Privacy Policy

Straight2PDF ("we", "us", "our") is operated by WFA Support Ltd, company number 11535469. We respect your privacy and are committed to protecting your personal data in accordance with the UK GDPR and Data Protection Act 2018.

1. Who We Are

WFA Support Ltd is a company registered in England and Wales with company number 11535469.
Registered office: 22 St. John Street, Newport Pagnell, Buckinghamshire, United Kingdom, MK16 8HJ.
Registered with the Information Commissioner’s Office (ICO), registration reference ZA927889.
Contact: privacy@straight2pdf.co.uk

2. Information We Collect

• Account & Profile Data: Name, email address, company name, login credentials.
• Form & Submission Data: Any content you upload or create, including form answers, signatures, photos, notes, uploaded files, generated PDFs, timestamps, form metadata and workflow/review records.
• Location Data: When a mobile app user allows location access, the app records the phone's GPS location and the time as each form answer is completed and when the form is submitted. Location is only recorded while a form is being filled in, never in the background. It is stored with the submission so the user's company can see where and when the form was completed, and is kept for the same period as the submission. Users can turn location access off in their phone settings; forms can still be submitted without it.
• HR Data (only for companies using the Timesheet & HR add-on): timesheets, holiday requests and entitlements, and sickness records, including absence dates, categories, notes, fit notes and Statutory Sick Pay details. Sickness records are health data: only the approvers and admins the company chooses can see them, and their notes are encrypted.
• Technical & Usage Data: IP address (see anonymisation note below), device type, browser, usage statistics, logs, usage alert data, spam checks, rate-limit checks and security event information.
• Delivery & Recipient Data: PDF delivery, notification, email recipient and support/contact details where these are used to provide the service, including timesheet reminders and recurring report check emails sent on a company's behalf.
• Payment Data: Billing contact name and email, company name, billing address, VAT details and records of subscriptions, add-ons, top-ups and payments. Card payments are handled by Stripe; we never see or store full card numbers.
• Support Data: Communications with our support team, including contact form name, email address, company, enquiry type and message.
• Crash and Error Data: We use Sentry to collect crash and error reports. This may include device model, OS version, and app state at the time of the crash.

IP addresses recorded in access logs, activity logs and page-visit analytics are anonymised by masking the final octet (e.g. 203.0.113.0 rather than 203.0.113.45), so the stored value cannot be used to precisely identify a device. The one exception is the API activity log for companies using the API access add-on: it keeps the full IP address of each API call for 90 days, so the company can check where its API login is used and ask us to restrict it to its own addresses.

3. How We Use Your Data & Lawful Bases

Purpose	Lawful Basis
Provide the Straight2PDF service (forms, workflows, signatures, PDF generation)	Contract
Account management, billing and support	Contract / Legal obligation
Keep the service secure (access logs, rate limits, abuse prevention)	Legitimate interests
Understand page visits with first-party analytics	Consent (cookie banner)
Improve the service using error reports and usage records	Legitimate interests
Marketing communications	Consent or Legitimate interests
Comply with legal and regulatory obligations	Legal obligation

4. Sharing Your Information

We share data with selected sub-processors needed to provide hosting, payments, email and text-message delivery, error reporting and app distribution. Our current sub-processor list, including location/transfer context for providers such as Stripe, Microsoft, Twilio, Google and Apple, is available at Sub-processors.

• Hosting: 24host.uk (United Kingdom)
• Payments: Stripe
• Email delivery: Microsoft 365
• Text-message sign-in codes: Twilio
• Crash and error reporting: Sentry (EU data region)
• Background maps on the admin location map: OpenStreetMap
• AI Assistant (only when a customer's authorised users use it, and for summaries of submitted answers only when the customer has switched them on; photos, signatures, contact details and who submitted are never sent): Anthropic
• App Distribution: Google LLC (Google Play) and Apple Inc. (App Store)
• Legal advisers and regulators where required by law

5. International Data Transfers

Our core hosting is in the UK. Limited transfers may occur where sub-processors such as Stripe, Microsoft, Twilio, Sentry, Anthropic, Google or Apple process data outside the UK. These transfers are safeguarded by appropriate contractual and transfer mechanisms, such as the UK International Data Transfer Agreement (IDTA), UK Addendum to EU Standard Contractual Clauses, or equivalent provider safeguards where applicable.

6. Data Retention

We keep data only as long as necessary. Form submissions are kept while the company's account is open, unless the company deletes them; the plan sets how far back they can be viewed. HR records are kept for 6 years after the period they cover. Full details are in our Data Retention Schedule. Billing records are kept for at least 6 years for tax and accounting purposes.

7. Your Rights

You have the following rights under UK GDPR:

• Access, rectification, erasure, restriction and objection
• Data portability
• Withdraw consent at any time
• Lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk

Account holders may request account deletion or a data export from within the service. To exercise any of your rights, please email privacy@straight2pdf.co.uk.

If you are unhappy with how we handle your personal data, you can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

8. Cookies and browser storage

We use essential cookies for the service to function securely and, with your consent, first-party analytics to understand page visits and improve Straight2PDF. You can manage your analytics preference through the cookie banner or the Cookie settings link at the bottom of every page. See our Cookie Policy for detailed cookie information.

• Essential session cookies: first-party cookies used to support login, account security and core service functionality. These cookies are configured using appropriate security settings and expire when your browser session ends.
• Cookie preference storage: first-party storage used to remember whether you accepted analytics or chose essential cookies only. It is retained for up to 90 days.
• First-party analytics: with consent, we use first-party analytics to understand page visits, usage patterns and service performance. This may include page information, referrer, device/browser information, IP address, session-level identifiers and visit timing.
• Interface preference storage: logged-in pages may store interface preferences such as display or admin screen settings in your browser.

9. Security

We use appropriate technical and organisational measures to protect your data. Form submission data, generated PDFs, customer-uploaded files, sickness record notes and two-factor authentication secrets are encrypted at rest using AES-256-GCM. For more information about our security approach, please see Security & Trust.

10. Data Breach Notification

In the event of a personal data breach, we will notify the Information Commissioner’s Office (ICO) within 72 hours of discovery where required by law, and will notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

11. Children

Straight2PDF is a business service and is not intended for children. Customers should not knowingly use the service to collect children’s personal data unless they have the required lawful basis, permissions and safeguards.

---

Contact Us
Email: privacy@straight2pdf.co.uk