acts on our written instructions and may use nothing for purposes of its own.

The hosting provider that serves these pages, which necessarily handles the request logs described above.
The email provider that carries our correspondence and stores it while it is live.
The payment providers, Stripe and PayPal, where payment is made by card or through PayPal. They receive what is needed to take that payment and handle the card details themselves. We never see a full card number and never store one.
The accountant who prepares the company's statutory accounts and returns, who sees invoices and payment records.
Outside contributors, where an engagement includes coordinating them. Each receives the part of the material their own step needs, and no more.

Information goes to anyone else only where the law requires it, for example under a court order or on a valid request from a public authority.

5. Whether any of it leaves the United Kingdom

The work itself is done in the United Kingdom. Some of the providers above operate internationally, and the payment providers in particular process outside it. Where that happens, the transfer is made only on a basis UK data protection law recognises: adequacy regulations covering the country concerned, or the International Data Transfer Agreement, or the UK Addendum to the standard contractual clauses. No information is transferred anywhere on any other footing.

6. The destruction schedule

How long each kind of record is held, and what fixes the period.
Record	Held for	What fixes the period
An enquiry that leads to no engagement	Deleted once it is clear that no engagement will follow	There is nothing further to answer, and nothing that has to be kept
Correspondence and working materials from an engagement	Six years after the final handover, then deleted	The period in which a claim under the engagement can still be brought in England and Wales
Invoices, payment references and accounting entries	Six years from the end of the financial year they fall in	Company and tax law set this period, and it cannot be shortened by asking us
Server logs	Held by the hosting provider for the short period its own operation requires	We hold no copy of them and use them for nothing else
Anything typed into the enquiry form	Not kept at all: it never leaves the browser it was typed into	The form posts nothing anywhere; it hands the finished text to the sender's own email application

7. What your team can require of us, and how to require it

UK data protection law entitles a person whose information we hold to:

be told what we hold about them and be given a copy of it;
have anything inaccurate or incomplete corrected;
have information deleted where we no longer have a reason to keep it;
have its use put on hold while an objection or a question of accuracy is settled;
object to a use that rests on legitimate interests, which stops that use unless we can show grounds that override the objection;
receive information they supplied in a portable, machine-readable form, and have it sent to another controller where that is technically possible;
withdraw a consent, wherever consent is what we rely on. Nothing described in this document runs on consent today, so this right would bite only if that changed.

What your team does

Write to info@prodentra.org and say which of the above is being asked for. A request does not have to quote any Article or use any particular words. If we cannot tell from the address it came from who the sender is, answer the one question we ask to establish it.

What we do

Acknowledge the request, ask only what we genuinely need to establish identity, and answer within one month. Where a request is complex or several arrive together we may take up to two further months, and we will say so, with reasons, inside the first month. There is no charge, unless a request is manifestly unfounded or excessive, in which case we will explain before doing anything.

8. Complaining about the way information has been handled

Write to info@prodentra.org first, so that we can look at it and put right whatever can be put right. Anyone unsatisfied with the outcome may complain to the Information Commissioner, the United Kingdom regulator for data protection. A complaint can be made at ico.org.uk/make-a-complaint, or by post:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Complaining to the Commissioner takes nothing away: the right to a remedy through the courts stands alongside it.

9. Whether any of this has to be supplied at all

None of it is demanded by law, and nobody is obliged to give us anything. The consequence of withholding it is practical rather than legal. Without a name and a working reply address there is nobody to reply to. Without a description of how product content is handled today, an enquiry cannot be quoted. Without the material an engagement rests on, the work cannot be carried out and we would have to say so rather than guess.

10. Every decision here is taken by a person

There is no profiling, no scoring and no automated decision-making of any kind, including the kind that produces legal effects. Enquiries are read by a person, quotations are written by a person, and the work itself is done by people.

11. What this site puts on a visitor's device

Nothing. These pages set no cookies of their own and no third-party cookies, write nothing to local storage or session storage, and carry no analytics, no advertising code and no tracking pixel. The typefaces are served from this site rather than from an outside font service, so opening a page makes no request to anyone else at all.

That is why no consent banner appears: there is nothing to consent to. A browser may still keep its own cache of pages and fonts, which is the browser doing its job and is outside our control. Were that ever to change, consent would be asked for first, as the Privacy and Electronic Communications Regulations require, and this section would be rewritten before anything was set.

12. Keeping records out of the wrong hands

Access is limited to the people carrying out the work. Accounts and devices used for it are protected by strong, unique credentials and multi-factor authentication where the provider offers it. Material travels by email or by a download link rather than being left in shared public locations, and copies made for convenience are deleted when the reason for them ends.

If a breach of security affects personal information and is likely to risk anyone's rights or freedoms, it is reported to the Information Commissioner within 72 hours of our becoming aware of it, and the people affected are told directly where the law requires that.

13. Revisions to this document

The revision date under the title at the top of this page is the date this wording took effect. When it changes, the new version replaces this one here and that date moves with it. Where a change materially affects an engagement already running, the people involved in it are told by email rather than left to notice.