Privacy policy

Effective 27 September 2026

Who is responsible

Holland & Johnston Ltd is the controller responsible for personal information used in this portal. This notice covers staff, contractors, customers and other people whose information appears in portal records.

Information we use and where it comes from

• Account names, email addresses, contact details, roles and sign-in information.
• Customer contacts, billing and site addresses, jobs, assignments, schedules, contract tasks, forms, documents, photographs and commissioning records.
• Training progress, internal notices, comments and activity records.
• Technical connection and service information processed by our hosting and communication providers.

Information is supplied by you, authorised colleagues and customers, and configured form connections. Required account and job information enables us to provide access and organise the associated work; without it we may be unable to provide those functions.

Why we use information

We use information to coordinate and document work, communicate with staff and customers, administer training and access, protect records and investigate errors or misuse. Our legitimate interests are operating the business, delivering and evidencing work, and maintaining a secure, accountable service.

Where necessary to take requested steps before a contract or perform a contract with you, we rely on contractual necessity. Where records must be kept to meet applicable tax, accounting or other statutory requirements, we rely on the relevant legal obligation. These grounds depend on the record and purpose; staff use of the portal is not treated as blanket consent.

Who can receive information

Authorised staff and contractors access information according to their roles and permissions. The portal uses OpenAI Sites hosting with Cloudflare-backed database and file storage, Resend for email notifications, and Jotform where form connections are configured. Information included in a notification is processed by the email provider and received by its intended recipients.

Records may also be disclosed where necessary to comply with law or deal with a specific insurance matter or legal claim. Links to separate services lead to those services’ own privacy notices.

International processing

Our providers operate internationally, so processing may take place outside the UK. Hosting this portal does not mean that all information stays in the UK. The applicable locations and transfer arrangements depend on the provider and the service terms. Contact us for information about the arrangements applicable to your data and copies of applicable safeguards.

Provider information is available from OpenAI Sites, Cloudflare, Resend and Jotform. Those notices do not replace our responsibility for the portal’s use of information.

QuickBooks

QuickBooks access begins only after a Super Admin authorises a company connection. Administrators can then read customer names and contact details, estimates and invoices, including line descriptions, dates, amounts, currencies, tax codes and outstanding balances. Product and tax settings are read to prepare new transactions. Creating records or saving supported edits sends those changes to Intuit QuickBooks Online for the connected company. The portal does not email invoices or collect card payments through this integration.

QuickBooks records are requested when you open or refresh the accounting area; they are not automatically copied into the portal’s job/customer tables. Connection tokens are encrypted in the portal database. A minimal save history retains the initiating staff identifier, company, record type, returned record identifier, request identifier, time and a fingerprint of the submitted data for retry protection and accountability. Financial record contents are not stored in that save history.

A Super Admin can disconnect through the QuickBooks area, revoking access and removing the stored connection tokens after Intuit confirms revocation. This does not delete records in QuickBooks or the portal’s save history. Save history is included in our annual retention review. QuickBooks data processing is also described in Intuit’s privacy statement.

Customer accounts and Stripe subscriptions

Invited customer contacts can access their linked customer’s job summaries and reminders, documents expressly shared by an administrator, and estimates and invoices from the matching QuickBooks customer where a connection is configured. We store customer account details, hashed invitation tokens and passwords, access status and the links used to limit access to the correct records.

For online subscriptions, we send the customer name, email address, internal customer identifier and selected plan to Stripe to create hosted checkout. Stripe collects card details directly; the portal does not receive or store full card numbers or security codes. We retain Stripe customer, checkout and subscription identifiers, plan details, status and billing dates to administer the service, reconcile payments and handle support. Stripe sends signed subscription updates to the portal. See Stripe’s privacy policy for its processing.

Customer access and subscription records are reviewed under the retention criteria below: accounting records where required, service records while needed to fulfil or evidence a maintenance commitment, and account details only while needed for access, support or a documented obligation.

Cookies and security

The portal uses the essential hj_staff_session cookie to keep authorised users signed in, with a maximum lifetime of 30 days. Customer sign-in uses the essential __Host-hj_client cookie, lasting up to seven days. Signing out ends the relevant session. Blocking this cookie prevents authenticated use. A separate secure connection cookie, __Host-hj_qb_state, lasts up to ten minutes while you authorise QuickBooks and is cleared when you return. Hosting and external services may also process technical information under their own notices.

Passwords are stored as salted hashes, and access is checked on the server. Protect your account and report suspected unauthorised access promptly. Security measures reduce risk but cannot guarantee absolute security.

How long we keep information

We keep personal information only while needed for its purpose or an identified legal requirement. We use these criteria:

• Company accounting records: normally six years from the end of the last company financial year to which they relate, or longer where required by applicable obligations or an unresolved HMRC enquiry.
• Customer, job and contract records, certificates and necessary photographs: during active work and afterwards where needed for a documented warranty, maintenance commitment, certification requirement, insurance matter or legal claim. The applicable requirement is assessed for the particular job.
• Staff and contractor records: access ends when no longer authorised. Information needed to attribute work, training or safety records is kept with those records where justified; obsolete contact details are removed when no longer required.
• Unsuccessful enquiries, routine messages and duplicate uploads: removed or anonymised when follow-up ends and they no longer support a job, complaint, accounting obligation or another documented need.
• Security and activity records: kept for the period needed to investigate incidents, resolve disputes and account for relevant work. Information tied to an investigation may be held until it is resolved.

Tom Dobson is responsible for reviewing retained portal records at least annually and arranging appropriate removal or anonymisation. You can request a review between these checks. Archiving a job or suspending an account does not delete its records. Removal is managed rather than triggered by an automatic retention schedule; supplier backup arrangements may affect when residual copies are removed.

Your rights

Depending on the circumstances and lawful basis, you may request access, correction, deletion, restriction or portability of information, or object to its use, including use based on legitimate interests. Where we rely on consent for a particular activity, you can withdraw it without affecting earlier lawful processing.

Send requests to info@holland-johnston.co.uk. Reasonable identity checks may be necessary. We will explain any applicable limitation or reason a record must be retained. You can also complain to the Information Commissioner’s Office.

Updates

We display the effective date above and will communicate material changes in how we use information appropriately.