Last updated 1 October 2026
Who we are
STRATIFY provides admin automation for UK small businesses. For the personal information described here, STRATIFY is the data controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Questions about your data, or requests to use your rights, go to info@stratifyconsulting.co.uk. We aim to reply within one working day, and always within one month.
What we collect
When you send an enquiry
- Your name, email address and business name
- Your industry, and anything you choose to tell us in your message
- Any later correspondence about your enquiry
When you visit the site
- Server logs: the page requested, the time, your browser type and an anonymised IP address (the last part is removed before it is written to disk). These protect the site from abuse.
- Your cookie choice. We do not use advertising or tracking cookies. See the cookie policy.
- Only if you switch on analytics: which page you viewed, whether you're on a phone, tablet or computer, and the website that sent you (for example "google"). We count these on our own server. No cookies are used for this, and no IP address, browser details or visitor ID is recorded, so the counts can't be linked to you.
When you sign in to the client dashboard
- Your sign-in is checked in your browser. A temporary session key is kept in your browser tab until you sign out, close the tab or are idle for 15 minutes.
We do not knowingly collect information from children, and we do not ask for special category data (such as health information) through this website. Please don't include it in an enquiry.
Why we use it, and our lawful basis
| Purpose | Lawful basis (UK GDPR Article 6) |
|---|---|
| Replying to your enquiry and preparing a proposal | Steps at your request before entering a contract, and our legitimate interest in responding to people who contact us |
| Keeping the website secure and working | Legitimate interests (preventing fraud and abuse) |
| Optional analytics, only if you switch it on | Consent, which you can withdraw at any time |
| Meeting legal, tax and accounting duties | Legal obligation |
We never sell your data, and we never use it for automated decisions that have legal or similarly significant effects on you. We will only send marketing emails if you have asked for them, and every one has a one-click unsubscribe.
If you become a client
When STRATIFY works on your business, you remain the controller of your customers' and patients' data, and we act as your processor under a written data processing agreement (UK GDPR Article 28). In short:
- Each client's records sit in their own isolated database and search index. Nothing is pooled.
- Health information is processed on locally hosted models by default (UK GDPR Article 9).
- Legal correspondence is excluded from detailed logging.
- You choose how long records are kept, and we can export or erase everything on request.
- We will tell you without undue delay about any personal data breach, so you can meet the ICO's 72-hour deadline.
- Any sub-processor, and any transfer outside the UK, is listed in the agreement and protected by appropriate safeguards.
Who we share it with
Only the service providers we need to run STRATIFY, each bound by data processing terms and confidentiality:
- Our hosting provider, which runs our servers
- Our email provider, which delivers our replies to you
- Professional advisers such as our accountant or lawyer, where needed
- Regulators or law enforcement, only where the law requires it
Where it is stored
Our website and enquiry records are hosted in the UK or the European Economic Area. If we ever need to transfer your data outside these areas, we will only do so with appropriate safeguards in place, such as the UK International Data Transfer Agreement, and we will update this notice first.
How long we keep it
| Information | How long |
|---|---|
| Enquiries that don't lead to work | 12 months from our last contact, then deleted |
| Client contract and billing records | 6 years after the contract ends, for tax and legal purposes |
| Anonymised server logs | 14 days |
| Analytics counts (only if you allowed analytics) | 13 months, then deleted |
| Your cookie choice | 6 months, then we ask again |
How we protect it
- All traffic is encrypted with HTTPS, and the site loads nothing from third parties. Fonts and images are served from our own server.
- Strict browser security rules block scripts from anywhere but our own site.
- Dashboard data is encrypted (AES-256) and only opens with the right password. Sign-in pauses after repeated failed attempts and signs out after 15 minutes without activity.
- Server access is limited to named staff using key-based logins, with backups encrypted.
Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you
- Correct anything that is wrong or incomplete
- Erase your data, where there is no reason for us to keep it
- Restrict how we use it, or object to our use of it
- Port your data to another provider in a common format
- Withdraw consent at any time, where we rely on it
To use any of these rights, email info@stratifyconsulting.co.uk. It's free, and we will reply within one month.
Cookies
We only use the cookies needed to run the site, unless you choose otherwise. The cookie policy lists every one, and you can change your choice at any time.
Complaints
If you're unhappy with how we've handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.
Changes to this notice
We'll update this page if anything changes, and show the date at the top.