How information is handled
Enquiries before financial records
Waloos is controller for its own company website and correspondence. An initial request about bookkeeping or software should describe the need without attaching receipts, payroll records or bank information. The registered identity below provides the postal route for business and privacy enquiries.
Web delivery and supplied details
Cloudflare receives technical connection information to serve this site, which can include an IP address, page requested, access time and browser details. A correspondent separately supplies a name, reply details and a description. No advertising technology or added analytics code is included in the published pages.
Lawful bases and purposes
Responding to relevant approaches and protecting the corporate site are legitimate interests assessed under Article 6(1)(f). A person’s request for precontractual steps can rely on Article 6(1)(b), and legally required records on Article 6(1)(c). A bookkeeping file should not be collected without identifying the purpose, responsibility and appropriate route for it.
Handling commissioned records
The data role of a bookkeeping or software engagement is determined from the actual work. If Waloos is a processor, instructions and a processing agreement need to specify the records, access, security and permitted providers. A contract should also settle what happens to supplied records at completion. The website notice alone is not that contract.
Retention and transfer decisions
Retention must distinguish an ordinary enquiry from project records and legally necessary accounting material. Each is kept only for the corresponding purpose and applicable requirement, followed by deletion or anonymisation when justified retention ends. International transfers through global infrastructure need applicable adequacy arrangements or approved contractual protections.
Exercising rights
Requests for access, correction, restriction and deletion of data can be posted to Waloos’s registered office. Include enough context to locate the exchange; unnecessary financial documents should not be added. Objection and portability are available where their conditions apply. Reasonable identity verification may be requested, and a response is normally due within one month.
A problem with information
A suspected data breach should be reported to the company promptly. Assessment determines containment and any notification to people or the ICO, including the applicable 72-hour regulator deadline. The ICO accepts privacy complaints independently. The company website is intended for professional enquiries and is not designed to collect children’s information.