Legal

Privacy Policy

Every clause here is set out the way the work is: what has to be true for it to apply, what happens in order, and what the result has to be. If the result is ever not what this page says it is, that is a defect in the company and it should be raised as one.

Who this is

Testiform LTD 167-169 Great Portland Street, London, England, W1W 5PF b2b@testiform.com

Edition

This is the edition of 16 September 2026. The edition current on the day an order is confirmed is the one that governs that order; a later edition does not reach back over it. Changes are published here, and anyone with an order in progress is told about a change that affects it.

PP-01

Who decides what happens to your data

Personal data reaches this company by any route at all - an email you have written, a request the form on this site has put into your email application, or the ordinary record a web server keeps of a page being fetched.

Steps

01 The data arrives at Testiform LTD, at the address given below.

02 Testiform LTD decides why it is held and what is done with it.

03 No other organisation makes that decision on its behalf.

Expected result

Testiform LTD is the controller of that data for the purposes of the UK General Data Protection Regulation and the Data Protection Act 2018. Its details are:

Company: Testiform LTD
Address: 167-169 Great Portland Street, London, England, W1W 5PF
Email: b2b@testiform.com

There is no separate data protection officer. The address above reaches the person who answers on the company’s behalf.

PP-02

What is collected, and where it comes from

You use this website, write to the company, or become a customer of it.

Steps

01 The request form on the Contact page assembles text inside your own browser. This site does not transmit it: it is handed to your email application, and it travels only when you press send there.

02 When an email arrives, the company receives what is in it - your name, your address, the website you are asking about and anything else you have chosen to write.

03 The server that hosts this site records each request for a page in its log: the address it came from, the time, the page and the browser string. That is how a web server works, and it happens whether or not you write to anybody.

04 If you place an order, the company holds what is needed to carry it out: the environment address, the contact for the work, test account details supplied for the pass, and the correspondence about it.

Expected result

Those four are the whole of it. This site runs no analytics, carries no advertising tags, no social buttons and no third-party scripts, and it does not buy, rent or enrich data about anybody from anywhere else.

PP-03

Cookies and anything else stored in your browser

You open any page on this website.

Steps

01 The page, its stylesheet and its fonts are fetched from this site. The fonts are served from here, not from a font network.

02 No cookie is set, by this site or by anybody else through it.

03 Nothing is written to local storage, to session storage or to a database in the browser.

Expected result

That is why there is no cookie banner on this site. The rule that requires consent, regulation 6 of the Privacy and Electronic Communications Regulations, bites when something is stored on your device or read back off it, and here nothing is.

If that ever changes, this page changes first, and the request for consent appears before anything is stored rather than after.

PP-04

Why it is held, and what in law allows that

Data has arrived by one of the routes in PP-02.

Steps

01 An enquiry is read and answered, and a scope and a quote are prepared from it.

02 Where an order follows, the work is carried out and the two sides keep in touch about it.

03 The invoice and the record of payment go into the accounting records.

04 The server log is kept so that the site can be kept running and so that abuse of it can be traced.

Expected result

Answering an enquiry: Article 6(1)(b): steps taken at your request before entering into a contract. Where you write on behalf of an organisation rather than yourself, Article 6(1)(f), the legitimate interest being to answer a business enquiry that was addressed to us.
Carrying out an order: Article 6(1)(b): performance of the contract you have entered into.
Accounting records: Article 6(1)(c): a legal obligation to keep records of what was invoiced and paid.
Server logs: Article 6(1)(f), the legitimate interest being to keep this website available and to work out what happened when it is attacked or breaks.

None of this is used to market anything to you. There is no mailing list on this site and nobody is added to one.

PP-05

Who else sees it

Data is held under PP-04, and running the company requires suppliers.

Steps

01 The hosting provider holds the site and its server logs.

02 The email provider holds the correspondence.

03 A payment provider handles the payment itself, and sees what it needs to take one.

04 An accountant sees the invoices and the payment records.

Expected result

Those four are categories rather than names, because the suppliers are being appointed. Once each one is in place it is named here, by name, and this page is republished. Naming them is the only honest way to make a list of recipients useful.

Nothing is sold, rented, shared for advertising, or handed to anybody else except where the law requires it or where it is needed to bring or defend a legal claim.

PP-06

Whether anything leaves the United Kingdom

A supplier under PP-05 processes data on the company’s behalf.

Steps

01 The company does not itself send personal data outside the United Kingdom for any purpose of its own.

02 Where a supplier stores or processes data outside the United Kingdom, that is checked before the supplier is used.

03 The transfer then rests either on the adequacy regulations made under the Data Protection Act 2018, or on an International Data Transfer Agreement or the Addendum to the European Commission standard contractual clauses.

