This is a working draft written to the shape of UK GDPR and PECR. The bracketed fields must be filled in, and it should be read by a solicitor or a data-protection adviser before it goes live — a privacy notice is a legal statement about your business, not boilerplate. In particular you must add a contact route for data-protection requests; a notice without one does not meet Article 13.
1. Who we are
Fisem is field service management software for UK service and repair firms. It is built and operated by YNK Digital Ltd, a company registered in England & Wales (company number 17432710), registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.
For the personal data described in this notice, YNK Digital Ltd is the data controller — except where section 4 says otherwise.
Data-protection questions and requests: privacy@ynkdigital.com.
2. What we collect
When you send us a message
The contact form asks for your name, company, work email, and optionally your phone number, your trade, roughly how many engineers you run and what you would like to fix. We also record whether you ticked the optional box asking for product updates.
When you open an account
Your name, work email, phone number, the company you work for and your role in it; your password, held only as a cryptographic hash that cannot be reversed; and, if you subscribe, the billing details needed to take payment. Card details are handled by our payment provider — we never see or store a full card number.
When you use the app
Records of what happened: which account did what and when, sign-in times, IP address and device or browser type. This is how we keep accounts secure, investigate faults and show your own administrators who changed what.
When you visit the website
Strictly necessary cookies, and — only if you agree — analytics that tell us in aggregate which pages are useful. See the cookie notice.
We do not buy personal data from third parties, we do not build profiles for advertising, and we do not use your data to train anyone's models.
3. Why we use it, and on what legal basis
| What we do | Why | Lawful basis (UK GDPR Art. 6) |
|---|---|---|
| Answer your enquiry | You asked us a question and we reply to it. | Legitimate interests — replying to someone who contacted us about our product. |
| Run your account and provide the service | Give you the software you signed up for, support it, and bill for it. | Performance of a contract. |
| Keep the service secure and working | Detect abuse, investigate faults, keep audit records. | Legitimate interests — running a secure, reliable service. |
| Send product updates | Occasional email about what has changed in Fisem. | Consent — the optional box on the form. Withdraw it any time. |
| Understand how the site is used | Aggregate analytics, so we know which pages help. | Consent — analytics cookies are off unless you switch them on. |
| Meet our own legal duties | Accounting and tax records, responding to lawful requests. | Legal obligation. |
Where we rely on legitimate interests, we have weighed our interest against your rights and concluded the processing is what you would reasonably expect. You can object — see section 9.
4. Your customers' data inside Fisem
Fisem holds records about your customers, their sites, their equipment and the engineers who visit them. For that data you are the controller and we are the processor: we hold and process it on your instructions, under the terms of your subscription, and for no purpose of our own. We do not sell it, mine it or use it to market to your customers.
Business customers who need one can ask us for a data processing agreement setting this out formally.
5. Who we share it with
We share personal data only with suppliers who help us run the service, and only what they need:
- Hosting and database — Supabase, to store and serve the application.
- Email delivery — Resend, to send account and service email.
- Payment processing — Stripe, to take subscription payments.
- Bot protection — Cloudflare Turnstile, to check that a message sent through our contact form, or a new account, comes from a person. It sees your IP address and browser signals at the moment you send the form, and sets no cookie on our site.
- Analytics — none at present, only where you have consented.
Each is bound by a written contract to act only on our instructions and to keep the data secure. We may also disclose data where the law requires it, or to establish or defend legal claims. We never sell personal data, and we do not pass it to anyone for their own marketing.
6. Where it is held
We aim to keep personal data in the United Kingdom or the European Economic Area. Where a supplier processes data outside that area, we rely on UK adequacy regulations or on the International Data Transfer Agreement or Addendum, with additional safeguards where they are needed. Current locations: Our application and database run in London (Supabase eu-west-2, Vercel lhr1) and our email is sent from the EU (Resend, eu-west-1). Our payment provider (Stripe) and Google — which distributes the app and delivers its push notifications — process data outside the UK and EEA, under the safeguards described above.
7. How long we keep it
This is how long we need personal data for. Records are deleted by our team when an account closes or when you ask us to.
| Data | Kept for |
|---|---|
| Enquiries that do not become customers | 24 months from your last contact with us. |
| Account and service data | While your account is open, and 90 days after it closes so you can export it or we can restore it. |
| Marketing consent records | Until you withdraw consent, plus a record of the withdrawal. |
| Security and audit logs | Kept while your account is open. Audit records are append-only, so entries cannot be changed or removed once written. |
| Invoices and accounting records | Six years, as UK tax law requires. |
To have your data deleted, write to privacy@ynkdigital.com. We remove what we can, unless the law requires us to keep it — an invoice, for example, has to stay for six years.
8. How we protect it
Data is encrypted in transit and at rest. Access is limited to the people who need it and is logged. Every account's data is isolated from every other account's at the database level, so one customer can never read another's records. If a breach happens that risks your rights, we will report it to the ICO within 72 hours and tell you without undue delay.
9. Your rights
Under UK GDPR you can ask us to:
- Show you what personal data we hold about you, and why.
- Correct anything that is wrong or incomplete.
- Delete it, where we have no continuing reason to keep it.
- Restrict what we do with it while a question about it is resolved.
- Give you a copy in a portable, machine-readable format.
- Stop processing you object to, including any direct marketing — that one is absolute.
- Withdraw consent at any time, without affecting what was done before you withdrew it.
Write to privacy@ynkdigital.com and we will answer within one month. We do not charge for this. We may ask you to confirm who you are before we release anything.
If your request concerns data held inside a customer's Fisem account, we will point you to that customer, who is the controller for it.
10. Cookies
Nothing optional is set until you choose. The cookie notice lists what is used and why, and you can change your choice at any time from "Cookie settings" in the footer.
11. If you are unhappy
Tell us first at privacy@ynkdigital.com — most things are quicker to fix directly. You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk or on 0303 123 1113.
12. Changes to this notice
If we change how we use personal data we will update this page and change the date at the top. Where a change is significant we will tell account holders directly rather than leaving you to notice it.