Privacy Policy
Last updated
This policy explains what personal data Fintrix collects when you use fintrix.so, contact us (including on WhatsApp), subscribe to our newsletter or apply for a job, and what we do with it. We have tried to keep it short and specific. If anything is unclear, email privacy@fintrix.so.
Summary
- We collect only what you send us (for example, on WhatsApp, through the contact or job application forms, or by email) and the basic technical data that every web server records.
- If you message us on WhatsApp, WhatsApp (part of Meta) also processes your messages under its own terms and privacy policy.
- A few small items, such as your cookie choice, are saved in your own browser so the site remembers them. They are never sent to us.
- We do not use advertising trackers. By default, the site runs no analytics at all. If we ever turn analytics on, it only loads after you opt in, and we honour Global Privacy Control.
- We do not sell or share your personal information for advertising.
- We use a small number of service providers (a hosting provider, a form processor and an email provider) to run the site. They act on our instructions.
- You can ask to see, correct or delete your data at any time. This includes job applicants, who can ask us to delete their application.
Who we are
Fintrix is the controller of the personal data described in this policy. This means we decide why and how it is used. The full legal name of our company is shown in the footer of every page, and our postal address is on our Contact page.
For any privacy question or request, email privacy@fintrix.so.
If we are legally required to appoint a representative in the European Union or the United Kingdom, we will list their contact details in this section.
What this policy covers
This policy covers personal data we handle through this website and related communications: enquiries (including WhatsApp messages), newsletter subscriptions, general email correspondence, job applications, website server logs and the small amount of information the site saves in your browser.
It does not cover data we process for our clients while delivering a project. When we build, host, integrate or support systems for a client, we usually act as a processor on the client's behalf. That processing is governed by our signed agreement with the client, including a data processing agreement where required, and by the client's own privacy notice. If you are a customer or user of one of our clients, please contact that organisation first.
Information we collect
When you message us on WhatsApp. WhatsApp is our main contact channel. The "Chat on WhatsApp" links on this site open WhatsApp, and nothing is sent to WhatsApp until you click one. When you message us, we receive your WhatsApp display name, your phone number, your profile photo and "about" text (if your WhatsApp privacy settings make them visible), and the content of your messages and any files you send. Some links pre-fill a short opening message, which you can edit or delete before sending.
WhatsApp is run by WhatsApp LLC and, in the UK and Europe, WhatsApp Ireland Limited, both part of Meta. WhatsApp processes your messages and account information under its own terms and privacy policy, not under this policy. Personal WhatsApp messages are end-to-end encrypted, but WhatsApp still collects information such as your phone number and usage data. If you would rather not use WhatsApp, you can email us or use the contact form instead.
When you use the contact form. Your name, work email address, company, and optionally your job title. We also collect the service or engagement model you are interested in, your timeline, your message and the page you sent the form from. The form also includes a hidden anti-spam field, which real visitors leave empty.
When you subscribe to our newsletter. Your email address and the date you subscribed. Our email provider may record whether each newsletter was delivered and opened, and which links were clicked. You can stop open tracking by turning off automatic image loading in your email client.
When you email us. Whatever you choose to include: usually your name, email address, signature details (such as job title, company and phone number) and the content of your message and any attachments.
When you apply for a job. You can apply through the application form on our Careers page or by email to careers@fintrix.so. The form asks for your name, email address, phone number, location, links (such as your LinkedIn profile, portfolio or GitHub), your CV and a message, and records which role you are applying for. Applications submitted through the form are delivered to us by our form processor. During the hiring process we also create records such as interview notes, take-home task results and our hiring decision.
Please do not include sensitive information (such as health, ethnicity, religion, sexual orientation or criminal records) in your CV or message. The exception is if you want to tell us about an adjustment you need for the hiring process, which we will use only to make that adjustment.
Information saved in your browser. Some features remember things in your own browser using localStorage: your cookie choice, the fact that you have subscribed to our newsletter (a yes flag only, not your email address), and which roles you have applied for. This information stays on your device and is never sent to us. Our Cookie Policy lists each item and explains how to clear it.
When you visit any page. Like every website, our hosting provider automatically records server logs. These include your IP address, the date and time of the request, the page or file requested, the response status, the referring page and your browser's user agent string. We do not use these logs to build profiles of individual visitors.
Analytics (off by default). The site currently runs no analytics. If we enable an analytics tool in future, it will load only after you choose "Accept analytics" in the cookie banner, and we will name the provider and the data it collects in our Cookie Policy.
We do not knowingly collect special category data through this website, and we do not use automated decision-making that has legal or similarly significant effects on you.
