What personal information we handle as a business, why, and the rights you have. Data inside a client's own system is governed by that client's notice and our DPA with them.
Version PUBLIC_2026_08_v1 · Effective 20 August 2026
1. Who we are
The controller for the personal information described in this notice is Nullshift Development Ltd, trading as Nullshift, company number 17284213, whose registered office is 66 Paul Street, London, England, United Kingdom, EC2A 4NA. Privacy contact: louis@nullshift.co.uk. ICO registration currently published by Nullshift: ZC214743.
2. Information we collect
Depending on how you interact with Nullshift, we may process:
- —identity and business-contact information such as name, job title, company, email and telephone number;
- —enquiry, proposal, project and contract communications;
- —account/client-portal information and authentication records;
- —billing, transaction and invoice information (but not full payment-card details where payment is handled by a payment processor);
- —support tickets, meeting notes and technical communications;
- —website/device information such as IP address, browser/device details, security logs and consent preferences;
- —marketing preferences and records of communications;
- —information you provide when exercising data rights or making a complaint; and
- —limited information from public business sources or referrals where relevant to a legitimate business relationship.
Client end-user data processed inside a Client System is normally processed by Nullshift as a processor for that Client and is governed by the Client's privacy notice and Nullshift's Data Processing Agreement with that Client.
3. Why we use information and lawful bases
| Purpose | Typical lawful basis |
|---|---|
| Respond to enquiries and take pre-contract steps | Legitimate interests and/or steps requested before contract |
| Deliver and administer client services | Contract; legitimate interests for business-contact data |
| Billing, accounting and tax records | Contract and legal obligation |
| Protect systems, prevent abuse and investigate security events | Legitimate interests; legal obligation where applicable |
| Manage suppliers and professional advisers | Legitimate interests / contract |
| Improve services and business operations | Legitimate interests, subject to privacy impact |
| Send B2B service/relationship communications | Legitimate interests where permitted |
| Send marketing requiring consent | Consent or another lawful basis only where the electronic-marketing rules permit it |
| Establish, exercise or defend legal claims | Legitimate interests / legal obligation |
| Handle data-protection complaints and rights requests | Legal obligation and legitimate interests |
Where we rely on legitimate interests, our interests are generally running and securing a technology-services business, responding to business enquiries, managing client relationships and improving our services. We consider the impact on individuals and do not use legitimate interests where those interests are overridden by rights and freedoms.
4. Marketing
We do not treat a transactional/service email as permission for unrelated marketing. Where the law requires consent for electronic marketing, we will request it separately or rely only on a valid applicable exception. Marketing messages must contain an easy unsubscribe/opt-out mechanism.
5. Cookies and similar technologies
Our use of cookies and similar technologies is described in the Cookie Policy. Non-essential storage/access technologies must not be activated before the required consent unless Nullshift has deliberately configured that technology to meet a current statutory exception.
6. Sharing information
We may share personal information with:
- —hosting, infrastructure, database, communications, support and security providers;
- —payment processors for billing;
- —professional advisers such as accountants, lawyers and insurers;
- —authorities where disclosure is legally required;
- —a purchaser/investor in connection with a genuine corporate transaction, subject to appropriate confidentiality; and
- —other suppliers necessary to operate Nullshift.
The current material subprocessor and supplier list is maintained at /legal/subprocessors.
7. International transfers
Some suppliers may process information outside the UK. Where the UK international-transfer rules require safeguards, we use a recognised mechanism such as adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses or another lawful safeguard, and conduct transfer-risk assessment where required.
8. Retention
Our baseline retention schedule is:
| Record | Retention |
|---|---|
| Unsuccessful ordinary sales enquiries | 24 months after last meaningful contact |
| Client contracts, SOWs, Change Orders and material project records | 7 years after the relationship/project ends, unless longer is reasonably needed for a dispute |
| Accounting/tax records | At least the statutory period applicable to the record |
| Support/security logs | Risk-based period, commonly 6–24 months depending on system and purpose |
| Marketing suppression record | As long as reasonably necessary to honour the opt-out |
| Data-rights/complaint file | Normally 3 years after closure, longer if a dispute/regulatory matter continues |
Exact periods are confirmed with our accountant and against our actual systems before publication.
9. Automated processing and internal pricing
Nullshift may use internal software to calculate or recommend business-service pricing using factors such as platform usage, technical load, organisation reach and service complexity. The pricing model is intended to price a business service, not evaluate an individual's personal characteristics. Where information relating to a sole trader or individual business contact is used, the final quote can be manually reviewed. Nullshift does not use this pricing tool to make solely automated decisions producing legal or similarly significant effects about individuals.
10. Your rights
Subject to legal conditions and exemptions, individuals may have rights to access, correct, erase or restrict personal information, object to processing, receive portable information in some circumstances, withdraw consent, and obtain safeguards concerning qualifying automated decision-making.
Requests should be sent to louis@nullshift.co.uk. We may need proportionate information to verify identity/authority.
11. Data-protection complaints
You can make a data-protection complaint to louis@nullshift.co.uk or through /legal/data-complaint.
Nullshift will:
- —provide a clear electronic route for complaints;
- —acknowledge a data-protection complaint within 30 days of receipt;
- —take appropriate steps to investigate and respond without undue delay; and
- —tell the complainant the outcome.
You also have the right to complain to the UK Information Commissioner's Office, whose current contact details are published at ico.org.uk.
12. Security
We use proportionate technical and organisational measures designed to protect personal information. No internet service can be guaranteed completely secure.
13. Changes
We may update this notice to reflect changes in law, suppliers or business practices. This page shows the current effective date, and prior versions are retained internally where material.
Nullshift Development Ltd, trading as Nullshift · company number 17284213 · registered office 66 Paul Street, London, England, United Kingdom, EC2A 4NA · not VAT registered · ICO ZC214743