Privacy Policy

Last updated: [DATE]

Template — not legal advice. This is a solid starting point drafted for Minster Desk's model, but you should review it (and have your Data Processing Agreement prepared) before relying on it or taking paying clients. Fill in every [bracketed] placeholder, and confirm your ICO registration is in place.

This policy explains how Minster Desk Ltd ("Minster Desk", "we", "us") handles personal data. We're a company registered in England & Wales (company no. [COMPANY NUMBER]), registered office [REGISTERED ADDRESS]. You can reach us at [hello@minsterdesk.co.uk].

The two roles we act in

It matters which "hat" we're wearing, because it changes who is responsible for your data:

As a controller — for our own website visitors and business enquiries (for example, the details you send us through the "Get set up" form, or if you ask for a demo text). We decide how that data is used, and this policy governs it.
As a processor — for the tradesperson's customers. When we run the missed-call text-back service, we handle callers' phone numbers and messages on behalf of the tradesperson (our client), who is the controller. We only act on their instructions, under a separate Data Processing Agreement. If you're a member of the public who was texted back after ringing a trade business, that business is the controller — please contact them, though we'll help them respond.

What we collect

If you're a tradesperson enquiring or using the service

Details you give us: your name, mobile number, trade, and (optionally) email.
If you enter your number for the live demo: your mobile number and your consent, used once to send you a demo text.
Basic technical data your browser sends (e.g. IP address, device/browser type) and any hosting/security logs.

If you're a caller (handled on behalf of our client)

Your phone number, the text messages exchanged, and the lead details captured (such as the job, your postcode area, urgency, and a callback preference).

Why we use it, and our lawful basis

To reply to enquiries and set up the service — on the basis of taking steps to enter into, or perform, a contract, and our legitimate interest in running the business.
To send a demo text you asked for — on the basis of your consent, which you can withdraw at any time.
Business-to-business contact — where we contact limited companies and LLPs about the service, we rely on legitimate interests, and we always identify ourselves and offer an easy opt-out.
To run the missed-call service — we process caller data on our client's instructions to deliver the leads they've asked us to capture.
To keep the service secure and working — our legitimate interest in preventing abuse and diagnosing faults.

The live demo

The "text it to your own phone" demo sends a real, one-off message to the number you enter, and only after you tick the consent box. We use the number to run that single demo conversation and don't reuse it for marketing. The endpoint is rate-limited to prevent misuse.

Who we share it with

We don't sell your data. We use a small number of trusted providers ("processors") to run the service, each under contract and only for these purposes:

Telephony & SMS — to route calls and send/receive texts.
AI conversation — to power the text-back conversation.
Data storage & lead delivery — to store configuration and leads and to email lead summaries.
Website hosting & security — to serve this site and protect it.

Some providers may process data outside the UK; where they do, we rely on appropriate safeguards (such as UK-approved transfer terms). We may also disclose data where the law requires it. [Confirm and, if you wish, name your specific providers here.]

How long we keep it

We keep enquiry and account data for as long as needed to provide the service and for a reasonable period afterwards, then delete or anonymise it. Caller/lead data is retained per our client's instructions and their retention policy. Demo numbers are kept only briefly to run and troubleshoot the demo. [Set your specific retention periods here.]

How we protect it

We use appropriate technical and organisational measures — access controls, encryption in transit, provider accounts secured with strong authentication, and least-privilege access — to keep personal data safe.

Your rights

Under UK data protection law you have rights to access your data, to have it corrected or erased, to restrict or object to processing, and to data portability, as well as the right to withdraw consent where we rely on it. To exercise any of these, email us at [hello@minsterdesk.co.uk]. If you were a caller, we'll pass your request to the relevant trade business (the controller) and support them in handling it.

You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk, though we'd appreciate the chance to put things right first.

Cookies

This site doesn't set advertising or tracking cookies. If we add any analytics or functional cookies in future, we'll update this policy and, where required, ask for your consent. [Update if you add analytics.]

Changes to this policy

We may update this policy from time to time. The "last updated" date at the top shows the latest version.

Contact

Questions about this policy or your data? Email [hello@minsterdesk.co.uk] or write to us at [REGISTERED ADDRESS].