Privacy

Privacy Policy

Last updated: 12 October 2026

This notice is intended to explain our processing under the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR), in each case as amended from time to time, including relevant changes introduced by the Data (Use and Access) Act 2025.

1. Who we are

EaseThat Ltd is a company registered in England and Wales under company number 15707366, with registered office at 2 Zubron Grove, Whitehouse, Milton Keynes, United Kingdom, MK8 1EH. For privacy enquiries contact info@easethat.com.

2. Personal information we collect

Depending on how you interact with us, we may collect:

• your name, job title, employer, business email address and telephone number;
• account username, account preferences and account-security information;
• for authorised staff or integration accounts, role/permission information, API/application-password usage metadata such as creation or last-use information, and restricted audit events. WordPress Application Passwords are stored as one-way hashes rather than recoverable plaintext;
• trade-account application information including organisation name, optional VAT number, business-account confirmation, application status and the date/version of the Trade Account Terms accepted;
• billing and delivery names, business addresses and contact details;
• order details, products, services, licence quantities, shipping information and transaction references;
• quote requests, support requests, project requirements and correspondence;
• appointment-booking information submitted through Microsoft Bookings, which may include your name, business email address, telephone number, organisation, selected service, appointment date/time, answers to booking questions, notes, consent/acknowledgement records and booking status;
• questions and short conversation context submitted through the EaseThat AI Assistant, where you choose to use it;
• managed-hosting and technical support information supplied by your organisation;
• IP address, browser/device information, security logs, bot/security-verification signals and information necessary to operate and protect the website;
• where you consent to optional analytics or marketing technologies, information such as page views, referral source, interactions, campaign/conversion data, approximate location derived from IP address, pseudonymous identifiers and related device/browser information;
• supplier and distributor business-contact information, account numbers, agreed credit limits and payment terms, purchase orders, goods-receipt and movement records, supplier invoice details, remittance/payment references and documents such as credit agreements, contracts, price lists or invoices where required to administer procurement and accounts payable;
• payment status and limited payment-related metadata returned by payment providers. EaseThat does not intend to store full payment-card numbers in the WordPress website.

3. Why we use information

We use personal information to operate the website and WooCommerce shop; create and manage accounts; respond to enquiries and quote requests; arrange and manage consultation appointments; take steps towards and perform business contracts; process, deliver and support orders; provide managed services; keep appropriate business, accounting and contractual records; prevent fraud and misuse; secure our systems; manage suppliers; and comply with legal and regulatory obligations.

4. Lawful bases

Depending on the activity, we generally rely on performance of a contract or steps requested before entering a contract, legitimate interests in operating and protecting our business and serving business customers, compliance with legal obligations, and consent where the law specifically requires consent. Where optional analytics or marketing/advertising technologies require consent under PECR or UK data-protection law, we rely on your consent for that activity and you can withdraw or change that choice through Cookie Preferences.

5. WooCommerce accounts, trade applications and orders

WooCommerce processes information needed to provide the shop, cart, checkout, customer account and order-management functions. Account and order records may include business contact details, billing/delivery information, items ordered, order status and related communications.

New trade-account applications are reviewed by an authorised EaseThat administrator before login and online purchasing access is activated. The review may consider the organisation details supplied, business email address, optional VAT information and other information reasonably required to establish that the applicant is acting for a business or organisation. EaseThat does not use solely automated decision-making to approve or reject trade-account applications.

Approval of a trade account is an administrative access decision only. It does not itself create credit terms, guarantee stock, pricing or availability, or mean that any future order must be accepted.

6. Payments

Where enabled, card and wallet payments may be processed by Stripe and PayPal. Those providers process payment and fraud-prevention information under their own privacy arrangements. Bank-transfer (BACS) payments are verified using the information available through our business banking records. EaseThat receives payment status and transaction references required to administer the order.

7. Account and application communications

We may send transactional emails relating to account creation, password setup or reset, trade-account review, approval or rejection, order status, quotations and service administration. These communications are necessary to administer the requested business relationship and are not treated as marketing simply because they are sent by email.

8. Quotes, contact forms and email delivery

EaseThat may research UK companies through public business registers, official tender notices and a company's own website for relevant B2B opportunities. A restricted Team Portal record can include the organisation, company number, publicly listed business contact, role, business email, source URL, date checked and a recorded reason and lawful basis for contact. Company discovery alone does not gather personal email addresses. Staff review corporate subscriber status, relevance, data accuracy and objections before any prospecting email. We use legitimate interests for proportionate B2B prospecting where applicable and honour objections to direct marketing. Where we obtain contact information indirectly, our first email provides this notice and a way to opt out. Sole traders and individual subscribers are not included in the automated campaign workflow.

