Privacy policy

Who we are

Trustlayer Technologies Ltd (“we”, “us”) is a company registered in England and Wales. We are the parent company of two services: Footersly (footersly.com), which manages email signatures, disclaimers and campaign banners for Microsoft 365 organisations, and MailAuthInspector (mailauthinspector.online), which inspects and monitors email authentication records.

For the purposes of UK data protection law we are the data controller of the personal data described in this notice, except where section 3 says otherwise.

Data protection contact details

Controller	Trustlayer Technologies Ltd
Registered office	To be confirmed
Data protection contact	privacy@trustlayertechnologies.com
ICO registration	Registration in progress — this entry will carry the number once issued.

We are not required to appoint a statutory Data Protection Officer. Responsibility for data protection sits with the company directors, and the address above reaches them.

What this notice covers

This notice covers personal data we handle about:

• visitors to this website, trustlayertechnologies.com;
• people who contact us by the form on this site, by email or by post;
• people who hold an account in, or administer, Footersly or MailAuthInspector;
• people at our customers, suppliers, partners and resellers whom we deal with;
• people who apply to work with us.

Each product also has its own privacy notice covering the detail of that service. Where this notice and a product notice differ on a point specific to that product, the product notice governs. Neither replaces a signed data processing agreement, which takes precedence over both for the data we handle on a customer's behalf.

When we are a controller, and when we are a processor

The distinction decides who answers to you, so it is worth stating plainly.

We are the controller

For our own business: the accounts we open, the people we bill, the enquiries we answer, the staff and applicants we deal with, and the logs this website produces. We decide what is held and why, and this notice applies in full.

We are a processor

For the content our customers put into the products: the directory data a Footersly tenant synchronises (names, job titles, telephone numbers, photographs, group membership), the domains and DNS records a MailAuthInspector account monitors, and the aggregate reports it ingests. Our customer is the controller of that data. We act on their instructions under a data processing agreement, we do not use it for our own purposes, and we do not sell it.

If you are an employee of one of our customers and want to know why your name appears in a signature template, ask your own organisation first: they decide that, not us. If you cannot get an answer, write to us anyway and we will help you reach the right people.

What we collect

Categories of personal data, by the relationship we have with you

If you are…	We may hold
A website visitor	IP address, the pages requested, the time of the request, the referring page, and your browser's user-agent string — all of it in standard server logs. We set no analytics or advertising cookies; see the cookie policy.
Making an enquiry	Your name, email address, organisation if you give it, the topic you chose and what you wrote in the message, plus our reply and any correspondence that follows.
An account holder or administrator	Name, work email address, the organisation or tenant you belong to, the rights granted to you, sign-in events, and a record of administrative changes you make. We authenticate through Microsoft Entra ID and never see or store your password.
A customer contact	Name, role, work contact details, the licence and billing details of the organisation, support history, and correspondence.
A supplier or partner contact	Name, role, work contact details, contract and payment details.
A job applicant	Your application, CV, correspondence, interview notes and references. We ask for nothing about health, ethnicity, religion or other special category data at application stage.

We do not read the content of your email. Neither product needs message bodies to do its job, and neither is given access to them.

We do not knowingly collect special category data (health, ethnicity, religious or philosophical belief, trade union membership, genetic or biometric data, sex life or sexual orientation) or criminal offence data. If you send it to us in an enquiry we will not use it, and we will delete it once the enquiry is closed.

Why we hold it, and our lawful basis

UK GDPR requires a lawful basis for each purpose. Ours are as follows.

