Privacy policy

Barkaday Ltd ("Barkaday", "we", "us") is committed to protecting your privacy. This policy explains what personal information we collect through our website, our Free IT & Cyber Health Check and our enquiry forms, how we use and protect it, and the rights you have. It should be read with our cookie policy.

Who we are

Barkaday Ltd is the controller of the personal information described in this policy, for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. RiskBuddy is a trading style and product of Barkaday Ltd; the RiskBuddy platform has its own privacy policy.

For any privacy question or request, email hello@barkaday.com.

Information we collect

Information you give us

• Health check requests: your name, work email address, company name, company website or email domain, team size, sector and anything you tell us in the message box.
• Contact messages: your name, email address, company, phone number, topic and message.
• Correspondence: if you email, call or meet us, we keep a record of that contact.

Information collected automatically

• With each form submission: the page you submitted from, the referring page, any campaign (UTM) parameters in the link you followed, your browser's user-agent string and the time of submission.
• Server and security logs: our hosting provider records technical information such as your IP address, browser type and the pages requested, in order to deliver the site and protect it from abuse. We use IP addresses briefly to limit repeated form submissions.
• Website analytics, only with your consent: if you accept analytics cookies, Google Analytics collects information about how you use the site. See Website analytics below.

Information about your organisation's domain

When you request a health check, we carry out a passive review of publicly observable information about the domain you provide, such as its email authentication records (SPF, DKIM and DMARC), DNS configuration and public-facing services. We never attempt to access your systems or any non-public information.

How we use your information

• to respond to your enquiry and to carry out and report on your health check;
• to arrange and hold meetings you ask for;
• to send you relevant information about our services as a business contact. You can opt out at any time;
• to understand how our website is used and improve it (with your consent);
• to keep our website and forms secure and to prevent spam and abuse;
• to meet our legal, accounting and regulatory obligations.

We do not sell your personal information, and we do not make decisions about you based solely on automated processing.

Our lawful bases

• Steps you ask us to take before a contract: carrying out a health check you requested and preparing proposals.
• Legitimate interests: responding to business enquiries, following up with business contacts about relevant services, and keeping our website secure. We balance these interests against your rights, and you can object at any time.
• Consent: analytics cookies. You can withdraw consent at any time with the "Cookie settings" link at the bottom of every page.
• Legal obligation: keeping records we are required to keep by law.

Website analytics (Google Analytics)

If you accept analytics cookies, we use Google Analytics 4, provided by Google Ireland Limited and Google LLC, to understand how visitors find and use our website. This helps us improve our content and measure how well our marketing is working.

• Data collected: pages viewed, approximate location (derived from your IP address, which Google Analytics 4 does not store), device and browser type, screen size, referring website, visit duration and interactions with the site.
• Configuration: advertising features, Google signals and ad personalisation are turned off. We do not send names, email addresses or form contents to Google Analytics.
• Lawful basis: your consent. Google Analytics does not load until you choose "Accept analytics".
• Retention: analytics data is kept in our Google Analytics property for up to 14 months.
• Opting out: use "Cookie settings", your browser's cookie controls or Google's opt-out add-on. See also Google's privacy policy.

Who we share it with

We share personal information only with service providers that help us run our business, under contracts that require them to protect it and to use it only on our instructions:

• Vercel Inc.: hosts our website and processes the server and security logs described above.
• HubSpot, Inc.: our customer relationship management system, where we store and manage enquiries, health check requests and our correspondence with you. If you use our meeting-booking link, HubSpot also hosts the scheduling page.
• Google: Google Analytics, if you have consented.
• Microsoft: Microsoft 365, which we use for email, documents and meetings.

We may also disclose information to our professional advisers, if a buyer or successor takes over our business, or where the law requires it.

International transfers

Some of our providers process data outside the UK, including in the United States. Where they do, we rely on UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework) or on the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses, so that your information is protected to UK standards.

How long we keep it

• Enquiries and health check requests: up to 24 months after our last contact with you, unless you become a client.
• Clients: for the length of our contract, and then for up to six years for legal, tax and accounting purposes.
• Server and security logs: for the short period set by our hosting provider, normally no more than 30 days.
• Analytics data: up to 14 months.

When information is no longer needed, we delete it or anonymise it. Backup copies are removed on their normal cycle.

How we protect it

We protect personal information with technical and organisational measures appropriate to the risk. These include encryption in transit (HTTPS), multi-factor authentication and role-based access to our systems. No method of transmitting information over the internet is completely secure, but we work to reduce the likelihood of unauthorised access and to detect and respond quickly if it happens.

Your rights

Under UK data protection law you have the right to:

• access the personal information we hold about you, free of charge;
• have inaccurate information corrected;
• have your information deleted, or its use restricted;
• object to processing based on our legitimate interests, and to stop direct marketing at any time;
• receive your information in a portable format, where applicable;
• withdraw consent at any time, where we rely on consent.

To exercise any of these rights, email hello@barkaday.com. We will respond within one month. Every marketing email we send includes an unsubscribe link.

If you are unhappy with how we have handled your information, please contact us first so that we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

Children

Our website and services are intended for businesses. They are not directed at children, and we do not knowingly collect information from anyone under 18.

Links to other websites

Our website links to other websites, including RiskBuddy and our technology partners. Those sites have their own privacy policies, and we are not responsible for how they handle your information.

Changes to this policy

We will post any changes to this policy on this page and update the date at the top. Where a change materially affects you, we will tell you directly where we can.

Contact

Questions, comments and requests about this policy are welcome at hello@barkaday.com.