1. Who We Are

ForgeDash Ltd (Company Number: 17032281) is the data controller for your personal information. We are registered in England and Wales and registered with the Information Commissioner's Office (ICO) under registration number ZC095670. The director responsible for data protection is Kaspars Rancans.

Registered Office: 14 Willow Way, Wisbech, UK
ICO Registration No: ZC095670
Director: Kaspars Rancans
Contact: [email protected]

2. What Data We Collect

We collect the following categories of personal data:

Account information — name, email address, trade type
Financial data you enter — income, expenses, invoices, receipts, customer records
Usage data — how you interact with the platform, pages visited, features used
Device and browser information — IP address, browser type, operating system, for security purposes
Payment information — processed securely by Stripe; we do not store full card details on our servers

3. How and Why We Use Your Data

Under UK GDPR, we must have a lawful basis for each processing activity:

Purpose	Lawful Basis
Providing ForgeDash services and calculating your tax obligations	Contract — necessary to deliver the service you signed up for
Processing payments via Stripe	Contract — to fulfil your subscription
Sending important service updates and security notifications	Legitimate interest — to keep your account secure and informed
Preventing fraud and ensuring platform security	Legitimate interest — to protect users and the service
Analytics on the marketing website (if you consent)	Consent — via cookie preferences
Complying with legal obligations (e.g. tax records, law enforcement requests)	Legal obligation

4. Who We Share Your Data With

We only share your data with trusted third-party providers necessary to deliver our services:

Supabase — database hosting and authentication (EU-based servers)
Stripe — payment processing (PCI DSS Level 1 certified)
Vercel — website hosting and delivery
Cloudflare — DNS, CDN, DDoS protection, and web application firewall (WAF)

We never sell, rent, or share your personal or financial data with third-party lenders, brokers, advertisers, or data brokers.

5. International Data Transfers

Your financial data is primarily stored on servers in the UK and EU. Some of our service providers (Stripe, Vercel, Cloudflare) may process data in the United States. Where data is transferred outside the UK, we ensure appropriate safeguards are in place, including:

UK International Data Transfer Agreements (UK IDTAs)
Standard Contractual Clauses (SCCs)
UK adequacy decisions where applicable

6. How Long We Keep Your Data

Data Type	Retention Period
Account information	Until you delete your account, plus 30 days
Financial records (income, expenses, invoices)	6 years after the tax year they relate to (HMRC requirement)
Payment transaction records	6 years (legal obligation)
Usage and analytics data	26 months
Cookie consent records	5 years (PECR requirement)

7. Data Storage & Security

We implement appropriate technical and organisational measures to protect your personal data, including:

Encryption at rest and in transit (AES-256, TLS 1.2+)
Cloudflare DDoS protection and Web Application Firewall (WAF)
Row-level security on all database tables
Regular security audits and vulnerability assessments
Secure authentication with password hashing and session management
Access controls based on the principle of least privilege

8. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

Right to be informed — this privacy policy fulfils this right
Right of access — request a copy of the personal data we hold about you
Right to rectification — request correction of inaccurate or incomplete data
Right to erasure — request deletion of your personal data ("right to be forgotten")
Right to restrict processing — request that we limit how we use your data
Right to data portability — receive your data in a structured, machine-readable format
Right to object — object to processing based on legitimate interests
Rights related to automated decision-making — ForgeDash does not make solely automated decisions with legal or significant effects

How to Exercise Your Rights

To exercise any of these rights, contact us at [email protected]. We will respond to your request within one month. You can also export your data directly from the ForgeDash dashboard at any time.

Right to Complain

If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).

ICO Contact: 0303 123 1113 · ico.org.uk

9. Our Role: Controller vs Processor

As a data controller: We determine how and why your personal data is processed when you use ForgeDash. This includes your account information, usage data, and marketing website data.

As a data processor:When you enter your customers' information into ForgeDash (e.g. customer names and contact details on invoices), you are the data controller for that customer data, and we process it on your behalf to deliver our services.

10. Cookies

We use essential cookies to make ForgeDash work and optional analytics cookies (with your consent) to improve our marketing website. For full details, see our Cookie Policy.

11. Children's Privacy

ForgeDash is designed for self-employed adults and sole traders. We do not knowingly collect data from individuals under 18. If we become aware that we have collected data from a minor, we will delete it promptly.

12. Changes to This Policy

We may update this privacy policy from time to time. If we make significant changes, we will notify you by email or through a notification on the ForgeDash platform. The "Last updated" date at the top of this page will always reflect the most recent version.

13. Contact Us

For any privacy-related questions or requests, contact us at:

ForgeDash Ltd

Kaspars Rancans, Director

14 Willow Way, Wisbech, UK

Email: [email protected]

Company Number: 17032281 · ICO Registration No: ZC095670 · Registered in England and Wales

Privacy Policy