Privacy Policy

How we collect, use, and protect your personal data.

Last updated: 1 January 2026

1. Introduction

This privacy policy explains how Heavy Technology Solutions Limited ("we", "us", "our", "Heavy Tech") collects, uses, stores, and protects your personal data when you use our website at heavytech.co.uk and our SaaS platform (collectively, the "Services").

We are committed to protecting your privacy and handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Data Controller: Heavy Technology Solutions Limited, Company No. 14763677, registered in England & Wales. Our registered address is Suite 6, 1a Broom Street, Swinton, Manchester, M27 5AN.

If you have any questions about this privacy policy or our data practices, please contact us at info@heavytech.co.uk.

2. Data We Collect

We collect and process the following categories of personal data:

2.1 Information You Provide Directly

  • Account information: When you register for our platform, we collect your name, email address, telephone number, company name, job title, and billing address.
  • Contact form submissions: When you contact us or request a demo, we collect your name, email address, telephone number, company name, and any details you include in your message.
  • Payment information: When you subscribe to our services, we collect billing details. Payment card information is processed securely by our payment provider and is not stored on our servers.

2.2 Information Collected Automatically

  • Usage data: We collect information about how you interact with our Services, including pages visited, features used, actions taken, and time spent on the platform.
  • Device and technical data: We collect your IP address, browser type and version, operating system, device type, screen resolution, and referring URL.
  • Cookie data: We use cookies and similar technologies to collect data about your browsing activity. Please refer to our Cookie Policy for full details.

2.3 Operational Data

When you use our platform, you and your organisation may input operational data including but not limited to weighbridge transactions, vehicle details, driver information, customer records, invoicing data, and route information. You remain the data controller for any personal data contained within this operational data. We process it solely on your behalf as a data processor in accordance with our data processing agreement.

3. How We Use Your Data

We use your personal data for the following purposes and lawful bases:

  • To provide and maintain our Services (lawful basis: performance of a contract) — including creating and managing your account, processing transactions, and delivering the functionality of our platform.
  • To communicate with you (lawful basis: performance of a contract / legitimate interest) — including responding to enquiries, sending service-related notifications, and providing technical support.
  • To improve our Services (lawful basis: legitimate interest) — including analysing usage patterns, identifying bugs, and developing new features.
  • To send marketing communications (lawful basis: consent) — including product updates, industry news, and promotional offers. You may opt out at any time.
  • To comply with legal obligations (lawful basis: legal obligation) — including responding to lawful requests from regulatory authorities and maintaining required business records.
  • To protect our legitimate interests (lawful basis: legitimate interest) — including fraud prevention, security monitoring, and enforcement of our terms of service.

4. Third-Party Services

We share your personal data with the following categories of third-party service providers, each of whom is contractually obligated to protect your data:

4.1 Cloud Infrastructure

Our platform is hosted on Microsoft Azure, with data centres located in the United Kingdom. Microsoft Azure provides enterprise-grade security, encryption, and compliance certifications including ISO 27001 and SOC 2.

4.2 Email Services

We use Postmark (by ActiveCampaign) to send transactional emails such as invoice deliveries, account notifications, and password resets. Postmark processes recipient email addresses and message content on our behalf.

4.3 Analytics

We use analytics services to understand how visitors use our website and platform. These services may collect information such as your IP address (anonymised), pages visited, session duration, and referral sources. Please see our Cookie Policy for details on the specific analytics tools we use and how to opt out.

4.4 Payment Processing

Payment transactions are processed by our third-party payment provider. We do not store your full payment card details on our servers.

5. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:

  • Account data: Retained for the duration of your account and for up to 12 months after account closure, unless a longer retention period is required by law.
  • Contact form submissions: Retained for up to 24 months from the date of submission.
  • Operational platform data: Retained for the duration of your subscription. Upon termination, data is available for export for 30 days, after which it is permanently deleted within 90 days.
  • Financial records: Retained for 7 years as required by UK tax legislation (HMRC requirements).
  • Analytics data: Aggregated and anonymised analytics data may be retained indefinitely. Identifiable analytics data is retained for up to 26 months.
  • Marketing consent records: Retained for as long as consent remains valid, plus 12 months after withdrawal for record-keeping purposes.

6. Your Rights

Under the UK GDPR, you have the following rights regarding your personal data:

  • Right of access: You have the right to request a copy of the personal data we hold about you. We will respond to your request within one month.
  • Right to rectification: You have the right to request that we correct any inaccurate or incomplete personal data we hold about you.
  • Right to erasure: You have the right to request that we delete your personal data where there is no compelling reason for us to continue processing it. This right is not absolute and may be subject to legal obligations that require us to retain certain data.
  • Right to restrict processing: You have the right to request that we restrict the processing of your personal data in certain circumstances, for example while we verify the accuracy of data you have disputed.
  • Right to data portability: You have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format (such as CSV or JSON), and to request that we transmit that data to another controller where technically feasible.
  • Right to object: You have the right to object to processing based on legitimate interests or for direct marketing purposes.
  • Rights relating to automated decision-making: We do not currently make any decisions based solely on automated processing that produce legal or similarly significant effects on you.

To exercise any of these rights, please contact us at info@heavytech.co.uk. We will respond to your request within one month. In exceptional circumstances, we may extend this period by a further two months, in which case we will inform you of the extension and the reasons for it.

7. Data Security

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it, including:

  • Encryption of data in transit using TLS 1.2 or higher
  • Encryption of data at rest using AES-256 encryption
  • Regular security assessments and penetration testing
  • Role-based access controls limiting data access to authorised personnel
  • Multi-factor authentication for administrative access
  • Regular data backups with secure, geographically separated storage
  • Staff training on data protection and information security

8. International Data Transfers

Your personal data is primarily stored and processed within the United Kingdom. Where we transfer personal data outside the UK, we ensure appropriate safeguards are in place in accordance with UK GDPR requirements, such as standard contractual clauses approved by the Information Commissioner's Office (ICO) or transfers to countries with an adequacy decision.

9. Children's Data

Our Services are not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a child, we will take steps to delete that data promptly.

10. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by posting the updated policy on our website and updating the "Last updated" date. Where changes are significant, we may also notify you by email.

11. Complaints

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

  • Website: ico.org.uk
  • Telephone: 0303 123 1113
  • Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We would appreciate the opportunity to address your concerns before you contact the ICO, so please reach out to us first at info@heavytech.co.uk.

12. Contact Us

If you have any questions about this privacy policy or wish to exercise your data protection rights, please contact us:

  • Email: info@heavytech.co.uk
  • Post: Heavy Technology Solutions Limited, Suite 6, 1a Broom Street, Swinton, Manchester, M27 5AN
  • Company No.: 14763677