Privacy Policy
How Devute Ltd collects, uses, shares and protects personal information when you visit our website, enquire, become a client or take one of our courses, and the rights you have over it.
1. Who we are
This policy explains how Devute Ltd, a private limited company registered in England and Wales (company number 14301159), whose registered office is at 53 Leafield Avenue, Bradford, England, BD2 3SE, uses personal data. In this policy, "we", "us" and "our" mean Devute Ltd, and "you" means the person whose data we hold. Devute Ltd was previously named Devute UK Ltd.
For the personal data described in this policy we are the controller, which means we decide how and why it is used. We follow the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), as amended, including by the Data (Use and Access) Act 2025.
Where we process personal data on behalf of a client, for example data held in a website, CRM or hosting account we run for them, the client is the controller and we act as their processor. That processing is covered by our Data Processing Addendum and the client's own privacy notice, not this policy.
If you have any question about this policy or your data, email us at info@devute.com.
2. What we collect and where it comes from
We collect personal data in the following ways.
- Information you give us. When you fill in an enquiry or audit form we collect your name, email address, company, budget and your message. When you become a client, buy a subscription or book a course, we also collect billing and contact details, the names and work contact details of your staff who deal with us, and anything you share with us during the work.
- Information collected automatically. When you use our website, our forms record the page you sent the enquiry from and any campaign (UTM) parameters in the web address. Our hosting provider and the services that deliver our fonts and images receive your IP address and basic browser information, which they need in order to deliver the page. If you agree to analytics or marketing cookies, we also collect information about how you use the site. See our Cookie Policy.
- Account information. If you use our client portal (client.devute.com), our CRM or software products, or our hosting client area (my.devute.com), we hold your login details, account settings and a record of activity such as orders, invoices and support tickets.
- Learner information. If you take one of our courses or join Devute Academy, we hold your enrolment details, attendance or progress, and any work or questions you submit.
- Information from others. We may receive your details from a colleague who introduces you, from your employer when they are our client, or from advertising platforms in aggregated or pseudonymised form when you respond to an advert.
We do not ask for special category data (such as health, ethnicity or religious beliefs). Please do not send it to us unless we have specifically asked.
3. How we use your data and our lawful bases
Data protection law requires us to have a lawful basis for each use of your personal data. These are the main purposes and the basis we rely on for each.
| Purpose | Lawful basis |
|---|---|
| Replying to your enquiry, giving you a quote or carrying out a free audit | Steps taken at your request before entering into a contract; where you enquire on behalf of a business, our legitimate interests in responding to business enquiries |
| Delivering services, subscriptions, software and courses you have bought | Performance of a contract; where the contract is with your employer, our legitimate interests in dealing with the people who manage the account |
| Billing, payments, record keeping and tax | Performance of a contract and compliance with legal obligations |
| Running our client portal, CRM and hosting accounts, including security and fraud prevention | Performance of a contract and our legitimate interests in keeping our systems secure |
| Website analytics using cookies (Google Analytics) | Consent |
| Advertising and measuring adverts using cookies or pixels (Google Ads, Meta, TikTok) | Consent |
| Sending marketing emails to individual (non-business) contacts | Consent, or the soft opt-in under PECR where you have bought or negotiated to buy a similar service from us |
| Sending marketing emails to business contacts at corporate addresses | Legitimate interests, with an easy way to opt out in every message |
| Improving our services and website, and keeping business records | Legitimate interests |
| Dealing with complaints, legal claims and requests from regulators | Legal obligations and our legitimate interests in protecting our business |
Where we rely on legitimate interests, we have balanced our interests against your rights and expectations. You can ask us for more detail about that balance, and you have the right to object (see "Your rights" below).
4. Your enquiry and our CRM
When you send an enquiry through our website, the details you enter, together with the page address and any campaign parameters, go to our customer relationship management system (CRM) at admin.devute.com, hosted on Vercel with a Supabase (PostgreSQL) database.
We use it to reply to you, prepare a proposal and follow up, and to see which pages and campaigns bring enquiries. Only our team and people working for us who need it can see it.
How long we keep it. If an enquiry does not lead to work together, we delete the lead 12 months after our last contact with you. You can ask us to delete it sooner by emailing info@devute.com, unless we need it for a contract we have agreed with you.
5. Clients, account users and course learners
Clients. If you or your business become a client, we use your details to manage the project or subscription, communicate with you, give you access to the client portal, issue invoices and provide support. We keep a record of the work, decisions and approvals so that we can deliver what was agreed and resolve any questions later.
Account users. If your employer gives you a login to our client portal, CRM, hosting client area or one of our software products, we use your name, work email and activity in the account to provide and secure the service. Data that your employer stores in a product we provide is handled as their processor under our Data Processing Addendum.
