Version 2.1 · Effective 29 September 2026
1. Who we are and what this policy covers
PastWipe Ltd is the controller of personal information collected through this website and our related business enquiries. We process personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We are registered in England and Wales with company number 16893742. Our registered office is 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. For privacy requests or complaints, contact info@pastwipe.com with “Privacy” in the subject line. This policy covers website visitors, enquiry contacts, prospective customers and partners, support contacts and recruitment enquiries. Processing carried out on a customer’s behalf is addressed in the applicable customer agreement and data-processing terms.
2. Information we collect
We collect information you provide in contact, briefing, evaluation, careers and support forms, in Ask PastWipe, when you subscribe to our newsletter, and in subsequent correspondence. Depending on the enquiry, this may include your name, work email, organisation, role, optional telephone number, enquiry type, description and information you choose to provide. Recruitment enquiries may include your professional profile, experience and work preferences. Giving us information is voluntary, but we need the fields marked as required to respond; without them we may not be able to handle your enquiry. Do not submit sensitive personal information, credentials or protected customer datasets through public forms.
3. Technical and campaign information
When you use the website, technical information such as IP address, browser and device characteristics, request times, page paths and security events may be processed to deliver and protect the service. We record the relevant form or page to route an enquiry. If you choose Accept optional, an enquiry you send also includes the campaign tags from the link you arrived by, the path of the first page you visited on our website and the referring website, and Google Analytics measures how the website is used. If you choose Reject optional, or your browser sends a Global Privacy Control signal, this campaign information is not sent with your enquiry and Google Analytics does not load. You do not need to accept optional storage to make an enquiry. Our Cookie Policy explains the details and your choices.
4. Why we use personal information
We use business contact and correspondence information to respond to enquiries, arrange briefings, scope evaluations, manage business relationships, consider recruitment enquiries and provide agreed support. We normally rely on legitimate interests in conducting and protecting our business and communicating with people who contact us, having considered their rights and reasonable expectations. Where the individual concerned is personally a party to a contract, we may instead rely on taking requested pre-contract steps or performing that contract. We rely on legal obligations where applicable, for example to keep accounting and tax records. Optional analytics, optional campaign storage and any separately requested marketing use consent. Marketing permission is not required to obtain a response to an enquiry. We do not carry out automated decision-making, including profiling, that produces legal or similarly significant effects on you.
5. Forms and Ask PastWipe
Website enquiries and Ask PastWipe submissions are sent by a small form-handling service on our website server to info@pastwipe.com for a response. Ask PastWipe is an enquiry form; it is not a third-party live-chat service. Cloudflare Turnstile is a strictly necessary security check provided by Cloudflare. It helps distinguish genuine requests from automated abuse and may process device and browser signals and your IP address. Please read Cloudflare’s privacy information at https://www.cloudflare.com/privacypolicy/. Submitting an enquiry does not sign you up for marketing.
5a. Newsletter (Post-Breach Briefing)
If you subscribe to our quarterly Post-Breach Briefing, we process your email address and, if you give them, your name and organisation, to send the newsletter. We rely on your consent, which you give with a separate, unticked checkbox and then confirm by clicking the link in a confirmation email (double opt-in). We record the time of your request and confirmation, the version of the consent wording you agreed to, and a one-way hash of your IP address, so that we can show that you consented. Every newsletter email includes an unsubscribe link, and you can also unsubscribe by emailing info@pastwipe.com. Withdrawing consent does not affect earlier processing. The confirmation and newsletter emails are sent through our email provider (Namecheap). We do not share subscriber lists or use them for advertising. Unconfirmed sign-ups are not used and are deleted after 30 days.
