Privacy Notice

This notice explains how Sound IT Policies collects and uses personal information when you visit our website, sign up for our free checklist, buy a policy pack, use our tailoring service, or when we contact your business. Last updated: 17 October 2026.

1. Who We Are

Sound IT Policies ("we", "us") is a UK business. We are the controller of your personal information for the purposes of the UK GDPR and the Data Protection Act 2018.

Contact: [email protected] (general and data protection queries).

2. What We Collect and Why

  • Free checklist sign-up: your first name and email address. We use them to send you the checklist and occasional practical emails about IT policies. Lawful basis: consent, which you can withdraw at any time using the unsubscribe link or by emailing [email protected].
  • Purchases: your name, email, business name, billing address and order details. Payment card details are handled by our payment providers, and we never see your full card number. Lawful basis: contract (to supply what you bought) and legal obligation (tax and accounting records).
  • Tailoring service: the intake form and documents you email to us at [email protected] (for example details of your IT systems, your existing policies, and a customer or insurer questionnaire, which may include information about that customer). Lawful basis: contract. Intake is by ordinary email, which is normally encrypted in transit but not end to end. Please don't send us passwords, PINs, codes, keys or logins, or personal data about your staff or customers that we don't need.
  • Enquiries: what you send us by email. Lawful basis: legitimate interests in responding to you.
  • Business contacts we approach: if you work for a UK company that we think may be interested in our products or a referral relationship, we may use your organisation's published business contact details to send a small number of relevant emails. These are the name of the business, a general business email address, its website, and publicly available business information (for example from Companies House or public contract notices). Lawful basis: legitimate interests in promoting our products to businesses. You can object at any time by replying "unsubscribe" or emailing [email protected]. We'll keep a minimal record so we don't contact you again.
  • Website: our hosting provider processes technical data (such as IP address and browser type) to deliver and secure the site. Lawful basis: legitimate interests in running a secure website.

3. Who We Share It With

We use these providers to run our business. Unless we say otherwise, they act as our processors and handle data on our instructions:

  • Payhip (online store and digital delivery) and Stripe and PayPal (payments). Note: for some digital sales Payhip acts as reseller for VAT purposes.
  • Kit (email sign-ups and emails)
  • Cloudflare (website hosting and security)
  • Apple (custom-domain email hosted by iCloud+, which we use for our business email, including Tailoring intake emails). Apple provides this service under its own terms and privacy policy rather than as our processor.
  • our accountant or HMRC, where required for tax purposes

We don't sell your personal information.

4. International Transfers

Some providers process data outside the UK (for example in the USA). Where they do, we rely on UK adequacy regulations (including the UK–US data bridge, where the provider is certified) or the UK International Data Transfer Agreement or Addendum, so your information stays protected.

5. How Long We Keep It

  • Checklist sign-up: until you unsubscribe, then a minimal suppression record so we don't email you again.
  • Purchase and tax records: for at least 5 years after the 31 January Self Assessment deadline for the relevant tax year, as HMRC requires.
  • Tailoring intake emails, attachments and working files: 90 days after delivery (covering revisions and follow-up questions), then deleted.
  • Tailored documents we deliver to you: up to 12 months after delivery, then deleted.
  • Enquiries: up to 2 years.
  • Business contacts we approach: up to 12 months after our last contact. If you ask us not to contact you, we keep a minimal suppression record so we don't contact you again.

6. Your Rights

You have the right to access your information, have it corrected or deleted, restrict or object to its use (including an absolute right to object to direct marketing), withdraw consent at any time, and ask for a copy in a portable format. Some rights have exceptions. To use them, email [email protected] with the subject "Data request". We'll respond within one month.

7. Complaints

If you're unhappy with how we've used your personal information, please complain to us first at [email protected] so we can try to put things right. We'll acknowledge your complaint within 30 days, look into it without undue delay and tell you the outcome. You can also complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, 0303 123 1113.

8. Changes

We may update this notice. The date at the top shows when it last changed.