Privacy notice

Who we are

Birchlow [LEGAL ENTITY NAME — CONFIRM] ("Birchlow", "we", "us") is the data controller for the personal data described in this notice. Company number [COMPANIES HOUSE NUMBER — CONFIRM], registered office [REGISTERED OFFICE ADDRESS — CONFIRM]. Contact us at hello@birchlow.co.uk about anything in this notice, including to exercise any of the rights below.

What we collect

When you use the Guaranteed Hours Exposure Calculator, all calculation happens in your browser — your workforce data (worker references, weekly hours, hirer names) is never sent to our servers, never logged and never stored.

If you choose to join the regulation alert list or request a PDF confirmation email, we collect: your email address, and optionally the sector and headcount band you select from a fixed list. We do not collect your IP address for this purpose — storing less is safer.

Why we collect it

Solely to notify you when the guaranteed hours regulations are made: the final low hours threshold, the final reference period, and what it means for a business your size. We do not use this list for any other marketing, and we do not sell or rent it to any third party.

Lawful basis

Consent (UK GDPR Article 6(1)(a)). You give this by an affirmative action — submitting the alert-list form with the consent wording shown next to it — and you can withdraw it at any time, as easily as you gave it. See "Your rights" below.

Who we share it with

• Resend — sends the confirmation and notification emails on our behalf (email processor).
• Supabase — hosts the database this data is stored in (hosting processor).

Where it is stored

In a Supabase project. The hosting region has not yet been confirmed — check the Supabase dashboard project settings and state the actual region (EU or UK) before this notice goes live.

Retention

Unsubscribed or soft-deleted addresses are permanently deleted 30 days after unsubscribing. Subscribed addresses that have not unsubscribed are kept until commencement is confirmed and the rung-3 notification email has been sent, then deleted automatically 90 days after that email goes out.

Your rights

Under UK GDPR you have the right to access, rectify, erase, restrict, object to the processing of, and receive a portable copy of your personal data, and to withdraw consent at any time. In practice:

• Unsubscribe (withdraw consent): click the unsubscribe link in any email we send you. One click, no login, takes effect immediately.
• Erasure: after unsubscribing, the confirmation page has a "also permanently delete my data" option that hard-deletes your row immediately, rather than just marking it unsubscribed. Alternatively, email hello@birchlow.co.ukand we will delete it within one month.
• Access, rectification, portability, objection: email hello@birchlow.co.uk and we will respond within one month.