Privacy policy
1. Who we are
TradeForm is an online service that lets businesses accept applications for customer accounts, such as trade or credit accounts. It is run by Belnomo Associates Ltd, a company registered in England and Wales under number 12185318 (“we”, “us”).
Contact us about privacy at eb+accapp+privacy@b3s.dev. Report a security problem to eb+accapp+security@b3s.dev.
Private trial. TradeForm is currently in a private trial. During the trial, applications are not stored or sent: the form shows the person filling it in a preview of their answers, and nothing is kept once they close the page. Sections 5 to 8 describe how the service handles applications once it stores them.
2. Our two roles
When you apply for an account with a business (for example a supplier you want to trade with), that business decides what information it needs and how it uses it. It is the controller of your information. We run TradeForm on its behalf and are its processor: we use your information only to provide the service to that business, under a written agreement with it.
You are applying for an account with that business, not with us. You do not have an account with TradeForm. The business’s own privacy notice, linked on its form, explains how it uses your information. For questions about your application, or to use your rights over it, contact that business first; we will help it respond.
For the businesses that use TradeForm and their staff, we are the controller of the information we need to run their account with us: staff users’ names and email addresses, support messages, problem reports and our service records.
3. What information is involved
In an account application (processed for the business):
- the organisation’s details: name, registration number, VAT number, addresses, phone, website and invoice email;
- contact people’s names, job titles, phone numbers and email addresses;
- the name, position and signature of the person who signs the declaration;
- for sole traders and partnerships, details about individuals: trading address (which may be a home address), bank account details and Unique Taxpayer Reference;
- how the applicant heard about the business.
We ask applicants to use work contact details where they can. We do not ask for special category information such as health or ethnicity.
Checks with official registers (processed for the business):
- Companies House. When a registration number is entered, we ask Companies House for the company’s official name, status and registered office address. We send only the registration number.
- HMRC. When a VAT number is entered, we use HMRC’s “Check a UK VAT number” service to get the name and address HMRC holds for it, so the form can compare them with the details given. We send only the VAT number. We never ask for or hold anyone’s HMRC sign-in details: we connect to HMRC as an application, not on anyone’s behalf.
About business users and contacts (we are controller): staff users’ names, email addresses and roles; a record of what each user does in the service; and messages sent to us, including the sender’s email address.
Service records. Our logs record technical events, such as a lookup succeeding or failing, and error codes. They are designed not to contain personal information: no IP addresses, names, VAT numbers or answers.
4. Why we use it, and our lawful basis
| Purpose | Our role | Lawful basis (UK GDPR Article 6) |
|---|---|---|
| Collecting, checking and passing applications to the business | Processor | The business’s basis: usually steps before entering a contract, or legitimate interests for business contacts |
| Companies House and HMRC checks | Processor | The business’s legitimate interests in verifying who it trades with |
| Running business users’ accounts | Controller | Contract with the business |
| Security, problem reports and activity records | Controller | Legitimate interests in keeping the service and its data secure |
| Keeping records the law requires | Controller | Legal obligation |
5. Who receives it
- The business you applied to, and only its authorised staff. Each business sees only its own applications.
- Cloudflare, Inc., which hosts the service and delivers its email, as our sub-processor under a data processing agreement.
- Companies House and HMRC, which receive only the registration number or VAT number they are asked about.
We do not sell personal information or use it for marketing. Our own staff can reach a business’s applications only for support, when that business approves it for a limited time, and every such access is recorded.
6. Where it is processed and stored
TradeForm runs on Cloudflare’s network. A request is processed in the Cloudflare data centre nearest the person using the form; for people in the UK, that is a UK data centre. Stored information is kept in Cloudflare’s European Union jurisdiction. Nothing is stored on our own computers.
Cloudflare is a US company certified under the UK Extension to the EU–US Data Privacy Framework. Where information is processed in a country without UK adequacy regulations, it is protected by the UK International Data Transfer Addendum in Cloudflare’s data processing terms.
7. How long it is kept
- Applications: for the period the business chooses (3, 6 or 12 months, or 7 years; 12 months if it has not chosen), never longer than 7 years, then deleted automatically.
- Business users’ details: while the business uses TradeForm. When a business closes its account, all its data is deleted within 30 days; we keep only a record that the deletion happened.
- Messages, problem reports and activity records: 12 months.
- Service logs: up to 7 days.
8. How we protect it
- All connections use HTTPS. Stored information is encrypted by Cloudflare, and bank details, Unique Taxpayer References, signatures and uploaded files are encrypted again by our service.
- Each business can reach only its own applications, through staff accounts with roles. Staff sign in through Cloudflare Access with one-time codes or their organisation’s own sign-in; we hold no passwords.
- We have no standing access to businesses’ applications. Our access is time-limited, approved by the business and recorded.
- Keys for Companies House and HMRC are stored as encrypted secrets and never reach anyone’s browser.
- We follow a written procedure for security incidents and tell affected businesses, HMRC and the Information Commissioner’s Office when we must, within 72 hours.
9. Cookies and browser storage
TradeForm uses no advertising or analytics cookies. While you fill in a form, it keeps your progress in your browser’s session storage so that reloading the page does not lose your answers. Bank details, tax references, signatures and files are never kept there, and the progress is cleared when you close the tab or send the form. Staff sign-in uses a strictly necessary cookie set by Cloudflare Access.
10. Your rights
You have the right to be told how your personal information is used, to get a copy, to have it corrected or deleted, to restrict or object to its use, and in some cases to move it. For an application, ask the business you applied to; we will help it. For anything where we are the controller, email eb+accapp+privacy@b3s.dev. We will reply within one month.
You can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.
11. Changes to this policy
We will update this policy when the service changes, and show the date at the top. We will tell businesses that use TradeForm about significant changes before they take effect.