Privacy Policy

Waymarq is a project-tracking product operated by Tortoise IT Ltd, trading as Waymarq (“we”, “us”, “our”). For the personal data described in this policy, Tortoise IT Ltd is the data controller — with one important exception, covered under “Data our customers upload” below.

This policy covers the Waymarq marketing site, the Waymarq application, and the emails we send.

We collect the following categories of personal data:

Account data

Your name, email address, and password. Optionally a profile photo, job title, country, timezone and locale preferences.

Organisation data

Your organisation’s name, address, company registration number, tax reference and billing defaults, where you choose to provide them.

Content you create

Projects, phases, tasks, comments, time logs, files you upload, clients, opportunities, quotes, expenses and similar records.

Communications

Messages you send us through the contact form, including your name, email, organisation and what you wrote.

Technical data

Your IP address, browser and device information, and server logs recording requests to the service. Used for security, abuse prevention and diagnostics.

Analytics data

Only where analytics has been configured and you have consented — it is off by default. Aggregated usage information about the pages and features you use. See our cookie policy.

We do not intentionally collect special category data (health, biometrics, political opinions and so on), and you should not enter it.

UK GDPR requires us to have a lawful basis for each purpose. We rely on the following, and we do not claim consent for anything we do without asking you:

Running your account and storing your work

Contract — processing is necessary to provide the service you have signed up for.

Service emails (sign-in codes, invitations, notifications)

Contract — these are part of the service, not marketing.

Occasional help and product email

Legitimate interests, relying on the soft opt-in for our own similar services — you gave us your address when you signed up, every message carries a one-click unsubscribe, and you can switch it off in your notification settings at any time. We do not send this to anyone who has not signed up.

Responding to your enquiry

Legitimate interests — answering someone who has asked us a question. Where the enquiry is about a contract, contract applies instead.

Security, abuse prevention, diagnostics and backups

Legitimate interests — keeping the platform available, secure and working correctly, balanced against the limited impact on you.

Improving the product

Legitimate interests — understanding how the product is used so we can make it better.

Non-essential analytics cookies

Consent — analytics is off unless configured, and we will not switch it on without asking you first. You can withdraw agreement at any time.

Accounting and legal record-keeping

Legal obligation — where we are required by law to keep records.

Where we rely on legitimate interests, you have the right to object — see “Your rights” below — and we will stop unless we have compelling grounds to continue.

Waymarq customers use the product to manage work for their own clients, and in doing so they upload personal data about other people — client contact names, email addresses, supplier details, and whatever appears inside briefs, files, tasks and comments.

For that data, the customer is the data controller and Waymarq acts as a processor. We process it only on the customer's instructions — that is, to operate the service — and not for our own purposes. This distinction matters: if you are an individual whose details appear in a Waymarq account and you want to exercise your rights over that data, the customer who owns the account is responsible for answering you. If you contact us, we will pass your request on to them and support them in responding, but we cannot act on their data ourselves.

If you are a Waymarq customer and you require a formal data processing agreement covering this arrangement, get in touch through the contact form and we will provide one.

We keep the list of third parties deliberately short, and several of them only ever see data because you switched something on. None of them are permitted to use your data for their own purposes.

SiteGround (hosting)

Hosts the application and database. Processes all service data by definition of hosting it.

Cloudflare (CDN and DNS)

Sits in front of every request to the site: terminates connections, caches static files, and sees request metadata such as IP address and headers in the process.

Email delivery

Our outbound mail provider delivers service emails — sign-in codes, invitations, notifications and enquiry alerts.

Google Analytics

Only where analytics has been configured and you have consented. Collects aggregated usage data. Not used if analytics is switched off.

Companies House API

Only when someone actively performs a company lookup. We send the search term; we do not send your account data. Companies House data is public.

AI providers (Anthropic, OpenAI or Google)

Only where a customer has switched AI on — with their own API key, or during the small trial every new account gets on ours. Nothing is sent to any AI provider otherwise: AI is off by default and the product works fully without it.

We do not sell personal data, and we do not share it with advertisers. We may disclose data where we are legally required to, or to establish or defend legal claims.

Waymarq's AI features are optional and off unless a customer's owner or admin configures a provider and supplies their own API key. When they do, the content sent to that provider is the project material the feature needs — for example an uploaded specification and the existing task list — and it is sent under the customer's own account with that provider, subject to that provider's terms.

If a project's AI setting is off, or no key is configured, no project content ever leaves Waymarq for an AI provider. If you are unsure whether AI is switched on for an account you use, ask that account's owner.

Some of the processors above operate outside the UK and EEA — in particular AI providers and analytics providers, which are typically US-based. Where personal data is transferred outside the UK, we rely on the safeguards those providers put in place under UK data protection law, such as UK adequacy regulations or the International Data Transfer Addendum to the EU Standard Contractual Clauses, as applicable to that provider.

We do not hold our own separate transfer agreements with the AI providers a customer configures, because in that arrangement the relationship is between the customer and their chosen provider.

Account and content data

For as long as the account is active.

After you delete your account

Deleting your account removes your personal data and your organisation’s content from the live system. Residual copies may persist in encrypted backups for a short rolling period before being overwritten.

Contact enquiries

Kept while we deal with your enquiry and for a reasonable period afterwards, then deleted.

Server and security logs

Kept for a short period for diagnostics and abuse prevention, then rotated out.

Records we must keep by law

Retained for the period the relevant law requires — for example accounting records.

Under UK GDPR you have the right to:

• Access — ask for a copy of the personal data we hold about you.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — ask us to delete your data, where no legal basis requires us to keep it.
• Restriction — ask us to pause processing while a dispute about accuracy or lawfulness is resolved.
• Portability — receive the data you gave us in a structured, commonly used, machine-readable format, or have it sent to another provider where technically feasible.
• Object — object to processing we carry out on the basis of legitimate interests.
• Withdraw consent — where we rely on consent (analytics cookies), withdraw it at any time. Withdrawing does not affect processing already carried out.

Exercising these rights is free, and we will respond within one month. If your data sits inside a customer's Waymarq account rather than being data we hold as controller, see “Data our customers upload” above.

We may update this policy as the product changes. The “last updated” date at the top of this page always reflects the current version, and we will tell account holders directly about any change that materially affects them.

The quickest way to reach us about anything in this policy — including a request to exercise your rights — is our contact form. Choose “Data / GDPR request” as the subject so it reaches the right person and we can respond within the statutory one-month deadline.

The data controller is Tortoise IT Ltd, trading as Waymarq, a company registered in England and Wales. Our company website is sean-barton.co.uk, where our registered postal address and company details are published. We have not appointed a Data Protection Officer — we are not required to — so requests are handled directly by the company.

If you think we have handled your personal data incorrectly, please tell us first so we can put it right. You also have the right to complain to the UK supervisory authority, the Information Commissioner's Office (ICO), at any time — you do not have to come to us first.

ico.org.uk · helpline 0303 123 1113.