Privacy Policy

Effective Date: 14th September 2026

1. Who we are

Patching Company Ltd is the controller responsible for the personal information described in this Privacy Policy. In this Privacy Policy, “Patching”, “we”, “us” and “our” refer to Patching Company Ltd. We are registered in England and Wales under company number 12544404, with our registered office at School Master's House, 39 College Street, Petersfield, England, GU31 4AG. You can contact us about privacy matters at [email protected].

2. Scope of this Privacy Policy

This Privacy Policy explains how we collect, use, share and protect personal information when you visit our website at patching.co, contact us, submit forms, subscribe to communications, attend calls or meetings with us, or otherwise interact with Patching.

3. Information we collect

3.1 Information you provide to us

We may collect information that you choose to provide to us, including:

• your name, email address, telephone number and other contact details;
• your company name, job title and business contact details;
• information you provide through website forms, enquiries, surveys, emails, calls, meetings or other communications;
• information relating to prospective, current or former client relationships, including service requirements, commercial discussions, contracts and support requests.

We may collect information from Microsoft Teams video or audio calls where all parties on the call have explicitly agreed to recording. If a call is recorded, the recording may include audio, video, transcripts, summaries, participant details, spoken content, timestamps and associated metadata. Recordings are stored in OneDrive and may be processed by Microsoft Copilot or related Microsoft 365 services to support note-taking, summaries, follow-up actions and service delivery. We will not record calls without explicit opt-in agreement from all parties on the call, and you may decline recording without affecting your ability to speak with us.

3.2 Technical, usage and device information

When you use our website or interact with our online services, we may collect technical, usage and device information. Some of this information may be personal information where it identifies, relates to, or can reasonably be linked with an individual or device.

• IP address, browser type, device information, operating system, pages viewed, referring website and browsing behaviour;
• cookies, tracking identifiers, analytics data, marketing interaction data and related information collected through tools including HubSpot and other website service providers;
• technical and security-related signals, such as browser and device signals, user-agent information and challenge outcomes, where used to distinguish genuine visitors from automated traffic and protect our website and forms from spam or abuse.

4. Where we obtain information from

We usually collect personal information directly from you. We may also receive information from client organisations, professional contacts, referrals, publicly available business sources, event organisers, suppliers, service providers, and tools used to operate our website, communications and business systems.

5. How we use your information and our lawful bases

We use personal information for the following purposes and lawful bases:

• Responding to enquiries and developing client relationships — legitimate interests.
• Providing services and managing client or supplier relationships — contract and legitimate interests.
• Managing billing, accounting, tax, legal, regulatory and dispute-resolution matters — legal obligation and legitimate interests.
• Operating, securing and improving our website and business systems — legitimate interests and, where required for non-essential cookies or similar technologies, consent.
• Sending permitted business communications — legitimate interests, with an option to unsubscribe or object.
• Recording and following up on calls or meetings — consent where recording is optional, and contract or legitimate interests where processing is needed for service delivery or business administration.

Where we rely on legitimate interests, these are our interests in operating, protecting and developing our business, providing services, managing relationships, maintaining records and enforcing or defending legal rights. Where consent is required, you may withdraw it at any time.

6. Cookies and similar technologies

Our website currently uses HubSpot cookies and similar technologies to support form handling, website analytics, visitor engagement and relevant business follow-up. These non-essential technologies are only deployed after you have accepted them through our cookie banner.

We also use Cloudflare Turnstile to help protect our website forms from spam and abuse. Turnstile may process technical and security-related information, such as browser, device and interaction signals, to distinguish genuine visitors from automated traffic. We do not use Cloudflare Turnstile for marketing tracking.

You can accept or reject non-essential cookies using our cookie banner. Your choice is respected for the rest of your browsing session. We do not currently provide a separate on-site cookie preference centre, but you can manage or block cookies using your browser settings. We will update this Privacy Policy if the cookies or similar technologies we use materially change.

7. Who we share information with

We may share personal information with service providers and other recipients where necessary for the purposes described in this Privacy Policy. This may include:

• productivity, communications, collaboration, storage, AI, automation, agent runtime, security and cloud services within our Microsoft tenant — including Microsoft 365, Teams, OneDrive, Copilot, Azure and Microsoft Foundry;
• CRM, marketing automation and form providers, including HubSpot;
• website performance, security and anti-abuse providers, including Cloudflare;
• professional advisers, insurers, auditors, accountants and legal advisers;
• clients, suppliers or business partners where needed to provide services or manage a business relationship;
• public authorities, regulators or law enforcement bodies where required by law or where necessary to protect our rights, users or services.

Some providers act as processors on our behalf. Others may act as independent controllers for limited purposes, depending on the service and the applicable terms. We do not sell personal information.

8. International transfers

We use service providers and technical infrastructure that may process, store or permit access to personal information in the United Kingdom, the EU and the United States. This may include cloud, CRM, security, communications, AI, automation or agent runtime services. Some of those countries may not provide the same level of protection for personal information as the United Kingdom. Where UK data protection law treats this as a restricted transfer, we will take appropriate steps to protect the information, such as relying on UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, contractual commitments from our providers, technical and organisational safeguards, or another lawful transfer mechanism. You can contact us for more information about the safeguards that apply to international transfers.

9. How long we keep information

We keep personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy. Retention periods vary depending on the type of information, the reason we hold it, the nature of our relationship with you, and any legal, accounting, reporting, contractual, security or dispute-resolution requirements that apply.

10. Security

We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, alteration, disclosure, loss or destruction. We review these measures in light of the nature of the information, the processing we carry out and the associated risks.

11. Marketing preferences

We may send relevant business updates, service information or marketing communications where the law allows us to do so. You can unsubscribe or object to marketing at any time by using the unsubscribe link in our communications or by contacting us at [email protected]. We may keep a limited suppression record to ensure we respect your choice.

12. Automated decision-making and profiling

We do not make solely automated decisions about individuals that have legal or similarly significant effects. We may use business tools to help prioritise, assess or follow up with B2B prospects, but decisions about whether to engage with a prospect involve human judgement.

13. Your rights

Depending on the circumstances, you may have rights to access, correct, erase or restrict the use of your personal information, receive certain information in a portable format, and object to certain processing. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing already carried out. These rights are subject to legal conditions and exemptions.

To exercise your rights, please contact us at [email protected]. We may need to verify your identity before responding to a request.

14. Complaints

If you have a concern about how we handle personal information, please contact us at [email protected]. We will acknowledge data protection complaints within 30 days, investigate appropriately, keep you informed where necessary, and respond without undue delay.

You also have the right to raise a complaint with the Information Commissioner’s Office. The ICO’s contact details are available at ico.org.uk.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the effective date and, where appropriate, provide a more prominent notice or contact affected individuals directly.

16. Contact us

If you have any questions about this Privacy Policy or how we handle personal information, please contact us at [email protected].