Purpose and lawful basis under Article 6 UK GDPR

Purpose	Lawful basis
Answering an enquiry you send us	Consent (Article 6(1)(a)) for the enquiry form, where you tick the box before sending, and legitimate interests for an enquiry you send by email or post — our interest in replying to someone who contacted us.
Providing and administering the products, including support and billing	Performance of a contract (Article 6(1)(b)) with the customer organisation, or taking steps at its request before entering one.
Keeping the services secure, preventing abuse, and investigating incidents	Legitimate interests (Article 6(1)(f)) — running a service our customers can rely on, which also protects them. Balanced against your interests, and limited to the data that serves it.
Improving the products, diagnosing faults, and capacity planning	Legitimate interests, using aggregated or pseudonymised data wherever it answers the question.
Sending service notices to account holders (outages, breaking changes, renewal)	Legitimate interests, and in some cases performance of a contract. These are not marketing and cannot be unsubscribed from while you hold an account, though you can ask to change who receives them.
Marketing to organisations that have not bought from us	Consent, or legitimate interests for corporate subscriber contact permitted by PECR. Either way, one click stops it.
Keeping accounting records and meeting tax, company and regulatory duties	Legal obligation (Article 6(1)(c)).
Establishing, exercising or defending legal claims	Legitimate interests, and where applicable legal obligation.
Recruitment	Legitimate interests in assessing applicants, and consent if we ask to keep your details on file after a role is filled.

Where we rely on legitimate interests we have weighed our interest against your rights and recorded that assessment. Ask at privacy@trustlayertechnologies.com and we will send you the relevant one.

Where we rely on consent, you can withdraw it at any time. Withdrawing it does not affect anything done before you did, and it does not affect a separate basis we hold for the same data — an invoice, for instance, stays on file because the law requires it.

This website, and server logs

This site is deliberately plain. It loads no fonts, scripts, images or styles from any other organisation, so visiting it does not report your visit to anybody else. There is no analytics package, no advertising pixel, no social media embed, no chat widget and no consent banner, because none of those is here to consent to.

Our hosting provider keeps standard web server logs, including your IP address, for security and fault diagnosis. Those logs are deleted or aggregated within 30 days. We do not use them to build a profile of you and do not combine them with anything else we hold.

The site sets one cookie, and only when you submit the enquiry form: an anti-forgery token that stops somebody else's website submitting the form as you. It is a session cookie and is strictly necessary, which is why no consent is required for it. The cookie policy sets it out in full.

Marketing, and the rules we keep to

We would rather have fewer, better conversations than a mailing list. In practice that means:

• we do not buy contact lists, and we do not scrape them;
• we do not pass your details to anybody else for their marketing, ever;
• every marketing message carries a working unsubscribe link, and we act on it within three working days at the outside;
• we market to corporate subscribers under the Privacy and Electronic Communications Regulations and to individuals only with consent;
• an enquiry is not consent to marketing. If you ask us a question, you get an answer, not a newsletter.

Who we share it with

We do not sell personal data, and we do not share it for anybody else's marketing. We do rely on a small number of service providers to run the business, each under a written contract that binds them to process data only on our instructions and to keep it secure:

• Cloud hosting and infrastructure — running the applications and databases;
• Email delivery — sending service notices and replying to you;
• Identity — Microsoft Entra ID, which authenticates account holders;
• Payments and accounting — taking payment and keeping statutory records;
• Error monitoring and support tooling — diagnosing faults and tracking tickets.

Each one is named, with what it does and where it holds data, on our sub-processors page. Customers can ask to be told before we add a new sub-processor to a service they use.

We will also disclose personal data where we have to:

• to our professional advisers — accountants, auditors, insurers and lawyers — where they need it;
• to a regulator, court or law enforcement body where we are legally obliged to. We check that any such request is valid and, unless the law stops us, we tell the customer it concerns;
• to a buyer, in the event that the business or part of it is sold or reorganised, under confidentiality and on the same terms as this notice.

International transfers

Customer data in the products is held in the United Kingdom or the European Economic Area. Some of our suppliers are headquartered outside the UK, and a few may process limited data — most often support correspondence or diagnostic logs — outside it.

Where that happens, the transfer is covered by one of the following:

• UK adequacy regulations, where the destination has been judged adequate;
• the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK International Data Transfer Addendum;
• another safeguard permitted by Chapter V of the UK GDPR, together with a transfer risk assessment and any extra technical measures it calls for, such as encryption in transit and at rest.

