1. Who we are
In short: JuteWise is the controller of the personal data described in this policy.
JuteWise [Ltd] ("JuteWise", "we", "us", "our") is registered in [England and Wales], company number [company number], registered office Suite RA01, 195-197 Wood Street, London, E17 3NU.
We are the "controller" of the personal data collected through this website, which means we decide how and why it is used.
Contact us about data protection: Email hello@jutewise.com. Post: Suite RA01, 195-197 Wood Street, London, E17 3NU.
ICO registration number: [ICO registration number]
2. What this policy covers
In short: this policy covers our website. It does not cover employment.
This policy explains how we handle personal data collected through jutewise.com — including when you fill in our enquiry form, book a call with us, email us, or simply browse the site.
It does not cover:
- Personal data we process about people we employ or engage through our Employer of Record services — that is covered by a separate Employee Privacy Notice provided at onboarding
- Personal data we process on behalf of a client, where the client is the controller and our handling is governed by the Data Processing Agreement between us
3. What we collect
In short: what you tell us, plus some technical data collected automatically.
3.1 Information you give us
| Data | When |
|---|---|
| Name | Enquiry form, booking a call, emailing us |
| Work email address | Enquiry form, booking a call |
| Company name | Enquiry form |
| The role you're hiring for, and roughly how many people | Enquiry form |
| Anything else you choose to tell us | Emails, calls, messages |
3.2 Information collected automatically
| Data | Purpose |
|---|---|
| IP address | Security, and approximate location for basic traffic reporting |
| Browser and device type, operating system | Making the site work across devices |
| Pages visited, time on page, referring URL | Understanding what's useful and what isn't |
| Cookie identifiers | See Section 7 |
This is basic server-level information collected by any hosted website, whether or not any analytics tool is installed. We do not collect precise geolocation data, and we do not ask for it. We do not currently run Google Analytics or any similar analytics tool — see Section 6.
3.3 Special category data
We do not ask for, and do not want, special category data through this website — that means data about health, race, ethnicity, religion, political opinions, trade union membership, sex life, sexual orientation, genetics, or biometrics.
Please don't include it in an enquiry form. If you do send it to us unprompted, we'll delete it unless we need it to respond to you, in which case we'll rely on your explicit consent under Article 9(2)(a) UK GDPR.
4. Where we get it from
Directly from you — forms, email, calls
Automatically — cookies and server logs when you use the site
From public sources — where we research a prospective client, we may look at publicly available business information such as your company website, Companies House, or your public LinkedIn profile
5. Why we use it, and our lawful basis
In short: mostly to answer your enquiry and run our business. Never without a lawful basis.
| What we do | Why | Lawful basis |
|---|---|---|
| Reply to your enquiry | You asked us a question | Legitimate interests — responding to a request you made |
| Arrange and hold a call with you | You booked it | Legitimate interests, and steps prior to entering a contract |
| Send you a proposal or pricing | You asked for it | Legitimate interests, and steps prior to entering a contract |
| Send you marketing about our services | Keeping you informed | Consent, or the "soft opt-in" under PECR where you've already enquired |
| Keep our site secure, prevent spam and abuse | Protecting our systems and yours | Legitimate interests |
| Keep records of business enquiries | Running and defending our business | Legitimate interests |
| Comply with legal or regulatory obligations | We have to | Legal obligation |
On legitimate interests: where we rely on this basis, we've assessed that using your business contact details to respond to an enquiry you made, or to tell you about services relevant to your role, doesn't override your rights. You can object at any time — see Section 10.
6. Who we share it with
In short: only our service providers, and only what they need. We never sell your data.
We use the following providers to run this website. Each processes personal data on our instructions under a written contract:
| Provider | What they do for us | Where |
|---|---|---|
| Vercel | Website hosting | [USA] |
| Formspree | Enquiry form processing and delivery | [USA] |
| Calendly | Call booking | [USA] |
| [Domain and email provider] | Domain registration and email | [location] |
We do not currently use Google Analytics, any other website analytics tool, or a CRM to manage enquiries. If we introduce any of these, we will update this table — and this policy — before they go live, not after.
