Privacy Policy

How Trade Cashflow handles personal data. Last updated 10 October 2026.

This policy explains what we do with personal information. It covers three different groups of people, and the rules are not the same for each: businesses we contact about our service, our clients, and the customers who owe our clients money.

1. Who we are

Trade Cashflow is the trading name of Jamie Greaves, a sole trader, of 38 Courthill Road, London SE13 6HB, United Kingdom. We have registered with the Information Commissioner’s Office and paid the data protection fee (application reference C2056175).

For questions about this policy or to exercise any right described below, email hello@tradecashflow.co.uk or write to us at the address above. We are not required to have a Data Protection Officer and have not appointed one.

We act in two different roles. For our own marketing, client records and website we are a controller: we decide why and how data is used. For the debtor information inside a client's accounting system we are a processor: the client decides, and we act on their instructions. Section 5 covers that second role.

2. If we contacted you about our service

We build a list of construction businesses that might benefit from what we do, using publicly available sources: Companies House, company websites, trade directories and public professional profiles. We typically hold a business name, a business email address, a phone number, a registered address, a named contact and their role, plus notes on why we thought you might be interested, such as the contractors you list on your website. We use AI tools (see section 6) to help research businesses and draft our emails.

Our lawful basis is legitimate interests: promoting a business-to-business service to organisations likely to want it. We have weighed this against your interests and concluded it is proportionate because we contact businesses about business matters only, we keep volumes low, we tell you who we are in every message, and we stop immediately on request. You can ask for a copy of that assessment.

We only send marketing email to corporate subscribers: limited companies, limited liability partnerships, Scottish partnerships and similar bodies. We do not send unsolicited marketing email to sole traders or ordinary partnerships, because the law treats them as individuals.

To stop hearing from us, reply to any message with the word “no”, or email hello@tradecashflow.co.uk. You have an absolute right to object to direct marketing and we will act on it without asking why. We keep a minimal suppression record (your email address, company and the date) purely so we never contact you again by mistake. That record is kept indefinitely, because deleting it would defeat its only purpose.

If you do not respond, we delete your details 12 months after our last contact.

3. If you are a client

We only ever request read access to your accounting software. Where a platform does not offer a read-only permission (QuickBooks, for example, has no read-only option) we may be granted broader technical access than we need. We do not use it. We never create, edit or delete anything in your ledger, and our terms of service commit us to that.

Retention. We keep your account data while you are a client and delete it 90 days after you cancel. Financial records that we are legally required to keep (invoices and payment records) are held for six years from the end of the relevant accounting period, as HMRC requires. Anti-money laundering records are kept for five years after our relationship ends, as the Money Laundering Regulations require. Access to your accounting software is revoked immediately on cancellation, and you can revoke it yourself at any moment from inside your own software.

4. If you visit this website

The site is a set of static pages. We do not run advertising trackers, we do not build profiles of visitors, and we do not sell anything about you to anyone.

Our host, Cloudflare, processes technical data such as IP address and browser type to serve the pages securely and defend against attacks. Cookies we set are limited to those strictly necessary to make the site work, plus basic statistical measurement of page views. Under changes to the cookie rules that took effect on 5 February 2026, low-risk statistical and appearance cookies of this kind do not require your consent, but you can still block or delete cookies in your browser without affecting your use of the site.

5. Your customers’ information: where we act as a processor

To chase a client's unpaid invoices we necessarily handle information about the businesses and people who owe them money: contact names, business email addresses, invoice numbers, amounts, dates and payment history.

For this information our client is the controller and we are the processor. We handle it only on their documented instructions, under a written data processing agreement that forms part of our terms of service and meets the requirements of Article 28 of the UK GDPR.

Practically, this means:

• We use it for one purpose only: recovering money owed to our client.
• Chase messages are sent in the client's name. The client is the sender in law, and messages follow templates and rules the client has approved in writing.
• We never use debtor information to market our own service to those debtors.
• We never sell it, share it, or combine it with anything else.
• We delete or return it when the client's contract ends.

If you have received a chase message and want your information removed or corrected, contact the business that sent it. They are the controller and only they can decide. Replies to those messages go directly to them, not to us. If you contact us instead we will pass your request on promptly and tell you we have done so, but we cannot action it ourselves.

6. Who else sees the data

We use a small number of established suppliers to run the service. Each acts under contract, may use the data only to provide their service to us, and may not use it for their own purposes.

We do not sell personal data, and we do not share it for anyone else's marketing. We will disclose information if the law requires it, or to establish or defend a legal claim.

Transfers outside the UK. Some suppliers process data in the United States. Those transfers rely on the UK–US data bridge where the supplier is certified, or otherwise on the UK International Data Transfer Agreement or the UK Addendum to the European Commission's standard contractual clauses, together with a transfer risk assessment. You can ask us for details of the safeguards that apply to any particular supplier.

7. Keeping it safe

Access to client data is limited to those who need it. Connections to accounting software use each platform's own authorisation mechanism rather than shared passwords wherever the platform allows it. Accounts are protected by two-factor authentication and data is encrypted in transit. We do not hold client money and have no access to any bank account of yours.

If a breach occurs that is likely to result in a risk to people's rights, we will report it to the ICO within 72 hours and tell those affected where the law requires. Where we are a processor, we will notify the client without undue delay so they can meet their own obligations.

8. Your rights

Under UK data protection law you can ask us to give you a copy of your personal data; correct it if it is wrong; delete it; restrict how we use it; provide it in a portable format; or stop using it. You can object to processing based on legitimate interests, and you have an absolute right to object to direct marketing, which we will always honour.

Email hello@tradecashflow.co.uk. We respond within one month and there is no charge. We may ask you to confirm your identity first. Where we hold the data as a processor for one of our clients, we will direct you to them and tell you who they are.

If you are unhappy with how we have handled your data, please tell us so we can put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint, by calling 0303 123 1113, or by writing to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

9. Changes

If we change this policy we will update the date at the top. If a change materially affects clients, we will email them before it takes effect.