How we use your information and our lawful bases
Under the UK GDPR and the EU GDPR, we must have a lawful basis for each use of personal data. These are ours:
| Purpose | Data used | Lawful basis |
|---|---|---|
| Reply to your enquiry and discuss a possible engagement | WhatsApp messages, contact form data, email correspondence | Legitimate interests (responding to business enquiries and developing client relationships), or steps you have asked us to take before entering into a contract |
| Send our newsletter | Email address, subscription date, delivery and engagement data | Consent, which you can withdraw at any time using the unsubscribe link in every email |
| Assess job applications, contact candidates and run our hiring process | Application form or email data (name, email, phone, location, links, CV, message, role applied for), interview notes, hiring decisions | Steps taken at your request before entering into a contract; legitimate interests (finding and hiring the right people). Information about adjustments you need is used to meet our obligations in employment and equality law |
| Keep an unsuccessful application on file for future roles | Application data | Consent, which you can withdraw at any time |
| Keep the website running, secure and free from abuse | Server logs, anti-spam field | Legitimate interests (operating and protecting the website) |
| Remember your choices in your browser (cookie choice, newsletter subscription, roles applied for) | Items saved in your browser's localStorage, which never leave your device |
Not sent to or processed by us. Storing them on your device is strictly necessary for, or part of, a feature you have used (see the Cookie Policy) |
| Understand how the website is used, if analytics is enabled | Analytics data described in the Cookie Policy | Consent, given through the cookie banner |
| Keep business records, handle legal claims and meet legal obligations | Correspondence and records relevant to the matter | Legal obligation; legitimate interests (establishing, exercising or defending legal claims) |
Where we rely on legitimate interests, we have weighed our interests against your rights and expectations. You can ask us for more detail about that assessment, and you can object at any time (see Your rights).
The consent checkbox on the contact form confirms that you have read this policy and want us to reply. If you do not provide the required fields, we will not be able to respond through the form, but you can always email us instead.
How long we keep it
We keep personal data only as long as we need it for the purposes above, then delete or anonymise it.
| Data | How long we keep it |
|---|---|
| Contact form enquiries, WhatsApp chats and related email correspondence (no engagement follows) | Up to 24 months after our last contact with you. We keep WhatsApp chat records in the same way as email correspondence, and delete the chat from our WhatsApp account at the end of that period |
| Correspondence, including WhatsApp chats, that leads to a client engagement | For the life of the engagement and up to 6 years afterwards, to meet accounting and legal obligations |
| Copies of form submissions (contact and job application forms, including CVs) held by our form processor | Deleted from the processor's systems within 90 days, once the submission has been delivered to our inbox |
| Newsletter subscription | Until you unsubscribe. After that, we keep your email address on a suppression list only so we never email you again by mistake |
| Job applications (unsuccessful), including CVs and interview notes | 12 months after the hiring decision, so we can answer questions about the decision and handle any legal claims. If you agree, we keep your details for up to a further 12 months to consider you for future roles. You can ask us to delete your application sooner at any time |
| Job applications (successful) | Moved to your employee file and handled under our employee privacy notice |
| Server logs | A short period set by our hosting provider, after which they are deleted or aggregated |
| Items saved in your browser | Stay on your device until you clear them (see the Cookie Policy). We never receive them |
| Records of privacy requests | Up to 3 years after we close the request, so we can show how we handled it |
We may keep information for longer if the law requires it or if it is needed for an ongoing legal claim.
Who we share it with
We do not sell your personal data, and we do not share it with advertisers or data brokers. We share it only with:
- Service providers (processors) that help us run the website and our business, under written contracts that require them to protect the data and use it only on our instructions:
- our hosting provider, which serves the website and keeps server logs;
- our form processor, which receives contact form and job application form submissions (including CVs) and forwards them to our inbox;
- our email provider, which hosts our mailboxes and, if you subscribe, sends our newsletter;
- an analytics provider, only if analytics is enabled and you have opted in.
- WhatsApp (Meta), if you choose to message us on WhatsApp. WhatsApp provides the messaging service and processes your messages and account information under its own terms and privacy policy, as described in Information we collect. We read and reply to your messages from a Fintrix WhatsApp account.
- Professional advisers such as lawyers, accountants and auditors, under a duty of confidentiality.
- Authorities, regulators or courts, where the law requires it or where it is necessary to protect our rights, our users or the public.
- A buyer or successor, if Fintrix is involved in a merger, acquisition or sale of assets. We would tell you before your data becomes subject to a different privacy policy.
You can ask us for the names of our current service providers at any time by emailing privacy@fintrix.so.
International transfers
Our team and our service providers may access or store personal data outside the United Kingdom and the European Economic Area, including in the United States.
When we transfer personal data out of the UK or EEA, we make sure it is protected by one of these safeguards:
- an adequacy decision or UK adequacy regulations, which confirm that the destination provides adequate protection (including, for US providers that are certified, the EU-US Data Privacy Framework and its UK Extension);
- the European Commission's Standard Contractual Clauses (SCCs); or
- for transfers from the UK, the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the SCCs.
Where needed, we also assess the laws of the destination country and add extra safeguards.
If you message us on WhatsApp, WhatsApp and Meta may transfer your information internationally, including to the United States, under the safeguards described in WhatsApp's own privacy policy. You can ask for a copy of the relevant safeguards by emailing privacy@fintrix.so.
