GOLDCRESTCODE LTD is responsible for the personal information it uses to handle its own enquiries and business relationships. This notice explains that use and the information involved in visiting this website.
1. Who we are
GOLDCRESTCODE LTD (company number SC810777) is registered in Scotland. Our registered office is Belmont Road, Aberdeen, Scotland, AB25 3SR. For privacy questions or to exercise your rights, email info@goldcrestcode.com, use our contact form, or write to our registered office. Mark your message “Privacy request” where helpful.
We are a software house designing and developing websites, virtual experiences and business software. We do not currently offer administration of clients’ customer databases or operational personal-data records. We nevertheless handle personal information in our own enquiries, correspondence and business records. Any hosting or support that involves personal information must be assessed according to the work actually performed; describing a service as software development does not remove data-protection responsibilities.
This notice covers our own website and business contacts. If an engagement involves processing personal information on a client’s instructions, the parties must agree the appropriate scope and data-processing terms before that work starts. The client’s own privacy information may also apply.
2. Information involved
- Enquiries: your name, email address, message and service interest; an organisation or phone number if you provide one; and any illustrative estimator assumptions and results you expressly choose to include.
- Business relationships: contact details, role, requirements, correspondence, proposals, contracts, invoices and related payment or accounting records, as relevant to the relationship.
- Project information: information and access details necessary for the agreed work. Please use an agreed secure method for access credentials.
- Website connections: hosting and external-resource providers receive connection information such as IP address, browser details, request time and the resource requested. This is separate from information you enter into a form.
- Legal and security matters: information reasonably needed to deal with a complaint, suspected misuse, dispute or legal requirement.
We receive enquiry information from you. Project or business-contact information may also come from the organisation you represent or people authorised to communicate about the engagement.
Name, email address and a message are required to submit the enquiry form so we can understand and respond to it. Other fields are optional unless identified otherwise. Please do not send sensitive personal records, live client datasets or passwords through that form.
The public estimators calculate within the page. Their values are not submitted with your enquiry unless you select the option to include them. The fictional workflow demonstrations do not call a live AI service or use real customer records. Submitting an enquiry does not subscribe you to a marketing mailing list.
3. Purposes and lawful bases
| Purpose | Information used | Lawful basis |
|---|---|---|
| Understand and respond to an enquiry or prepare a proposal | Contact details, message and any scenario you choose to send | Legitimate interests in responding to business enquiries. Where you personally may enter a contract with us, taking steps at your request before that contract. |
| Deliver and administer agreed services | Relevant contact, project, contractual and billing information | Performance of a contract with you personally; legitimate interests in performing a contract with the organisation you represent. |
| Keep financial and company records and meet legal duties | Relevant invoices, payments, contracts and correspondence | Legal obligation where a record is required by law; otherwise legitimate interests in keeping appropriate business records. |
| Protect the website and business and handle complaints or disputes | Relevant technical, contact, correspondence and incident information | Legitimate interests in security, resolving concerns and establishing, exercising or defending legal claims; legal obligation where applicable. |
A legitimate interest is not an automatic entitlement to use information: the use must be necessary and balanced against your interests and rights. The enquiry-form acknowledgement confirms that the notice has been brought to your attention; it is not consent to marketing or a waiver of your rights.
We do not use the public estimators or demonstrations to make solely automated decisions about you with legal or similarly significant effects.
4. Service providers and other recipients
The website uses Netlify hosting and Netlify Forms to receive enquiries. We use Microsoft 365 business email through Outlook for correspondence. The site loads fonts from Fontshare and interface assets from jsDelivr, so your browser contacts those providers when loading the relevant resources.
For the provider’s information about its own processing, see Netlify’s privacy notice and Microsoft’s privacy statement. A provider may act on our instructions for some activities and have separate responsibilities for others; its precise role depends on the service and applicable terms.
Where necessary for an engagement or legal matter, relevant information may also be shared with personnel working on it, agreed specialist service providers, professional advisers, or authorities where disclosure is legally required. Any use of a provider to process personal information on our behalf requires the applicable data-protection arrangements. A provider’s notice does not replace our own responsibilities.
5. Processing outside the UK
Using external hosting, email and content-delivery services can involve processing outside the United Kingdom. The locations and arrangements depend on the provider, account and service configuration. A transfer restricted by UK data-protection law requires an applicable lawful route, such as UK adequacy regulations or appropriate contractual safeguards, and any additional assessment or measures required by law.
To ask about transfers relevant to information we hold about you, including how to obtain information about applicable safeguards, contact us using the details in section 1. Commercially sensitive information may need to be redacted where legally appropriate.
6. How long information is kept
Retention depends on the purpose of the record rather than a single period for all information. Relevant criteria include whether an enquiry remains active, whether follow-up is reasonably needed, the duration and support needs of a project, applicable accounting and company-record duties, and the period reasonably needed to resolve a dispute or legal claim.
Information should not be kept indefinitely just because it may be useful. When it is no longer needed for those purposes, it should be deleted or anonymised, subject to any lawful requirement to preserve it. Provider copies, mailboxes and backups must be considered when arranging deletion. You may ask about the retention applicable to a particular record using the contact details above.
7. Security
The website is configured to use HTTPS, and enquiries are submitted through Netlify Forms. Protecting business information also requires appropriate account-access, supplier and operational controls. This notice does not claim that we or our providers hold a particular security certification or that every system has been independently audited. No internet service can be guaranteed completely secure.
If a personal-data breach occurs, we must assess it and notify the relevant regulator and affected people where the law requires. Please tell us promptly if you believe information sent to us has been exposed or misused.
8. Your rights
Depending on the circumstances, you may have rights to access your information, correct inaccuracies, request erasure, restrict processing, receive portable information, and object to processing based on legitimate interests. You have an absolute right to object to use of your personal information for direct marketing. Where processing relies on consent, you may withdraw that consent without affecting the lawfulness of earlier processing.
Rights have conditions and exceptions. We may need proportionate information to verify identity, and we must respond within the applicable statutory time limit, normally one month, subject to lawful extensions or other adjustments. A request is normally free; any lawful charge or refusal must be explained.
9. Complaints
You can raise a privacy concern with us at info@goldcrestcode.com. You may also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint. You do not have to obtain our permission to contact the regulator.
10. Cookies, other sites and changes
See our Cookie Notice for the website’s use of browser storage and external resources. The separate virtual-room demonstration and other linked websites have their own arrangements. Our services are directed to organisations and adult business contacts, rather than children.
This notice will need updating when the relevant processing changes. The date above identifies this version; it does not retrospectively change the lawful basis for earlier processing.