Privacy Notice

1. Who we are

Costa Bridge is a correspondence-first relocation preparation service operated by Shane Fullwood. We are registered in the United Kingdom.

• Contact: costabridge.co.uk
• Email: hello@costabridge.co.uk
• Privacy queries: privacy@costabridge.co.uk

For the purposes of data protection law, Costa Bridge is the “data controller” in respect of the personal data described in this notice.

2. What personal data we collect

We collect only the information you choose to provide or that is necessary to respond to your enquiry and deliver our services.

We do not collect sensitive or special-category data (such as health information, racial or ethnic origin, or religious beliefs) through this website. If you choose to disclose such information in a free-text message, it is treated with additional care and is never distributed beyond the small team reviewing your case.

3. Why we process your data (lawful basis)

Under UK GDPR and the Data Protection Act 2018, we process your personal data on the following lawful bases:

• Consent — You give explicit consent via a checkbox on the enquiry form before we collect or store your data.
• Contractual necessity — If you proceed to purchase a service, processing is necessary to fulfil our contract with you (preparing written reports, checklists and guidance).
• Legitimate interests — We have a legitimate interest in responding to enquiries, maintaining accurate records and improving our services. We do not rely on this basis where consent or contractual necessity applies.

4. How we use your data

• To review your enquiry and assess whether our services are suitable
• To respond to your questions by email
• To prepare and deliver written guidance, reports or checklists you have purchased
• To send one bounded follow-up email round (questions relating to the report only)
• To suggest professional referrals where your situation requires a lawyer, tax adviser or other specialist
• To keep internal records of who we have advised and what service was provided

We do not use your data for marketing newsletters, automated profiling or advertising purposes. If in the future we introduce a newsletter, we will ask for separate, explicit consent.

5. How we store and share your data

Your data is stored in systems we use to operate the business:

• Airtable — used as our internal operations database for tracking enquiries, services and referrals. Airtable is a US company; data transfers are subject to Standard Contractual Clauses under UK GDPR. Data is encrypted in transit and at rest.
• Fillout — used for structured questionnaires and client intake. Fillout Inc is a US company that processes data on our behalf (data processor). We have reviewed their data processing terms.
• Zoho Mail — used for email communication. Zoho processes emails in transit and storage under its own privacy and data-processing terms.
• Vercel — our website hosting provider (US). Vercel processes server logs and routes form submissions securely via HTTPS.
• Stripe — if you purchase a service, payment data is handled by Stripe. We do not store your card details. Stripe’s privacy notice applies to payment processing.

We do not sell your personal data. We do not share it with third parties for marketing. We only share data with professionals (lawyers, tax advisers, gestors) if you explicitly ask us to make an introduction, or if we believe a referral is in your best interest and relevant to your request.

6. Cookies and tracking

We do not use advertising cookies, tracking pixels or third-party analytics (such as Google Analytics) on this website.

Our hosting provider may collect basic server logs (IP address, browser type, pages visited) for operational security and debugging purposes. These logs are retained for a short period and are not used to identify individuals.

7. International transfers

Some of our service providers (Airtable, Fillout, Vercel, Stripe) are based in the United States. Where your personal data is transferred outside the UK, we rely on appropriate safeguards — principally Standard Contractual Clauses approved under UK GDPR — to ensure your data receives a substantially similar level of protection.

8. How long we keep your data

• Enquiries that do not proceed to a paid service — retained for 24 months after last contact, then deleted, unless you request earlier deletion.
• Clients who purchase a service — retained for 7 years after the last service delivery, in line with UK tax and accounting record-keeping requirements, then securely deleted.
• Email correspondence — retained in our mail system for the same periods as above. You may request deletion at any time.

9. Your rights

Under data protection law you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate or incomplete data
• Erasure — ask us to delete your data (“right to be forgotten”)
• Restriction — ask us to limit how we use your data
• Objection — object to our processing based on legitimate interests
• Data portability — request your data in a structured, commonly used format
• Withdraw consent — withdraw your consent at any time (this does not affect processing already carried out)

To exercise any of these rights, email us at privacy@costabridge.co.uk. We will respond within one calendar month. We may need to verify your identity before processing your request.

10. Sensitive documents

Please do not send passports, bank statements, utility bills, key codes, alarm codes, legal documents, visa application forms or other sensitive files through this website or by unencrypted email.

If we need documents for a paid service, we will agree a secure transfer method with you directly (such as encrypted email, a secure upload link or password-protected files). We treat all documents we receive with strict confidentiality and store them only for as long as necessary to provide the relevant service.

11. Security

We take reasonable technical and organisational measures to protect your data: password-protected accounts, two-factor authentication on our operational systems, HTTPS encryption for all website traffic, and restricted access so that only Shane Fullwood (and any future vetted team member bound by confidentiality) can view client data.

No system is completely secure. If we become aware of a data breach that affects your personal data, we will notify you and the relevant supervisory authority as required by law.

12. How to complain

If you are unhappy with how we have handled your personal data, please contact us first at privacy@costabridge.co.uk.

You also have the right to complain to the UK supervisory authority: the Information Commissioner’s Office (ICO). We would appreciate the chance to resolve any concern before you escalate, but you are free to contact the ICO at any time.

13. Changes to this notice

We may update this privacy notice from time to time to reflect changes in how we process data or in legal requirements. The latest version will always be available on this page, with the “last updated” date at the top.

14. Important reminder about our services