Privacy Notice
Plain-English detail on what we collect through this website, why we collect it, how long we keep it, and the control you have over it.
Last updated: 24 September 2026 · Version 1.0
Who we are
TrishulHub (“we”, “us”, “TrishulHub”) is the data controller for the personal data described in this notice. Our website is trishulhub.com, and we are based in the United Kingdom.
Privacy questions, requests and complaints: info@trishulhub.in
We are not required to appoint a Data Protection Officer. If you are unsure who to contact, use the email address above and your message will reach the people responsible.
What we collect
Enquiries. When you use the contact form or the project planner, we collect what you type: your name, email address, the service you are interested in, optional company name, budget range and phone number, and your message or planner answers. Please do not send us special category data (for example health, religious or biometric information) through these forms.
Technical information. Our hosting provider records standard information such as IP address, browser and device type, the pages requested and timestamps, as part of serving the site securely and reliably.
Clients and suppliers. Once an enquiry becomes a project, we process contact details, project information, correspondence and invoices in the normal course of doing business together.
Why we use it, and our lawful basis
We always need a lawful basis under the UK GDPR. These are the purposes we process data for:
| Purpose | Data used | Lawful basis | Kept for |
|---|---|---|---|
| Replying to an enquiry you send us | Name, email, company, service of interest, budget range, message, and any phone number you add | Legitimate interests (Art. 6(1)(f)) — responding to a business enquiry you started. Where you go on to become a client, performance of a contract (Art. 6(1)(b)) | 24 months after the last contact |
| Keeping a record of what we discussed | The enquiry and the notes and correspondence that followed | Legitimate interests — continuity and quality of service | 24 months after the last contact |
| Running and securing the website | IP address, browser and device type, requested pages, timestamps, error logs | Legitimate interests (Art. 6(1)(f)) — keeping the site available, fast and secure. Consent is not needed for the security and preference storage described in our cookie policy | Short-lived provider logs (typically up to 30 days) |
| Managing a project or contract with you | Contact details, project brief, correspondence, invoices and payment records | Performance of a contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) for tax and accounting records | 6 years after the end of the financial year (UK tax requirement) |
| Direct marketing to people who enquired or bought from us | Name, business email address, and what you asked about | Legitimate interests / soft opt-in (PECR reg 22) — only where you have not objected, with an unsubscribe in every message | Until you object or unsubscribe |
Where we rely on legitimate interests, we have balanced our interest (answering people who asked us a question, keeping the site secure, and running our business) against your rights and expectations. An enquiry you chose to send us does not come as a surprise to you, we use it for that purpose and no other, and you can object at any time.
Who we share it with
We never sell your data, and we do not use it for advertising, profiling or automated decision-making. We share it only with the service providers that make the site and our email work, plus professional advisers where necessary (for example our accountant, under a duty of confidence):
Vercel Inc.
Website hosting, edge network and CDN · United States, with regional edge locations
Turso (ChiselStrike, Inc.)
Encrypted database holding enquiry records · AWS eu-west-1 (Ireland, EEA)
Our email service provider
Sending and receiving enquiry and account emails over SMTP · Depends on the mailbox provider in use
We may also disclose data where the law requires it (for example to HMRC, a court, or the ICO), or to establish or defend legal claims.
Transfers outside the UK
Enquiry records are held in an encrypted database hosted in the EEA (AWS eu-west-1, Ireland). Some providers we use are based in the United States, so data may be transferred there for hosting and email delivery.
Where personal data leaves the UK, we rely on the UK International Data Transfer Agreement (IDTA), the International Data Transfer Addendum to the EU Standard Contractual Clauses, or a provider holding an adequate certification — together with an assessment of the risks involved. You can ask us for details of the safeguards we rely on.
How long we keep it
The retention periods for each purpose are in the table above: enquiry records are kept while the conversation is active and for up to 24 months afterwards, so we can pick up previous context if you return. Contract and financial records are kept for six years, as UK tax law requires. You can ask us to delete enquiry data sooner.
How we protect it
Everything is served over HTTPS. Sign-in credentials for our own team are stored as salted hashes rather than plain text, sessions use HTTP-only same-site cookies, access to enquiry records is limited to the directors who need it, and we do not put secrets in the browser bundle. If a breach ever put your rights at risk, we would notify you and the ICO without undue delay.
Children
This site is aimed at businesses and is not intended for children. We do not knowingly collect data from anyone under 13, and we do not use personal data for targeted advertising to children.
Your rights
Under the UK GDPR you have the right to:
- Be informed about how we use your data — this notice does that.
- Get a copy of the personal data we hold about you (a subject access request).
- Have inaccurate or incomplete data corrected.
- Have your data erased where there is no good reason for us to keep it.
- Restrict how we use your data, or object to processing based on legitimate interests.
- Receive your data in a portable, machine-readable format, or have it sent to another provider.
- Withdraw consent at any time, where we rely on consent (for example cookie choices).
- Not be subject to a decision made solely by automated means that has a legal or similarly significant effect on you.
To exercise any of these, email info@trishulhub.in. We respond within one month, and it is free. We may ask you to confirm your identity so we do not disclose data to the wrong person.
Cookies and device storage
This website sets no advertising or tracking cookies, no analytics, and no third-party cookies. It stores your light/dark display preference and your enquiry draft, which the law treats as device storage rather than cookies. Every item is listed, with its purpose and duration, in the cookie & storage policy, where you can also change or withdraw your choice.
Do you have to give us your data?
No. Providing personal data through this website is entirely voluntary — it is not a statutory or contractual requirement. If you choose not to give us the details the form asks for, we will not be able to reply to your enquiry or prepare a plan for you. Once you become a client, we will need some information to deliver the work and to meet our legal record-keeping duties.
How to complain
If something about the way we have handled your information concerns you, please tell us first — email info@trishulhub.in with “Data protection complaint” in the subject line. We will acknowledge it, investigate, and respond within 30 days, and we will tell you what we found and what we are changing.
You can complain to the Information Commissioner’s Office at any time, including before contacting us: ico.org.uk/make-a-complaint, 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
Changes to this notice
If we change what we do with personal data, we will update this notice and the version number above, and — where the change is significant — tell active clients directly.