1. Who we are
Custodiance is a trading name of TicketWave HQ Ltd, a company registered in England and Wales, company number 17143167, registered office Radley House, Richardshaw Road, Pudsey, LS28 6LE. TicketWave HQ Ltd is the data controller for the personal data described in this notice. For anything about your data, email hello@custodiance.com.
This notice covers this website and anything you send us. If we run your practice's web and email estate, we handle the personal data in that estate on your practice's behalf, as its processor, under our data processing agreement, which we also sign with the practice. That processing is governed by the agreement, not by this notice, and the providers it involves are listed at /sub-processors.
2. What we collect, and why
| Data | When and why | Lawful basis |
|---|---|---|
| Your name, your firm or practice, your email address, and what you write to us | When you email us. The form on our contact page does not send anything to this website: it is set up to open a message in your own email program, which you then send. We use what you send to reply, to arrange a scoping call and to scope an engagement. | Steps you ask us to take before entering a contract; our legitimate interest in answering enquiries |
| Records of an engagement: correspondence, the agreed scope, quotes, invoices and payments | If you engage us, to deliver the work and to keep the accounting records the law requires. We invoice by email and take no card payments. Quotes, invoices and your client record are kept in our own business system, on hardware rented from OVHcloud in Gravelines, France, with encrypted backups held by Scaleway in Paris. | Performance of our contract; legal obligation (tax and accounting) |
| Technical data: your IP address, your browser's user agent, the page requested and the time | Recorded in our hosting provider's request logs whenever your browser asks this website for a page, so the page can be delivered, the site kept secure and faults diagnosed. We do not use it to identify or profile you. | Our legitimate interest in a secure, working website |
We do not need client, patient or pupil data to answer an enquiry, so please leave it out and describe your situation in general terms; we will go into the detail on a call. We do not sell personal data, and we make no automated decisions about you.
3. Cookies and tracking
This website sets no cookies and runs no analytics, advertising or tracking code. Its fonts are served from this website, and its pages load nothing from other websites. The links in our briefings to regulators and other sources are ordinary links: nothing is sent to those sites unless you follow one.
4. Who handles your data
We share personal data only with the providers that run this website, our email and our business records, and only as far as they need it:
- Hosting: Vercel Inc., a US company. This website's server-side code runs in Vercel's London region, and pages are delivered through Vercel's network, normally from the location nearest you. Vercel keeps the request logs described in section 2.
- Email: Proton AG, in Switzerland, hosts the mailbox
that receives mail sent to
@custodiance.com, and sends our replies. Our quotes and invoices are also sent through Proton, frombilling@ticketwavehq.com. - Business records: OVHcloud (OVH Limited), on hardware in Gravelines, France, runs the business system that holds our quotes, invoices and client records. Its backups are encrypted before they are stored with Scaleway SAS in Paris.
- Our professional advisers, such as our accountant, and regulators or law enforcement where the law requires it.
Our domain name's DNS is hosted by Cloudflare, Inc., a US company. Cloudflare answers lookups for the domain name only: your visits to this website and your emails to us do not pass through it. The source code of this website is kept on GitHub, a US company; it contains no personal data.
5. Transfers outside the UK
Switzerland, where Proton holds our mailbox, is recognised under UK law as giving adequate protection to personal data. France, where OVHcloud and Scaleway hold our business records, is in the EU, which the UK's adequacy regulations also cover. Vercel is a US company: this website's server-side code runs in London, but Vercel can be subject to US law wherever the data is held, and may process request data outside the UK. Vercel's data processing addendum covers transfers from the UK with the UK International Data Transfer Addendum and the EU Standard Contractual Clauses.
6. How long we keep it
- Enquiries that do not lead to an engagement: 12 months from the enquiry, then deleted.
- Engagement records, including correspondence, quotes, invoices and payments: for the life of the engagement and 6 years after it ends, for disputes and for the tax and accounting records the law requires.
- Request logs: Vercel keeps them for up to 30 days.
- If you exercise one of your rights: your request and our reply, for 12 months after we close it, or 6 years if it becomes a complaint or a claim.
After that we delete the data or make it anonymous.
7. Your rights
Under UK data protection law you have the right to: access a copy of your data; have inaccurate data corrected; have data erased in some circumstances; restrict or object to our use of it, including where we rely on legitimate interests; and data portability. To exercise any of these, email hello@custodiance.com. We will reply within one month.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk (opens in a new tab) or on 0303 123 1113. We would appreciate the chance to put it right first, but you do not have to come to us before you go to the ICO.
8. Keeping data safe
Connections to this website are encrypted (HTTPS), and access to our mailbox, our hosting account and our business system is limited to the people who need it. No system is completely secure. If a personal data breach is likely to put you at high risk, we will tell you without undue delay, and we report breaches to the ICO where the law requires it.
9. Changes to this notice
We update this notice when what we do changes. The version and date are at the top, and every change is listed below.
10. Changelog
- v1.1, 15 October 2026: section 1 now links to the published data processing agreement and sub-processor list that govern processor work; neither existed when v1.0 was written. The records of an engagement are kept in our business system on OVHcloud hardware in France, backed up encrypted to Scaleway in Paris, and quotes and invoices are emailed from a Proton mailbox (sections 2, 4, 5 and 8). The source code of this website is kept on GitHub, a US company (section 4).
- v1.0, 12 October 2026: first publication.