Expected result

When the suppliers are named under PP-05, where each one processes and which of those two bases applies is named with it. Until then, no claim is made in either direction, because a claim that the answer is already settled would not be true.

PP-07

How long it is kept

Data has been collected under PP-02 and used under PP-04.

Steps

01 An enquiry that does not become an order is kept for twelve months and then deleted.

02 The file of an order - the scope, the correspondence, the report, the case list and the recordings - is kept for six years after the contract ends.

03 The accounting records are kept for six years from the end of the accounting period they fall in.

04 Test account details supplied for a pass are deleted as soon as the pass is finished, and in any event within seven days of the report going out.

05 The server log is kept for thirty days and then overwritten.

Expected result

The six-year periods are not a matter of preference: the first follows from the Limitation Act 1980 section 5, which is how long a claim on a contract can be brought, and the second from what tax record-keeping requires. The twelve months, the seven days and the thirty days are the company’s own decision and can be shortened on request for your own data.

PP-08

Personal data met while testing somebody else’s website

A pass is being run and the environment contains records about real people - because the customer has supplied a copy of live data, or because only the live site exists.

Steps

01 The company asks for test data first, and for accounts created for the testing, precisely so that this does not arise.

02 Where real records cannot be avoided, the customer stays the controller of them and the company acts on the customer’s written instructions only.

03 A written processing agreement under Article 28 is put in place before the pass begins.

04 Nothing is copied out of the environment except what a finding needs, and a recording is trimmed or a value obscured where a real person would otherwise be identifiable in it.

05 Whatever was held for the pass is deleted when it ends.

Expected result

This company does not want other people’s customer records and does not need them to do its work. The rule in PP-07 about test accounts applies to this material too.

PP-09

What you can ask for

The company holds personal data about you.

Steps

01 You ask, by email to the address in PP-01. There is no form to fill in and no fee.

02 Your identity is confirmed where there is any doubt about it.

03 The request is answered within one month. Where a request is complicated or where several have been made, that can be extended by up to two further months, and you are told inside the first month if it is.

Expected result

You may ask for any of the following:

a copy of the personal data held about you, and the information on this page;
correction of anything inaccurate, and completion of anything incomplete;
erasure, where there is no longer a reason to hold it;
restriction of what is done with it while a dispute about it is resolved;
an objection to processing carried out on the legitimate-interest basis named in PP-04;
a copy of the data you supplied, in a machine-readable form, or its transfer to somebody else, where the processing rests on a contract or on consent;
withdrawal of consent, in the case of any processing that ever comes to rest on consent. None of the processing described in PP-04 does.

Some of these have conditions attached by the legislation. Where a request cannot be met in full, the answer says which part cannot and why.

PP-10

Whether you have to give anything at all

You want a quote, or you have placed an order.

Steps

01 You decide what to write. Nothing on this site is compulsory and nothing is collected without you typing it.

02 Without a way to reply, an enquiry cannot be answered.

03 Without the address of the website and something to test against, a scope cannot be written and an order cannot be carried out.

Expected result

There is no statutory or contractual obligation to give any of it. The consequence of not giving it is the practical one above and nothing more: no account is closed, no service is withdrawn and no record is kept of having asked.

PP-11

Decisions made by a machine

Any of the processing described on this page is taking place.

Steps

01 A person reads each enquiry and each request.

02 A person writes each scope, each quote and each report entry.

03 No score, rating or category is attached to anybody by software.

Expected result

There is no automated decision-making producing legal or similarly significant effects, and no profiling, within the meaning of Article 22. If that ever changes, this page says so before it starts, and the safeguards in Article 22 apply to it.

PP-12

Complaining about how your data has been handled

You think this page has not been followed, or that your data has been handled wrongly.

Steps

01 Write to the address in PP-01. Saying what you think went wrong and when is enough; there is no form.

02 The complaint is answered in writing, and where something has gone wrong the answer says what has been done about it.

03 If the answer does not satisfy you, you may complain to the Information Commissioner. You can do that whether or not you have written to the company first.

Expected result

Regulator: Information Commissioner’s Office
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Website: ico.org.uk

Complaining to the Commissioner does not stop you from taking the matter to court, and it costs nothing.

PP-13

Changes to this page

Something described on this page changes - a supplier is appointed, a retention period moves, a new kind of data starts being collected.

Steps

01 This page is rewritten and the edition date at the head of it is changed.

02 Where an order is in progress and the change affects it, the customer is told directly rather than left to notice.

03 The edition in force when an order is confirmed continues to govern that order.

Expected result

No change is applied retrospectively to data already collected in a way that would widen what it is used for, without asking first.