What personal data Elysium Code collects, why, who sees it, how long it is kept and what you can ask us to do with it.
Elysium Code is a trading name of D Henderson Ltd, a private limited company registered in England and Wales, company number 14785033, registered office 26 Quinton Close, Redditch, England, B98 0EL. D Henderson Ltd is the data controller for the personal data described in this notice.
Questions about your data, or requests to use any of the rights below, go to hello@elysiumcode.co.uk. We are a small company and are not required to appoint a Data Protection Officer.
This notice applies to visitors to elysiumcode.co.uk, people who enquire about our services, clients and their staff, and suppliers and subcontractors we work with. Our company website, dhendersonltd.co.uk, has its own short notice.
Where we build or maintain software for a client that handles personal data, such as a booking system or customer portal, we process that data on the client’s instructions as their processor. The client’s own privacy notice applies to it. See Working on client systems below.
| When | What | Why | Lawful basis |
|---|---|---|---|
| You use the contact form | Your name, email address, subject and message, plus your phone number and budget if you choose to give them. | To read and reply to your enquiry, and to prepare a proposal if you ask for one. | Our legitimate interest in responding to enquiries, and steps you ask us to take before entering a contract. |
| You email, call or message us (including on LinkedIn) | Your contact details and whatever you include in the message. | As above. | As above. |
| You become a client | Business contact details for you and your colleagues; proposals, contracts and project records; correspondence; invoices and payment records; and any system credentials you give us for the work. | To deliver the work, manage the relationship, invoice and get paid, and keep the records that company law and HMRC require. | Performance of our contract with you; our legal obligations to keep accounting and tax records; our legitimate interest in running the business. |
| You are a supplier or subcontractor | Contact details, the contract between us, invoices, payment details and the work you deliver. | To engage and pay you and keep statutory records. | Contract; legal obligation; legitimate interests. |
| You visit this website | The technical data your browser sends to fetch a page: your IP address, browser type and the page requested. We keep no visitor logs and run no analytics. | To serve the pages and keep the site secure. | Our legitimate interest in running a secure website. |
We do not use your details for marketing, do not send newsletters, and never sell or rent personal data. What is stored on your device when you visit is set out on the cookies page.
Only the suppliers that run parts of the business for us, each under a contract that stops them using the data for anything else:
| Who | What they do for us | Where |
|---|---|---|
| Amazon Web Services | Hosts this website and the service that receives contact-form submissions. | London, UK |
| Postmark (ActiveCampaign, LLC) | Delivers contact-form submissions to our inbox by email, and keeps a copy of each message for 45 days. | United States, under the UK Extension to the EU-US Data Privacy Framework |
| Google Workspace | Our email, calendar and document storage. | Google’s UK and EU data centres, with the UK-approved safeguards in Google’s terms for any transfer outside the UK |
| Google reCAPTCHA | Protects the contact form from automated spam. Loaded only when you start filling in the form. | United States, under the UK Extension to the EU-US Data Privacy Framework |
| Xero | Our accounting software. Holds client and supplier billing details and invoices. | Xero’s terms include the ICO-approved safeguards for transfers outside the UK |
We may also share what is strictly necessary with our professional advisers (accountant, insurer, solicitor), with HMRC, Companies House or another authority when the law requires it, and with a buyer or successor if the business is ever sold. Where a supplier is outside the UK, the transfer is covered by a UK adequacy decision or by the International Data Transfer Agreement or Addendum approved by the Information Commissioner.
You can ask us for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it. You can also object to how we use it, ask us to restrict its use, or ask for it in a portable form. Email hello@elysiumcode.co.uk; we reply within one month and do not charge. Some records, such as invoices, have to be kept for the periods above even if you ask for deletion, and we will tell you if that applies.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113. We would appreciate the chance to put things right first.
Much of our work involves building and maintaining software that holds our clients’ customer data. For that data the client is the controller and we are the processor. We only process it on the client’s documented instructions, only as far as the work requires, keep it confidential, protect it with appropriate technical and organisational measures, tell the client without undue delay if we become aware of a breach relating to our work, and return or delete it when the work ends. The data-protection section of our Terms of Business sets this out in full. If you have a question about your data in a system we built for someone else, please contact that business; we will help them answer it.
Data is held on encrypted, access-controlled systems with two-factor authentication. Credentials clients give us are kept in a password manager, never in email or source code, and are shared with nobody else.
This website and our services are for businesses. We do not knowingly collect personal data from anyone under 18.
If this notice changes we will update this page and the date at the top. If a change affects how we use data we already hold about you, we will tell you directly.