Your rights
If you are in the UK or the EEA
You have the right to:
- Access the personal data we hold about you and receive a copy.
- Rectify data that is inaccurate or incomplete.
- Erase your data, where there is no good reason for us to keep it.
- Restrict our use of your data, for example while we check its accuracy.
- Object to our use of your data where we rely on legitimate interests. You can object to direct marketing at any time, and we will stop.
- Portability: receive data you gave us in a structured, machine-readable format, or ask us to send it to someone else, where we rely on consent or a contract.
- Withdraw consent at any time, where we rely on consent. This does not affect anything we did before you withdrew it.
These rights have some legal limits. If we cannot fully meet a request, we will explain why.
If you are in California
To the extent the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the CCPA), applies to us:
- What we collect. In the past 12 months we have collected these categories of personal information: identifiers (such as name, email address, phone number, WhatsApp account details and IP address); professional or employment-related information (such as job title, company, CV, work history, location and job application details); and internet or network activity (such as server log data). We collect them from you directly and from your browser, for the purposes described in How we use your information, and we keep them for the periods in How long we keep it.
- We do not sell or share personal information. We do not sell personal information or share it for cross-context behavioural advertising, and we have not done so in the past 12 months. We do not knowingly sell or share the personal information of consumers under 16.
- Sensitive personal information. We do not use or disclose sensitive personal information for any purpose that would give you the right to limit it under the CCPA.
- Your rights. You can ask to know what personal information we have collected about you and how we use and disclose it, to get a copy of it, to correct it and to delete it. You also have the right to opt out of the sale or sharing of personal information. We do not sell or share it, but we treat a Global Privacy Control signal as a valid opt-out request all the same.
- No discrimination. We will not treat you differently for exercising your rights.
- Authorised agents. You can use an authorised agent to make a request for you. We may ask for proof that the agent is authorised, and we may ask you to verify your identity directly.
Global Privacy Control
If your browser sends a Global Privacy Control (GPC) signal, we treat it as a choice of "Necessary only": no analytics loads and no cookie banner is shown. We also treat it as an opt-out of any sale or sharing of personal information under US state privacy laws.
How to exercise your rights
Email privacy@fintrix.so and tell us which right you want to use. To unsubscribe from the newsletter, simply use the link at the bottom of any newsletter email.
Job applicants. You can withdraw your application, or ask us to delete your application and CV, at any time by emailing careers@fintrix.so or privacy@fintrix.so. We will delete it from our inbox, our hiring records and our form processor, and confirm when that is done. We may keep a minimal record (your name, the role and the date of deletion) if we need it to show that we handled your request or to deal with a legal claim. To remove the list of roles you applied for from your own browser, clear your browser storage for fintrix.so.
WhatsApp. You can ask us to delete our copy of a WhatsApp conversation, and we will delete it from our WhatsApp account and any records we keep. To control what WhatsApp itself holds about you, use the settings in the WhatsApp app or contact WhatsApp directly.
- Verification. To protect your data, we may ask you to confirm your identity before we act. We usually do this by replying to the email address we hold for you, and we will not ask for more information than we need.
- Timing. We respond within one month (UK and EEA) or 45 days (California). If a request is complex, we may extend this as the law allows, and we will tell you why.
- Cost. There is no charge, unless a request is clearly unfounded or excessive.
Complaints
If you have a concern about how we handle your data, please contact us first at privacy@fintrix.so so we can try to put it right.
You also have the right to complain to a data protection supervisory authority. In the UK, this is the Information Commissioner's Office (ico.org.uk). In the EEA, you can contact the supervisory authority in the country where you live or work, or where you believe the issue occurred. The European Data Protection Board keeps a list of national authorities. In California, you can also contact the California Privacy Protection Agency (cppa.ca.gov).
Children
This website and our services are intended for businesses and professionals. They are not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has sent us personal data, email privacy@fintrix.so and we will delete it.
How we protect your data
We use technical and organisational measures appropriate to the risk. These include:
- serving the website only over encrypted HTTPS connections;
- running a static website with no user accounts and no database of visitor data;
- self-hosting our fonts and avoiding third-party scripts, so that by default your browser does not contact any other company when you load our pages;
- applying strict security headers, including a Content Security Policy;
- limiting access to inboxes and service-provider accounts to the people who need it, protected with multi-factor authentication;
- choosing service providers that commit to appropriate security measures.
No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If you find a security issue, please report it using our Security policy.
Links to other websites
Our website links to other websites, such as social networks. When you follow those links, the other site's privacy policy applies, not this one.
Changes to this policy
We will update this policy when our practices or the law change. The "Last updated" date at the top of the page shows when we last changed it. If we make a significant change that affects how we use data you have already given us, we will tell you directly where we can, for example by email if you are a newsletter subscriber.
Contact us
For any question about this policy or your personal data, email privacy@fintrix.so. Our postal address is on our Contact page.