Website Privacy Policy

1. Scope and controller

WORRAPS LTD, company number 17566250. Registered office: 71-75, Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. Email: info@worraps.co.uk. This notice covers our standalone public marketing website and enquiries about Worraps. It does not describe the future accounting application, bank connections, customer accounting records, document processing or subscription payments. Those activities require a separate application notice before the relevant processing begins.

2. Information processed when you visit

When the deployed website is delivered through its selected hosting and security provider, Cloudflare, connection and request information may be processed to deliver pages and protect the service. Depending on the enabled services, this may include IP address, request time, requested URL, browser or device information in request headers, response status and security or error information. These are technical data and may be personal data; they are not described as anonymous merely because reports are aggregated. Google Analytics 4 is planned to measure visits and help us improve the public website. Once enabled, and only with your consent, it may process cookie identifiers, page views, interactions, visit times, referring sources, device/browser information and approximate location. We will exclude enquiry content, accounting documents and bank transactions from analytics and prevent personal information in page URLs or event fields from being sent.

3. Information you send us

If you email info@worraps.co.uk, we process your email address, name if supplied, message, attachments you choose to send and relevant communication metadata to handle your enquiry. IONOS Mail / SMTP is the selected email provider. Do not send bank passwords, identity documents, tax identifiers or financial documents unless we specifically request them through an appropriate secure process. The current marketing-site code does not provide an account-registration, payment, document-upload, mailing-list or contact-submission form.

4. Cookies and similar storage

The website creates worraps.cookie-preferences in local storage only when you explicitly save or reject optional cookies using Manage cookies. It records the notice version, save/expiry times and necessary-only settings, without a browsing history or account identifier. It is valid for 180 days and is removed if expired or invalid on the next visit, or when you clear site storage. Local storage has no automatic native expiry. No optional analytics, marketing pixels or advertising tools are integrated into the current marketing-site code. Necessary hosting/security technologies must be identified from the deployed Cloudflare configuration. See the separate Cookie Policy and use Manage cookies in the footer. Google Analytics 4 is planned, but this notice does not activate it. Before introducing it, we will update the cookie inventory and add an optional analytics control. Analytics will be off by default, and no Google Analytics requests will be sent before you opt in. You will be able to withdraw consent through Manage cookies; withdrawal will stop future analytics collection without affecting the lawfulness of earlier processing.

5. Purposes and lawful bases

We rely on legitimate interests to deliver and protect the website, prevent misuse, maintain proportionate reliability information and answer general business enquiries, after considering the necessity of the processing and your rights. Where an enquiry is a step you request before entering a contract with us, we rely on the contract basis to the extent necessary. We rely on legal obligation where a specific duty applies, such as responding to statutory requests. Optional tracking or marketing would require an appropriate basis and consent where required; this notice does not activate either. Providing contact details does not subscribe you to marketing. When introduced, Google Analytics measurement will rely on your consent. Refusing or withdrawing analytics consent will not prevent you from using the public website.

6. Providers and sharing

Cloudflare is selected for public-website hosting, delivery and security. IONOS Mail / SMTP is selected for email handling. These selections do not by themselves verify the live account configuration, exact contracting entities or the processing terms accepted by WORRAPS. When a provider acts on our instructions it must be covered by appropriate processing terms; a provider may separately act as controller for its own purposes under its terms. Authorised personnel and advisers may receive limited information where necessary, and we disclose data when legally required. We do not sell enquiry or visitor data. The website does not send visitors' accounting documents or bank transactions to application providers merely because they browse it. Google is the selected provider for planned Google Analytics 4 measurement on the public website. Before activation, we will verify the applicable Google entity, processing terms and settings. We will initially disable Google Signals, advertising personalisation and advertising-account links. This planned service is separate from accounting-application processing. Further information is available at https://policies.google.com/privacy.

7. Locations and international transfers

Our service providers may process personal data in the United Kingdom and other countries. Cloudflare operates an international network, and the planned Google Analytics 4 service may involve processing outside the UK, including in the United States. A UK hosting location does not mean that all related processing, support access or onward transfers remain in the UK. Where a transfer is restricted under UK data protection law, we require an applicable lawful transfer mechanism and any necessary assessment and supplementary safeguards. Depending on the recipient and circumstances, this may include UK adequacy regulations or appropriate contractual safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission's Standard Contractual Clauses. Before enabling Google Analytics, we will confirm the applicable Google contracting entity, processing terms and international transfer safeguards. You can request further information about the safeguards applicable to your personal data by emailing info@worraps.co.uk.

8. Retention

We keep personal data only as long as necessary. Our adopted routine limits are 12 months after closure for enquiry/support/complaint correspondence and data-rights case files; 90 days from the event for access/diagnostic logs; and 12 months from the event for security-event and privileged-access audit records. We delete or minimise sooner when no longer needed. A specific legal obligation or justified legal claim may require limited relevant records to be kept longer; holds are documented and reviewed at least every 90 days. These are policy requirements to be implemented and verified before the relevant processing starts, not confirmation of live provider settings. Our cookie-preference record is valid for 180 days from saving. Expired records are removed on your next visit, or when you clear site storage. Local storage does not expire automatically. Google Analytics 4 is planned. Before enabling it, we will select two-month retention for user-level and event-level data and disable reset on new activity. Google applies its scheduled deletion process; this setting does not determine standard aggregated-report retention. Configured analytics-cookie lifetimes will be listed in the Cookie Policy before activation. Our policy maximum for routine recovery copies is 90 days from backup creation. Where immediate individual deletion from a backup is not possible, data must remain protected and beyond normal use until expiry; restoration must reapply deletion restrictions. Necessary legal holds are handled separately. We must verify provider terms and configurations against these requirements before the relevant processing starts. See the Data Retention Policy for the summary schedule.

9. Your choices and rights

You may request access, correction, erasure, restriction or, where applicable, portability, object to legitimate-interest processing and withdraw consent where processing is based on it. Direct marketing objections must be honoured. Email info@worraps.co.uk; we normally respond without undue delay and within one month, subject to lawful verification, clarification and permitted extensions. Requests are normally free. We explain any lawful refusal, limitation or extension. Declining optional storage does not prevent access to the marketing website.

10. Complaints

Email a privacy complaint to info@worraps.co.uk or write to our registered office. We acknowledge privacy complaints within 30 days, investigate and respond without undue delay, and keep you informed. You may complain to the UK data protection regulator through https://ico.org.uk/make-a-complaint/ without losing that right by contacting us first.

11. Security and external links

We apply proportionate access and security measures appropriate to the processing and risks; no online service guarantees absolute security. External websites have their own privacy information when you follow a link to them. Separate notices will describe any future accounting application and any new collection before it starts.

12. Updates

Last updated: 8 November 2026. This notice takes effect when published on the WORRAPS public website. We review and update it when our processing purposes, service providers, technologies or legal obligations change. Before introducing Google Analytics or other optional tracking technologies, we will update the relevant privacy and cookie information and provide the necessary consent controls. Where a change requires new consent, we will obtain it before beginning the affected processing. The latest version of this notice will remain available on this website.