Privacy Policy

1. Who We Are

GK Tools Ltd is a UK-registered company providing software tools and services for small businesses and tradespeople.

• Company Name: GK Tools Ltd
• Registered Office: 483 Green Lanes, London, N13 4BS
• Company Number: 16434833
• ICO Registration: ZB899192
• Contact: support@gk.tools

For the purposes of UK GDPR, we are the "data controller" - meaning we decide how and why your personal data is processed.

2. What Data We Collect

The data we collect depends on how you interact with us:

When you contact us (email, contact form):

• Your name and email address
• Your mobile number, if you choose to give it (optional)
• Whether you would prefer a reply by email or WhatsApp
• Your country and preferred language, if you tell us (optional)
• The content of your messages

When you use Invoicer (our invoicing application):

• Account details: name, email, password (encrypted), business name, address
• Client/customer information you add (names, addresses, contact details)
• Invoice and quote data you create
• Payment information (processed securely by Stripe - we don't store card details)
• Session data to keep you logged in

When you use our hosting services:

• Account and billing information
• Technical data needed to provide the service

3. Why We Collect Your Data

We only collect data when we have a good reason:

• To provide our services: We need your account info to let you use Invoicer, and your client data to generate invoices for you.
• To communicate with you: Responding to support requests, sending important service updates.
• To process payments: If you have a paid subscription, we need billing details.
• Legal obligations: We're required to keep certain financial records for HMRC.

4. Legal Basis for Processing

Under UK GDPR, we process your data based on:

• Contract: Processing necessary to provide services you've signed up for.
• Consent: Where you've explicitly agreed (e.g., opting in to marketing emails).
• Legal obligation: Where we're required by law (e.g., tax records).
• Legitimate interests: Where we have a genuine business need that doesn't override your rights (e.g., responding to your enquiries, improving our services, preventing fraud).

5. Who We Share Data With

We don't sell your data. Ever. We only share data with:

• Stripe: Our payment processor. They handle card payments securely. Stripe's Privacy Policy
• Microsoft 365: We use Microsoft for email. Messages you send us are stored in their systems. Microsoft's Privacy Statement
• Our hosting provider: Your data is stored on servers they manage in the UK.
• HMRC: We're legally required to share certain financial information for tax purposes.
• Google (reCAPTCHA & Maps): We use Google reCAPTCHA to protect our contact form from spam, and an embedded Google Map on our contact page. Google may process limited technical data (such as your IP address) in doing so, including on servers outside the UK under the UK Extension to the EU-US Data Privacy Framework and standard contractual safeguards. Google's Privacy Policy
• Google Translate: Only if you use the language switcher. Nothing is sent to Google unless you choose a language — the page is not translated by default. If you do, Google receives the page content to translate it and sets its own googtrans preference cookie. Google's Privacy Policy
• Google Analytics: Only if you accept our cookie banner. We use it to understand site traffic, with IP anonymisation switched on. See Section 10 for what it sets and how to opt out. Google's Privacy Policy

All our service providers are UK-based or operate under UK data-protection safeguards (including the UK Extension to the EU-US Data Privacy Framework where applicable).

6. Where Your Data Is Stored

Your data is stored on secure servers in the United Kingdom. We use encryption (SSL/TLS) to protect data in transit, and access to our systems is restricted to authorised personnel only.

Email is processed through Microsoft 365, which may store data in Microsoft's UK or EU data centres.

7. How Long We Keep Data

• Account data: For as long as your account is active, plus 90 days after closure to allow for reactivation or to handle any disputes.
• Invoice/financial records: 7 years (as required by HMRC).
• Support correspondence: 3 years from last contact.
• Marketing enquiries: Until you ask us to delete it.

We don't keep data longer than necessary. When data is no longer needed, we securely delete it.

8. Your Rights

Under UK GDPR, you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Ask us to correct inaccurate data.
• Erasure: Ask us to delete your data (where we don't have a legal reason to keep it).
• Restriction: Ask us to limit how we use your data.
• Portability: Request your data in a machine-readable format.
• Object: Object to certain types of processing.
• Withdraw consent: Where processing is based on consent, you can withdraw it at any time.

To exercise any of these rights, email support@gk.tools. We'll respond within one calendar month (usually much sooner).

9. Security

We take security seriously:

• SSL/TLS encryption on all our sites and applications
• Passwords are hashed (we can't see them)
• Regular security updates and patching
• Access controls and logging
• Regular backups stored securely

No system is 100% secure, but we do our best to protect your data.

10. Cookies

Matomo (always on, no cookies, no consent needed)
We use Matomo, a self-hosted, open-source analytics platform, to understand how visitors use our website. Matomo runs entirely on our own infrastructure in the United Kingdom — your analytics data is never shared with third parties or sent abroad. We do not set any Matomo cookies on gk.tools. The last two octets of your IP address are discarded before storage.

Google Analytics (only if you accept the cookie banner)
When you first visit gk.tools you'll see a cookie banner. If you click Accept, we also load Google Analytics (GA4) alongside Matomo, so we can see aggregate traffic trends. Google Analytics is not loaded, and sets no cookies, until you accept — if you click Reject, or close the banner without choosing, only cookieless Matomo runs. IP anonymisation is switched on in our Google Analytics configuration. You can change your mind at any time by clearing the gk_cookie_consent cookie in your browser, which brings the banner back on your next visit.

Other GK Tools products
Each product in the GK Tools family runs as a separate site with its own privacy policy describing the cookies and tracking specific to that product:
• Invoicer — invoicer.gk.tools/privacy-policy
• Gravity Host — gravityhost.co.uk
All GK Tools products that use analytics use the same self-hosted Matomo described above — no third-party analytics tools, no cross-product profiling.

Payment Processing
When you make a payment, Stripe (our payment processor) may set cookies to process the transaction securely. These are set by Stripe, not by us. See Stripe's Cookie Policy.

Opting out
You can opt out of Matomo analytics on gk.tools by ticking the box below. We’ll store that preference locally in your browser and stop tracking you on future visits. (Untick to re-enable.)

11. Children's Privacy

Our services are designed for businesses and are not intended for anyone under 18. We don't knowingly collect data from children.

12. Changes to This Policy

We may update this policy from time to time. The "Last Updated" date at the top will reflect any changes. For significant changes, we'll notify you via email or a notice on our website.

13. Complaints

If you're unhappy with how we've handled your data, please contact us first at support@gk.tools - we'll do our best to sort it out.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Phone: 0303 123 1113