Outbound campaigns are approved by a separate authorised administrator and sent in controlled batches through the configured email transport. Messages identify EaseThat, include a monitored contact address and an unsubscribe link. An opt-out records a minimal one-way email hash so that future imports and campaigns can honour the request. Campaign records, source information and delivery handoff logs are restricted to authorised Team Portal users; the mailer accepting a message is not confirmation that it reached an inbox. Prospecting records are reviewed for continued relevance and erased or anonymised when no longer needed, subject to the minimal suppression record and any legal or dispute requirements.

Quote requests and general enquiries are processed by the EaseThat WordPress website and delivered using WordPress email functionality through the configured business email transport. The intended production configuration uses Microsoft 365 / Microsoft Graph with OAuth, with a separately configured hosting SMTP fallback during migration and resilience testing. Quote requests are sent to orders@easethat.com and general enquiries to info@easethat.com. Information supplied in those forms is used to assess and respond to the relevant business requirement. Mailbox passwords are not stored in the EaseThat theme.

If an outgoing transactional or notification email cannot be delivered, the website may retain the message temporarily in a restricted recovery queue so authorised administrators can diagnose the failure, retry delivery or clear the record. The recovery record can include recipient, subject, headers, attachment names, message body, retry history and the last delivery error. Message bodies are not copied into the general Activity Log. Failed-mail recovery records are retained only for delivery troubleshooting and are reviewed/cleared when no longer required.

To protect public forms from automated abuse, the website uses signed form-session values, hidden trap fields, field and link limits, and short-lived pseudonymous rate-limit and duplicate-detection records derived with one-way keyed hashes. Contact and quote rate-limit records normally expire after approximately 10 minutes; trade-application rate limits after approximately 30 minutes; duplicate indicators after approximately 15 minutes for enquiries/quotes and six hours for trade applications. These controls do not store the submitted message or raw IP address in their transient keys. Security events may be recorded in the restricted Activity Log without copying the submitted message into the event detail.

9. Supplier procurement, distributors and accounts payable

Where EaseThat buys hardware, software, licences or services from distributors and other suppliers, we may process business-contact details for supplier representatives together with supplier account numbers, agreed credit limits and payment terms, Purchase Orders issued by EaseThat, delivery and goods-receipt records, returns/RMA information, supplier invoice records, payment/remittance references and related correspondence or supporting documents.

We use this information to source and purchase goods or services, manage supplier credit, evidence approvals, track goods movement, reconcile supplier invoices against Purchase Orders and receipts, administer payments, investigate discrepancies, prevent fraud and maintain accounting, tax, contractual and audit records. Depending on the circumstances, our lawful basis is generally performance of a contract or steps connected with a contract, legitimate interests in operating and protecting our B2B procurement and finance processes, and/or compliance with legal obligations.

Supplier invoice, credit-agreement and related documents stored through the Team Portal are held in restricted, authenticated storage and are not intended to be exposed through the public WordPress Media Library. Access is limited to authorised EaseThat team users according to assigned permissions. The website records payment approvals and settlement references for reconciliation purposes but does not initiate bank payments.

Supplier and purchasing records may be shared where necessary with the relevant supplier/distributor, delivery or fulfilment providers, EaseThat's accountants or professional advisers, banking/payment providers, auditors, insurers, regulators or public authorities where required. Supplier business-contact information remains subject to applicable data-protection rights.

10. Appointment bookings and Microsoft Bookings

EaseThat uses Microsoft Bookings, a Microsoft 365 service, to provide self-service appointment scheduling. The Bookings experience may be embedded within the EaseThat website, but the scheduling interface and appointment processing are provided through Microsoft systems.

When you make or amend a booking, Microsoft Bookings may process information such as your name, business email address, telephone number, organisation, selected service, preferred appointment date/time, answers to required or optional booking questions, notes, booking status, the staff member assigned to the appointment and records of confirmations, reminders, cancellations or changes. Where the Bookings custom-consent feature is enabled, the date and time of that acknowledgement may also be recorded.

We use this information to arrange and administer the appointment, prepare for the requested discussion, communicate confirmations or changes, prevent misuse of the booking service and, where appropriate, take steps requested by you before entering into a business contract. Depending on the circumstances, our lawful basis is generally pre-contract steps/contract and/or our legitimate interests in operating an efficient B2B appointment service, protecting that service and responding to genuine business enquiries. A consent statement displayed in Microsoft Bookings is an important transparency and acknowledgement control, but consent is not necessarily the lawful basis for every aspect of appointment administration.

Microsoft states that Bookings customer content is stored in the Exchange Online mailbox that hosts the organisation's Bookings service. Microsoft provides the platform under our Microsoft 365 service arrangements and may process associated technical and security information in accordance with its applicable product, security and privacy documentation. Microsoft Bookings can also send appointment confirmations, reminders, updates and cancellation messages containing booking information.