6. Who receives information
Information is available to people at PastWipe who need it to handle the enquiry or perform their duties. We use these service providers, which process personal information on our behalf: Cloudflare, Inc. (website delivery, network security and the Turnstile anti-spam check); Hostinger (hosting of the virtual private server that runs our website and form-handling service); Namecheap, Inc. (hosting of our email, including info@pastwipe.com); and Google Ireland Limited and Google LLC (Google Analytics and Google Tag Manager, only if you choose Accept optional). Professional advisers, insurers and competent authorities may receive relevant information where necessary and lawful. Providers relevant to a proposed customer service are set out in its data-processing terms. We may disclose information in a business transaction where lawful and subject to appropriate protections.
7. Processing locations and international transfers
PastWipe Ltd is a UK company, but our service providers may process information outside the UK, for example in the European Economic Area or the United States. Transfers to the European Economic Area rely on the UK’s adequacy regulations. For transfers to the United States, where the recipient is certified under the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), we rely on the UK adequacy regulations for that bridge. Otherwise we use the UK International Data Transfer Agreement (IDTA) or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment and any additional protections needed. Contact us for information about processing locations and a copy or explanation of the applicable safeguards, subject to lawful redactions.
8. Retention
We retain identifiable information only for as long as necessary for the relevant purpose. The schedule below applies unless a shorter period is sufficient or a specific legal requirement or documented legal hold justifies longer retention. A legal hold is limited to the relevant records and reviewed. Customer contract records may have separate requirements under the signed agreement. Backups are used only for recovery; information restored from a backup is put back into the deletion process.
| Record category | Retention rule to apply |
|---|---|
| General enquiries and prospect correspondence | Up to 24 months after the last contact, unless a business relationship follows. If it does, the records needed for it move to the contract schedule below. We delete sooner if information is no longer needed. |
| Support correspondence | Up to 24 months after the ticket closes; retain separately any minimum record needed for a legal claim or contract obligation. |
| Recruitment enquiries | Up to 6 months after the decision or last contact. A separate, optional talent-pool consent may allow up to 12 months before renewal or deletion. |
| Routine website security logs and telemetry | Up to 90 days. Retain a relevant extract longer only for a documented incident, legal obligation or claim. |
| Backups | Backups are overwritten on a rolling cycle within 30 days. Recovery access is restricted, and earlier deletions are reapplied if information is restored. |
| Contract, invoice and tax records | 6 years from the end of the financial year to which they relate, to meet UK company law (Companies Act 2006) and HMRC record-keeping requirements. We keep only the records needed for accounting, tax and legal claims. |
| Newsletter subscriptions | While you remain subscribed. Unconfirmed sign-ups: deleted after 30 days. After you unsubscribe we keep only the minimum suppression and consent record needed to respect your choice and show that earlier emails were sent with consent. |
| Marketing choices and suppression | Stop marketing on withdrawal or objection. Retain the minimum suppression record needed to prevent further unwanted contact. |
| Browser storage and optional analytics | Browser storage: the periods in our Cookie Policy. Google Analytics (only after Accept optional): event-level data is kept for 14 months and then deleted automatically. Aggregated reports that do not identify you may be kept longer. |
9. Your rights
Depending on the circumstances and legal basis, you may request access, correction, erasure, restriction or portability of your personal information. You may withdraw consent at any time without affecting processing that was lawful before withdrawal. Contact info@pastwipe.com. We may need proportionate information to verify your identity. We respond within the applicable statutory period, normally one month, and explain any lawful extension or restriction.
10. Your right to object
You may object to processing based on legitimate interests for reasons relating to your situation. You may object to direct marketing at any time; we will stop that use. You can also withdraw optional storage permission through Cookie settings.
11. Complaints
Please send a privacy complaint to info@pastwipe.com with “Privacy complaint” in the subject line. We will acknowledge it within 30 days, investigate without undue delay, keep you informed and communicate the outcome. You may also complain to the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/ or telephone 0303 123 1113. Any right to complain to another competent supervisory authority is unaffected.
12. Other points and updates
The website is intended for professional enquiries and is not directed at children. If you believe a child has provided personal information, contact us. We may update this policy to reflect changes in processing or law and will show the effective date of the revised version. Where a material change requires renewed consent or a separate notice, we will provide it.