Learners. If you take a course, training session or join Devute Academy, we use your details to enrol you, run sessions, give you access to material, track completion and send you course-related messages. Any terms specific to courses are set out in our Course Terms.
6. Marketing by email, SMS and WhatsApp
We may send you marketing by email, SMS, WhatsApp or other messaging channels about our services, products, courses and articles. We follow UK law (UK GDPR and the Privacy and Electronic Communications Regulations):
- We only send marketing to individuals where you have agreed to receive it for that channel, or where you have bought or asked about a similar service from us and did not opt out when we collected your details.
- We may email people at business email addresses about services relevant to their role, as the law allows.
- We record when and how you gave consent, and for which channels.
- Every message tells you how to opt out — an unsubscribe link, or replying STOP — and you can email info@devute.com at any time.
When you opt out, we keep a minimal record of your contact details on a suppression list so we do not contact you again.
With your consent, we may use advertising platforms (Google, Meta and TikTok) to show our adverts to people who have visited our website and to measure how well they work. We do not sell your personal data.
9. International transfers
Some of our providers are based in, or store data in, the United States or other countries outside the UK. Where personal data is transferred outside the UK, we make sure it is protected by one of the safeguards recognised by UK law, such as:
- a UK adequacy decision ("data bridge"), including the UK Extension to the EU-US Data Privacy Framework for US organisations certified under it;
- the UK International Data Transfer Agreement (IDTA), or the International Data Transfer Addendum to the EU Standard Contractual Clauses.
You can ask us for more information about the safeguard used for a particular provider.
10. How long we keep your data
We keep personal data only for as long as we need it for the purpose we collected it for. As a guide:
| Data | How long |
|---|---|
| Enquiries and leads that do not become clients | 12 months from our last contact with you, then deleted |
| Client contracts, invoices and financial records | 6 years from the end of the financial year they relate to, as HMRC requires |
| Google Analytics data | 14 months, in line with our Google Analytics settings |
| Marketing consent and preferences | Until you withdraw consent or opt out; we then keep your email address on a suppression list |
| Account and learner records | For as long as your account or enrolment is active, then for the periods above where they form part of client or financial records |
We may keep data for longer if we need it to deal with a complaint or legal claim, or if the law requires us to. When data is no longer needed, we delete it or anonymise it.
11. How we protect your data
We use appropriate technical and organisational measures to protect personal data. These include encrypted connections (HTTPS), access controls so that only people who need data can see it, strong authentication on our systems, keeping software up to date, and choosing providers that maintain recognised security practices.
No system is completely secure. If a personal data breach occurs that is likely to put your rights at risk, we will tell the Information Commissioner's Office and, where required, you.
12. Your rights
You have the following rights over your personal data. Some apply only in certain circumstances.
- Access. You can ask for a copy of the personal data we hold about you.
- Rectification. You can ask us to correct data that is inaccurate or incomplete.
- Erasure. You can ask us to delete your data where we no longer need it or have no lawful basis to keep it.
- Restriction. You can ask us to limit how we use your data, for example while we check its accuracy.
- Objection. You can object to our use of your data where we rely on legitimate interests. You can object to direct marketing at any time, and we will stop.
- Portability. You can ask for data you gave us, which we process by automated means on the basis of consent or contract, in a commonly used machine-readable format, or ask us to send it to another organisation.
- Withdraw consent. Where we rely on consent, you can withdraw it at any time. This does not affect anything we did before you withdrew it. For cookies, use "Cookie settings" in the footer.
- Automated decisions. You have rights relating to decisions based solely on automated processing that have legal or similarly significant effects on you. We do not make decisions of this kind about you.
To use any of these rights, email info@devute.com. We may need to confirm your identity first. We will respond within one month, which may be extended by up to two further months for complex requests, in which case we will tell you why. We will not normally charge a fee.
13. Children
Our website and services are intended for businesses and adults. We do not knowingly collect personal data from children under 13. If you believe a child has given us personal data, please contact us and we will delete it.
14. Complaints
If you are unhappy with how we have handled your personal data, please contact us first at info@devute.com so that we can try to put it right. We will acknowledge your complaint and look into it.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection, at ico.org.uk/make-a-complaint. The ICO usually expects you to have raised the matter with us first.
15. Changes to this policy
We may update this policy from time to time, for example when we change providers or the law changes. The date at the top of this page shows when it was last updated. If we make a significant change that affects how we use your data, we will tell you by email or through a notice on our website where appropriate.
16. Contact us
Devute Ltd, registered in England and Wales, company number 14301159.
Registered office: 53 Leafield Avenue, Bradford, England, BD2 3SE.
Email: info@devute.com. You can also reach us through our contact page.