Please do not enter passwords, credentials, payment-card information, health information, special-category personal data, confidential client data or other sensitive information in booking fields unless EaseThat has specifically asked for it through an appropriate secure process.

Booking records are retained only for as long as reasonably necessary for appointment administration, security, dispute handling, follow-up and applicable business/legal record-keeping purposes. Records that become part of a customer engagement may be retained with the relevant contractual or customer record. Retention within Microsoft 365 is also subject to EaseThat's configured Microsoft 365/Exchange retention and deletion controls. We periodically review retention and do not intend to keep booking information indefinitely solely because the platform permits it.

11. EaseThat AI Assistant

The public website may provide an AI-assisted chatbot to help business visitors identify relevant EaseThat services and next steps. Use of the assistant is optional. Please do not enter passwords, payment-card information, API keys, confidential business information, special-category personal data or other sensitive information.

When you submit a message, the website sends the current question and a limited amount of recent conversation context from that browser session to the EaseThat server. The theme does not intentionally save chatbot transcripts to the WordPress database. The browser keeps a short in-memory conversation history only while the page remains open so the assistant can understand the current exchange.

Before an AI request is made, the server attempts to remove obvious email addresses and UK-format telephone numbers from the submitted text. This is a risk-reduction measure and may not identify every type of personal or confidential information, so you should still avoid entering information that is not needed for a general service enquiry.

When AI is configured, the redacted message and limited recent context are sent server-side to the selected provider: OpenAI, Microsoft Azure OpenAI, Anthropic Claude or Google Gemini. The chat interface identifies the configured provider. If EaseThat enables a separate fallback provider, temporary network failures, rate limits or service outages may cause the same redacted conversation to be sent to that fallback provider; the interface discloses this before messages are submitted. Provider authentication/configuration errors and safety-blocked or empty successful responses are not retried against another provider.

OpenAI and Azure OpenAI requests set store: false to avoid requesting storage for later response retrieval. This setting does not establish zero retention across all providers. Provider-side processing, retention, international transfers and safeguards depend on the applicable service terms and account configuration. EaseThat does not persist transcripts in this theme. Non-content usage counters and connection/fallback status are recorded to manage costs and availability. If AI is unavailable, unconfigured or its usage limit is reached, rules-based guidance is returned locally.

The assistant provides general service guidance only. It does not approve accounts, place orders, make solely automated decisions with legal or similarly significant effects, create contracts, guarantee compliance or commit EaseThat to pricing, scope or delivery.

To protect the public endpoint from abuse, the website creates a short-lived pseudonymous rate-limit key derived from connection and browser information. The rate-limit record is held as a WordPress transient for approximately 10 minutes and is used only to limit excessive chatbot requests.

12. Managed hosting and technical services

If your organisation buys hosting or managed technology services, we may process authorised user/contact information, technical configuration, support records, access information and other data needed to deliver the contracted service. Where EaseThat processes personal data on behalf of a business customer as a processor, appropriate data-processing terms will be agreed as part of the service contract where required.

13. Analytics, website measurement and marketing technologies

If you consent to the Analytics category and EaseThat enables the relevant service, we use Google Analytics 4 and may use Microsoft Clarity on eligible public pages to understand website use and improve usability. These integrations remain disabled until Analytics consent is provided. GA4 excludes Team Portal, Customer/My Account, company-account, cart, checkout, password, quotation, invoice and protected PDF routes; removes query strings from page locations; and disables Google Signals and advertising-personalisation signals. Clarity is used for behavioural/usability analysis and session replay with sensitive input content masked by the service. EaseThat does not intentionally configure these analytics services with customer names, email addresses, company details, user IDs, order contents, quotation numbers, Purchase Order contents or invoice identifiers.

Where Analytics consent is granted, EaseThat may record consent-controlled conversion events for a successfully submitted website enquiry and for entry into the Book a Consultation journey. A completed Microsoft Bookings appointment is not inferred from the cross-origin booking iframe unless a separate Microsoft-side confirmation integration is introduced. Other optional services supplied by providers such as Meta, LinkedIn or Hotjar are not enabled by this theme and must not be activated unless they are first documented and connected to the relevant consent category.

Where session-replay, heatmap or interaction-analysis services are used, we will configure them to minimise unnecessary collection and to avoid intentionally capturing passwords, full payment-card details or sensitive information entered into website forms.

