Privacy Policy
Version: 2.1
Effective date: 22 Aug 2026
This notice explains what personal data SpotDev Services Ltd collects, why we collect it, what we do with it and what rights you have. It covers our website at www.spotdev.co.uk, our marketing, our sales process and our dealings with clients, suppliers and applicants.
It does not cover personal data we process on behalf of a client when delivering services to them. In that case the client decides what happens to the data and you should read their privacy notice. Our obligations to them are set out in our Data Processing Agreement.
1. Who we are
SpotDev Services Ltd is the controller of the personal data described in this notice.
| Company | SpotDev Services Ltd |
| Registered in | England and Wales, company number 14296175 |
| Registered office | Office 11, 3 Edgar Buildings, Bath BA1 2FJ |
| VAT number | GB 425818778 |
| Data protection contact | hello@spotdev.co.uk |
We are not required to appoint a Data Protection Officer and we have not appointed one. Data protection questions go to the address above and reach a named person internally.
2. The personal data we collect
- Contact and business details. Name, work email address, telephone number, job title, employer, and the content of your enquiry.
- Correspondence. Emails, messages, meeting notes, and recordings or transcripts of calls and online meetings.
- Website and marketing data. Pages viewed, referral source, approximate location derived from IP address, device and browser type, and whether you opened or clicked an email from us.
- Contract and billing data. Purchase orders, invoices, payment records and the details needed to administer an engagement.
- Recruitment data. Where you apply to work with us, your application, CV and interview notes.
We do not seek special category data (such as health, ethnicity or political opinions) and you should not send it to us. If you do, we will delete it unless we have a lawful reason to keep it.
3. Where we get it
Mostly from you, when you fill in a form, email us, call us, meet us or engage us. We also collect it from your device when you use our website, and from public and professional sources such as company websites, Companies House and business networking platforms, where we are researching an organisation we believe we can help.
4. What we use it for, and our lawful basis
| Purpose | Lawful basis |
| Responding to an enquiry and preparing a quote or proposal | Steps taken at your request before entering a contract, and our legitimate interests in running a business |
| Delivering services and managing an engagement | Performance of a contract, and our legitimate interests where the contract is with your employer rather than you |
| Business to business marketing, including our newsletter and outreach to people in relevant roles | Our legitimate interests in promoting our services. Where the law requires consent for an electronic message, we rely on consent |
| Non-essential cookies and analytics | Consent |
| Recording calls and meetings for accuracy, training and a written record | Our legitimate interests in keeping an accurate record of what was agreed |
| Keeping our systems and data secure | Our legitimate interests in protecting our business and our clients |
| Accounting, tax and statutory record keeping | Compliance with a legal obligation |
| Recruitment | Steps taken at your request before entering a contract, and our legitimate interests in assessing candidates |
Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights. You can ask us for that assessment, and you can object to the processing. See section 9.
5. Cookies and similar technologies
Our website sets cookies. Those that are strictly necessary to make the site work are set without asking you. Everything else, including analytics and advertising cookies, is set only if you consent through our cookie banner. You can change or withdraw that consent at any time using the cookie settings on the site.
Some of these technologies are operated by third parties, including HubSpot for website and marketing analytics and Microsoft Clarity for behavioural analytics. Their use of the data they collect is governed by their own notices.
6. Call and meeting recording
We record incoming telephone calls, and we record and transcribe online meetings, so that we have an accurate record of what was discussed and agreed and so that we can improve how we work. We will tell you at the start of a call or meeting that recording is taking place. You can ask us not to record, and you can ask us to delete a recording. Recordings and transcripts are held in our CRM and meeting tools and are subject to the retention rules below.
7. Who we share it with
We share personal data with the service providers who run our business systems. They act on our instructions and are bound by contract. The categories are:
- CRM, website and marketing: HubSpot
- Productivity, email and file storage: Microsoft 365
- Project management and delivery: ClickUp, Supered
- Meeting recording and transcription: Fireflies
- Telephony: Aircall, CircleLoop
- Finance and payments: Xero, QuickBooks Online, Stripe
- Integration and automation: Pipedream, Zapier
- Data quality: Neverbounce
- Application hosting and infrastructure: Railway
- Artificial intelligence services: OpenAI, Anthropic, SpaceXAI
A current list of the providers we use when processing client data, and how we notify clients of changes to it, is in our Data Processing Agreement.
