TOHQ Privacy Policy
Last updated: 2026-06-19
This policy explains how Flockstone Group Limited (company no. 11849937), trading as Trade Office / TOHQ ("we", "us"), handles personal data where we are the controller — namely data about our account holders, their staff users, our website visitors, and people who contact us.
Separate roles: where we process personal data about your customers on your behalf (e.g. enquiries and job records inside the platform), you are the controller and we are the processor — that processing is governed by the Data Processing Agreement, not this policy.
1. Who we are
Flockstone Group Limited, Xl House, 2 Mill Court, Spindle Way, Crawley, West Sussex, England, RH10 1TT. Contact for privacy matters: contact@flockstone.co.uk.
2. What we collect
- Account & user data — name, business name, email, phone, role, login credentials (hashed), and settings for the account holder and their staff users.
- Billing data — billing contact and Direct Debit details (processed via GoCardless; we do not store full bank details).
- Support & communications — messages you send us and our replies.
- Website & product usage — pages visited, device/browser information, IP address, and analytics events (see our Cookie Policy).
- Server logs — IP address, user agent, request and timestamp, retained for security and abuse prevention.
3. Why we use it, and our lawful basis (UK GDPR Art. 6)
| Purpose | Lawful basis |
|---|---|
| Providing and administering your account | Contract (Art. 6(1)(b)) |
| Billing and collecting payment | Contract (Art. 6(1)(b)) |
| Security, fraud and abuse prevention, server logs | Legitimate interests (Art. 6(1)(f)) |
| Product analytics (cookie-based) | Consent (Art. 6(1)(a)) |
| Service and security notifications | Legitimate interests / legal obligation |
| Marketing emails to business contacts | Legitimate interests / consent as required by PECR |
4. Who we share it with
We do not sell personal data. We share it only with:
- our sub-processors acting on our behalf — currently Vercel (hosting), Supabase (database/storage, London), Name.com (domains/DNS), Resend (email), Sentry (error monitoring), GoCardless (payments), and consent-gated analytics (Google / Microsoft). See the Subprocessor Schedule;
- professional advisers, auditors, or authorities where legally required.
5. International transfers
Core data is hosted in Europe (Supabase, London; Vercel EU region). Some sub-processors are US-incorporated; where personal data is transferred outside the UK we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or an adequacy decision.
6. Retention
We keep account and billing data for the life of your account and for as long afterwards as needed to meet legal, tax and accounting obligations. Server logs are kept for a limited period for security. We delete or anonymise data when it is no longer needed.
7. Your rights
Under UK GDPR you have the right to access, rectify, erase, restrict, port, and object to processing of your personal data, and to withdraw consent where processing is based on consent. To exercise any right, email contact@flockstone.co.uk. You can also complain to the Information Commissioner's Office (ico.org.uk), though we'd appreciate the chance to help first.
8. Changes
We may update this policy and will post the new version with a revised date.
9. Contact
Flockstone Group Limited · contact@flockstone.co.uk · registered office as above.