We may also share personal data with:
Our professional advisers — accountants, solicitors, insurers — where necessary
Regulators, courts, or law enforcement — where legally required
A buyer or successor — if we sell or restructure the business, personal data may transfer as part of that
We do not sell your personal data, and we do not share it with third parties for their own marketing.
7. Cookies
In short: we don't currently set cookies that need your consent.
The only cookies this site sets today are strictly necessary ones, plus functional cookies set by Calendly when you use our call-booking tool. We do not currently use analytics or marketing cookies.
Full detail — including exact cookie names and how long each lasts — is in our Cookie Policy.
8. Sending data outside the UK
In short: some of our providers are outside the UK. Where they are, we use approved safeguards.
Some of the providers listed in Section 6 are based outside the United Kingdom, including in the United States. Where personal data is transferred outside the UK, we make sure one of the following applies:
- The country has a UK adequacy decision — meaning the government has decided its data protection is broadly equivalent to ours; or
- We have an International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses in place with the recipient, supported by a documented transfer risk assessment; or
- Another safeguard permitted under Chapter V of UK GDPR applies.
This section covers our website suppliers. It does not cover transfers to our India-based Employer of Record partner, which are addressed separately in our Data Processing Agreement with clients and our Employee Privacy Notice, since India does not have a UK adequacy decision and that transfer needs its own, fuller safeguards.
You can ask us for detail on the safeguards for any specific transfer by emailing hello@jutewise.com.
9. How long we keep it
In short: not longer than we need it.
| Data | Retention |
|---|---|
| Enquiries that don't become clients | [24] months from your last contact with us |
| Enquiries that become clients | For the length of the relationship, then 6 years (contract and tax records) |
| Marketing consent records | Until you withdraw consent, plus [2] years as proof of consent |
| Server and security logs | [12] months |
| Correspondence with us | [24] months, unless part of a client relationship |
At the end of these periods we securely delete or anonymise the data.
10. Your rights
In short: you have real control over your data, and exercising it is free.
Under UK GDPR you have the right to:
| Right | What it means |
|---|---|
| Access | Get a copy of the personal data we hold about you |
| Rectification | Have inaccurate or incomplete data corrected |
| Erasure | Have your data deleted, in certain circumstances |
| Restriction | Have us pause processing, in certain circumstances |
| Portability | Receive your data in a machine-readable format, where processing is based on consent or contract and is automated |
| Object | Object to processing based on legitimate interests — and to direct marketing at any time, absolutely and without needing a reason |
| Withdraw consent | Where we rely on consent, withdraw it at any time |
| Not be subject to automated decisions | We don't make solely automated decisions with legal or similarly significant effects |
To exercise any of these, email hello@jutewise.com.
We'll respond within one month. If your request is complex we may extend that by up to two further months, and we'll tell you if we do and why. There's no fee, unless a request is manifestly unfounded or excessive.
We may need to verify your identity first — we'll ask for the minimum necessary to do that.
11. Marketing
In short: you can opt out at any time, in one click.
We'll only send you marketing emails if you've consented, or if you've previously enquired about our services and we're contacting you about similar services (the "soft opt-in" under PECR).
Every marketing email has an unsubscribe link. You can also email hello@jutewise.com at any time. We'll action it promptly and keep a record of your objection so we don't contact you again by mistake.
12. Security
In short: we take it seriously, and we'll tell you if something goes wrong.
We use appropriate technical and organisational measures to protect your data, including encryption in transit, access controls, and staff confidentiality obligations.
No system is completely secure. If a personal data breach is likely to result in a risk to your rights and freedoms, we'll report it to the ICO within 72 hours, and tell you directly where the risk to you is high.
13. Children
Our website and services are aimed at businesses. We don't knowingly collect data from anyone under 18 through this site.
14. Changes to this policy
We may update this policy. The current version is always at this URL, with the "last updated" date at the top. Where changes are significant, we'll say so prominently.
15. Complaints
In short: tell us first if you can — but you can always go straight to the regulator.
If you're unhappy with how we've handled your data, please contact us at hello@jutewise.com and we'll try to put it right.
You also have the right to complain to the Information Commissioner's Office:
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Helpline: 0303 123 1113. ico.org.uk/make-a-complaint
You don't have to complain to us first.