We also share personal data with our professional advisers, and with a regulator, court or law enforcement body where we are legally required to. If our business is sold or merged, personal data will transfer to the buyer and we will tell you.
We do not sell personal data.
8. Sending data outside the UK
Some of our people and some of our providers are outside the United Kingdom. Our engineering team includes people in South Africa, Romania and Italy.
Applications we host are hosted in the Netherlands. Transfers to the European Economic Area are covered by United Kingdom adequacy regulations, so no additional safeguard is needed. For transfers to countries not covered by adequacy regulations, including South Africa, we use the Information Commissioner's International Data Transfer Agreement or the International Data Transfer Addendum to the European Commission's standard contractual clauses, and we carry out a transfer risk assessment before relying on them. For transfers to providers in the United States we rely either on the United Kingdom Extension to the EU-US Data Privacy Framework, where the provider is certified to it, or on the same contractual safeguards.
You can ask us for a copy of the safeguards that apply to a particular transfer by emailing hello@spotdev.co.uk.
9. How long we keep it
We keep personal data only for as long as we need it, and then delete it. How long that is depends on why we hold it:
- Enquiries that do not become work: kept while there is a realistic prospect of doing business, then deleted.
- Client records: kept for the life of the engagement and afterwards for as long as a claim could reasonably be brought.
- Accounting and tax records: kept for the period required by law.
- Marketing contacts: kept while you remain engaged with us, and reviewed periodically so that contacts who have not engaged are removed.
- Call recordings and transcripts: kept while the related enquiry or engagement is live, and deleted once it closes and any question about what was agreed has passed.
- Unsuccessful job applications: kept until the recruitment process closes and for a short period afterwards in case you ask for feedback, then deleted.
- Records of an objection or an unsubscribe: kept indefinitely, because we need them to honour your request.
10. Your rights
You have the following rights over the personal data we hold about you:
- Access. To be told whether we hold data about you and to receive a copy.
- Rectification. To have inaccurate data corrected and incomplete data completed.
- Erasure. To have data deleted, where we no longer have a good reason to hold it.
- Restriction. To have us stop using data while a dispute about it is resolved.
- Objection. To object to processing based on our legitimate interests. You can object to direct marketing at any time and we will stop, with no exceptions and no need to give a reason.
- Portability. To receive data you gave us in a machine readable format, where we process it by automated means on the basis of consent or a contract.
- Withdrawal of consent. To withdraw consent at any time, where we rely on it. This does not affect anything we did before you withdrew it.
To exercise any of these, email hello@spotdev.co.uk. We will respond within one month. If your request is complex, or you have made several, we may extend that by up to two further months, and we will tell you within the first month if we do.
11. Complaints
You have the right to complain to us. If you think we have handled your personal data wrongly, email hello@spotdev.co.uk with the word "complaint" in the subject line, or write to us at the registered office above. You do not need to use a particular form or wording.
We will acknowledge your complaint within 30 days of receiving it. We will then look into it, keep you informed of progress and tell you the outcome, without undue delay.
You also have the right to complain to the Information Commissioner under section 165 of the Data Protection Act 2018. You can do that whether or not you complain to us first.
| Information Commissioner's Office | Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF |
| Helpline | 0303 123 1113 |
| Website | ico.org.uk |
12. Automated decision making
We do not make decisions about you that produce a legal effect, or a similarly significant effect, based solely on automated processing. We use artificial intelligence tools in our own work, for example to draft text, summarise a meeting or research an organisation, but a person reviews the output and a person makes the decision.
13. Children
Our services are sold to businesses and our website is not intended for children. We do not knowingly collect personal data about children. If you believe we have, email hello@spotdev.co.uk and we will delete it.
14. Other websites
Our website links to other websites and includes features operated by third parties. We are not responsible for their content or their privacy practices, and this notice does not apply to them.
15. Changes to this notice
We review this notice at least once a year and whenever our processing changes materially. When we change it we update the version number and effective date below. Where a change materially affects you, we will tell you directly rather than relying on you to check.
16. Document control
| Document | SpotDev Privacy Policy |
| Version | 2.1 |
| Effective date | 22 Aug 2026 |
| Next review | 22 Aug 2027 |
| Owner | Chief Executive |
| Approver | Chief Executive |
| Supersedes | All previous versions of the SpotDev privacy policy |