14. Editorial publishing, REST APIs and integration accounts

EaseThat may use external editorial or automation services, such as content-publishing tools, to prepare or transmit website articles through the WordPress REST API. These integrations use dedicated low-privilege WordPress accounts and revocable Application Passwords over HTTPS. External publishing is restricted to draft Insights and required media operations; a human EaseThat reviewer publishes the final article.

WordPress stores Application Passwords using one-way hashing and does not make the original password recoverable after creation. EaseThat may retain restricted operational metadata such as the integration username, role, credential name, creation/last-use information, source IP metadata supplied by WordPress and audit events. External editorial services are not intentionally given customer account, order, quotation, supplier, support or failed-email content through this publishing route.

Editorial content itself is intended for publication. If an external publishing provider is later configured to receive additional personal data, EaseThat will review the supplier, lawful basis, contractual safeguards, retention and this privacy notice before that processing is introduced.

15. Who we may share information with

Information may be shared where necessary with payment providers, hosting providers, email/communications providers, AI service providers selected for the AI Assistant (OpenAI, Microsoft Azure OpenAI, Anthropic Claude or Google Gemini) when you use it, analytics and marketing technology providers where you have consented, distributors and fulfilment partners, couriers, software/licensing vendors, security/IT suppliers, editorial/publishing service providers where used to prepare public website content, accountants, insurers, professional advisers, regulators and other providers involved in delivering or administering the requested business service. We do not sell personal information.

16. International transfers

Some technology, AI and payment providers may process information outside the UK. Where UK data-protection law requires safeguards for a restricted transfer, we will use an appropriate lawful transfer mechanism or rely on a provider that does so.

17. Retention

We retain information only for as long as required for the relevant purpose. Order, contractual, accounting and tax-related records may normally be retained for up to six years after the relevant transaction or relationship, or longer where law, a dispute, warranty or regulatory requirement requires it.

Supplier Purchase Orders, goods-receipt and movement records, supplier invoices, credit notes, payment/remittance evidence and supporting accounting documents are treated as business and financial records. EaseThat normally retains these records for at least the period needed to meet company, tax and VAT record-keeping obligations, which will commonly be six years, and longer where a transaction spans accounting periods, an asset has a longer useful life, a dispute or warranty remains open, or a regulator or tax authority requires continued retention.

Approved trade-account information is retained while the account is active and afterwards where reasonably required for contractual, security, fraud-prevention, accounting or legal purposes. Pending, rejected or withdrawn applications are periodically reviewed and, where there is no continuing business, legal or security need, are normally deleted or anonymised within 12 months of the final decision or withdrawal. We may retain a minimal suppression/audit record where reasonably necessary to protect the service or demonstrate how an application was handled.

Chatbot conversation text is not intentionally stored as a transcript by the EaseThat theme. Recent conversation context is held in browser memory for the current page session. The pseudonymous chatbot rate-limit transient expires after approximately 10 minutes. Separate infrastructure or security logs may be retained for the periods needed to operate and protect the website.

Failed outgoing email records may remain in the restricted mail-recovery queue until delivery succeeds or an authorised administrator has reviewed and cleared the record. Integration/audit metadata for dedicated publishing accounts is retained only for as long as reasonably necessary for security, accountability and troubleshooting.

18. Security

We use proportionate technical and organisational measures intended to protect personal information. No internet service can be guaranteed completely secure, and business customers are also responsible for protecting their account credentials and authorised-user access.

Secret credentials stored by EaseThat are protected according to their purpose: recoverable API tokens/keys are encrypted at rest where the application must use them later; verification-only WordPress Application Passwords are one-way hashed by WordPress; and high-value secrets may be kept outside the database in server configuration. Public identifiers such as analytics Measurement/Project IDs or OAuth Application/Client IDs are not passwords and do not become secret merely because they identify an integration.

Where enabled, we use Cloudflare Turnstile as a necessary website-security measure on selected login, password-reset, trade-registration and enquiry forms. Turnstile may process limited technical, browser/device, network and challenge-response information to help distinguish legitimate users from automated abuse. This processing is used for security and fraud/abuse prevention rather than optional analytics or advertising. Cloudflare may process this information under its own service and privacy terms, including through infrastructure outside the UK where applicable safeguards are required.

19. Your rights

Individuals may have rights under UK data-protection law including access, correction, erasure, restriction, portability and objection, depending on the circumstances and lawful basis. Where processing relies on consent, consent can be withdrawn.

20. Complaints

Please contact info@easethat.com first if you have a privacy concern. Individuals may also complain to the UK Information Commissioner's Office (ICO).

21. Changes

We will review this notice when our services, suppliers, payment methods, website functionality or legal requirements change.

Ongoing review: This notice is reviewed when EaseThat changes material suppliers, payment methods, hosting, analytics, AI, booking, account, security or retention practices. Operational configuration must remain consistent with the disclosures above.