The sub-processors page names the location and the safeguard for each one. Ask us for a copy of the mechanism covering any particular transfer and we will provide it.

How we protect it

Security is a practice, not a paragraph, and the security page describes ours. In summary:

• data is encrypted in transit with TLS, and at rest in our hosting provider's storage;
• access to production systems is limited to the engineers who need it, requires multi-factor authentication, and is logged;
• nobody here browses a customer's organisation casually. Support access is granted by the customer, time-limited, and recorded in the change log the customer can read;
• backups are encrypted and restores are tested;
• we patch promptly and track vulnerabilities in our dependencies;
• staff are vetted, trained on data protection, and bound by confidentiality.

If a personal data breach occurs that is likely to result in a risk to people's rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours of becoming aware of it, and tell affected customers without undue delay. Where we are a processor, we tell the controller without undue delay so they can meet their own duty.

How long we keep it

We keep personal data only as long as the purpose needs, or as long as the law requires. In practice:

Retention periods

Data	Kept for
Web server logs	30 days, then deleted or aggregated
Enquiries and the correspondence that follows	24 months from the last message, unless it becomes a customer record
Customer account and configuration data	For the life of the account, then 90 days, then deleted
Administrative change log and audit records	24 months, so a change can be traced after the fact
Sign-in and security event records	12 months
Support tickets	36 months from closure
Invoices, receipts and accounting records	7 years from the end of the accounting period, as UK tax law requires
Marketing preferences, including unsubscribes	Indefinitely, because forgetting that you opted out would be worse
Unsuccessful job applications	6 months, or 12 months with your consent

A customer can ask for earlier deletion, and backups age out on their own cycle within 35 days of deletion from the live systems.

Your rights

Under the UK GDPR you have the right to:

• be informed about how your data is used — which is what this notice is for;
• access a copy of the personal data we hold about you, and be told why we hold it, who we share it with and how long we keep it;
• rectification of data that is inaccurate or incomplete;
• erasure of data we no longer have a reason to hold — sometimes called the right to be forgotten;
• restrict processing while a dispute about accuracy or our basis is resolved;
• data portability — a machine-readable copy of data you gave us, where we hold it on consent or contract;
• object to processing based on legitimate interests, and to object to direct marketing at any time, which we always honour;
• withdraw consent where consent is our basis;
• complain to the Information Commissioner's Office.

To exercise any of them, email privacy@trustlayertechnologies.com. We will not charge you, and we will reply within one month; if a request is complex we may extend that by up to two further months, and we will tell you within the first month if so. We may ask you to confirm who you are, but only to the extent needed to avoid disclosing your data to somebody else.

If your request concerns data we hold as a processor for one of our customers — your employer, for instance — we will pass it to them promptly and tell you we have, because the decision is theirs to make.

Automated decision-making and profiling

We do not make decisions about you by automated means alone that have a legal or similarly significant effect on you, and we do not profile you for marketing. The products do score and classify things — a DNS record, a sending source, a configuration — but those are judgements about domains and records, not about people.

Children

Our products are sold to organisations and are not directed at children. We do not knowingly collect personal data about anyone under 18 through this website. If you believe we have, tell us at privacy@trustlayertechnologies.com and we will delete it.

Changes to this notice

We update this notice when what we do changes, and when the law does. The date at the top is the date of the current version. Where a change materially affects you we will say so — by email to account holders, or by a notice on this site — before it takes effect. Earlier versions are available on request.

Complaints, and the ICO

If you are unhappy with how we have handled your data, tell us first at privacy@trustlayertechnologies.com. We will acknowledge it within five working days and give you a substantive answer within one month. We would far rather fix it than have it escalated.

You have the right to complain to the UK's supervisory authority at any point, whether or not you come to us first:

Supervisory authority

Authority	Information Commissioner's Office
Address	Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline	0303 123 1113
Online	ico.org.uk/make-a-complaint

Questions about this document

Write to privacy@trustlayertechnologies.com for anything about data protection, or hello@trustlayertechnologies.com for everything else. Post reaches us at the registered office: to be confirmed.