01
Scope and controller
LEVYLOOM LIMITED is the controller of personal information covered by this notice. We are a private limited company registered in England and Wales, company number 17302243, with our registered office at 85 Kings Road, Chelmsford, England, CM1 2BB.
Contact admin@levyloom.com for privacy questions or to exercise a data protection right.
What this notice does not cover
This website describes the Levyloom concept but does not provide an authenticated product or collect client tax records. If Levyloom later processes information through a product, pilot, customer workspace, recruitment process, or supplier relationship, the appropriate notice and contractual terms must be provided before that processing begins. A customer may also act as controller for information Levyloom processes on its instructions.
02
Information we handle
When you use this website
The application code has no contact form, analytics, advertising tracker, session replay, or browser-storage feature, and it does not set cookies. The current public domain's Cloudflare security edge does set one bot-protection cookie type. Our hosting and security providers may also receive routine technical request information needed to deliver and protect the site, such as your IP address, request date and time, requested URL, response status, browser or device user-agent, and security event data.
Read the cookie policy for the current audited cookie and browser-technology position.
When you contact us
We may receive your name, work contact details, organisation, role, the content of your enquiry, correspondence history, and any information you choose to include in an attachment. We receive this information directly from you or from a colleague contacting us on your behalf.
If another person gives us identifiable information about you, we will proactively direct you to the relevant privacy information within a reasonable period and no later than one month, or when we first communicate with you or disclose the information if that happens sooner, unless a lawful exception applies.
Please do not send client tax records, credentials, national identifiers, payment-card data, or special-category information to the general email address. Contact us first if your enquiry appears to require sensitive information so that we can agree a suitable channel and scope.
If sensitive, criminal-offence, confidential client, or excessive information arrives unexpectedly, we will restrict access and assess whether it can lawfully and safely be kept. We will securely delete or return it where it is not necessary. We will not use special-category or criminal-offence information unless a valid additional legal condition and appropriate safeguards apply.
Information we do not collect on this site
- No user account or login information.
- No client case, tax-return, banking, identity-verification, or authority data.
- No precise location, advertising profile, or cross-site browsing history.
- No payment information.
03
Why we use information and our lawful bases
Scroll horizontally to see all columns
| Purpose | Information | Lawful basis |
|---|---|---|
| Deliver, maintain, troubleshoot, and protect the public website. | Routine request, device, and security data. | Legitimate interests in operating a reliable and secure public website, balanced against visitors' rights and expectations. |
| Read, route, and respond to an enquiry. | Contact details, message, correspondence, and supplied files. | Legitimate interests in communicating with people who approach us. Where you ask us to take specific steps before entering a contract with you, those pre-contract steps are the basis instead. |
| Keep records or make disclosures that applicable law requires. | Relevant corporate, accounting, tax, request, complaint, and transaction records. | Legal obligation under applicable company, accounting, tax, data protection, or other law. The particular obligation depends on the record or request. |
| Maintain proportionate business records and establish or defend legal claims. | Relevant correspondence, request, complaint, and transaction records. | Legitimate interests in accountable administration and protecting legal rights. |
| Handle data protection rights and complaints. | Identity and contact details, request evidence, correspondence, and outcome. | Legal obligation. |
Our legitimate interests are limited to running and protecting the website, responding to people who contact us, maintaining proportionate records, and protecting legal rights. We consider the necessity and impact of this use and do not rely on legitimate interests where your rights and freedoms override them.
You do not have to provide information through this website. If you email us without enough information to understand or answer your enquiry, we may be unable to respond. We do not use the information covered by this notice for solely automated decisions with legal or similarly significant effects, and we do not profile website visitors for advertising.
05
How long we keep information
We keep personal information only for as long as needed for the purpose described, legal and accounting duties, security, and the establishment or defence of claims. We decide the period by considering the amount, nature, and sensitivity of the information; the risk of harm; whether the purpose can be achieved another way; and applicable legal, regulatory, accounting, security, and limitation requirements.
Scroll horizontally to see all columns
| Record | Retention criteria |
|---|---|
| Routine website request and security logs | The shortest period configured by the approved host for delivery, diagnostics, and abuse prevention, extended only where a specific incident or legal issue requires investigation. |
| Enquiries that do not become a business relationship | Until the enquiry is resolved, followed by a proportionate period based on whether a business relationship, follow-up, complaint, or claim is reasonably likely. |
| Contract and core business correspondence | For the applicable contractual, tax, accounting, and legal limitation period after the relationship or relevant transaction ends. |
| Rights requests, data protection complaints, incidents, and legal claims | For long enough to resolve the matter, demonstrate how it was handled, and meet any regulatory, legal, insurance, or active-proceedings requirement. |
Production hosting and email retention settings must be checked against these criteria before launch and after a supplier change. When a record is no longer required, we delete or anonymise it; residual copies may remain in protected backups until their normal overwrite cycle completes.
06
Your data protection rights
Depending on the circumstances and lawful basis, you may have the right to:
- ask for access to your personal information and related information;
- ask us to correct inaccurate or incomplete information;
- ask us to erase information;
- ask us to restrict how we use information;
- receive eligible information in a portable format;
- object to particular uses; and
- withdraw consent at any time where a future activity relies on consent.
Your right to object
You may object to processing based on our legitimate interests. Tell us what you object to and why. We will stop unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is needed for legal claims. You may object to direct marketing at any time; this website currently conducts no tracking-based or email subscription marketing.
These rights are not absolute and an exemption may apply. We may ask for proportionate information to verify identity or authority before acting. We normally respond without undue delay and within the period required by law. There is usually no fee, but the law permits one in limited cases.
07
Privacy requests and data protection complaints
Email admin@levyloom.com with the subject “Data protection complaint” if you believe we have not handled personal information lawfully or fairly. Include your contact details, what happened, the information or interaction concerned, and the outcome you seek. Do not send identity documents unless we ask for them through an appropriate channel.
We will acknowledge a data protection complaint within 30 days, take appropriate steps to investigate it without undue delay, keep you updated without undue delay, and communicate the outcome. If we cannot complete the investigation promptly, we will explain the position and continue to provide appropriate updates without undue delay.
You also have the right to complain to the Information Commissioner's Office. You can use theICO data protection complaint service. Contacting us first may allow us to resolve the issue, but it does not affect your right to approach the ICO.
08
Security, children, and changes
We use proportionate organisational and technical measures designed to protect personal information against unauthorised access, alteration, loss, or disclosure. No internet or email service is completely secure, so please use the contact route above before sending sensitive material.
This business-to-business website is not directed at children, and we do not knowingly seek personal information from children through it. If you believe a child has sent information to us, contact us so we can assess and handle it appropriately.
We review this notice when our website, suppliers, processing, or the law changes. Material changes will be made clear on this page and the “Last updated” date will change. Earlier versions can be requested from admin@levyloom.com where available.