How Tiny Acorns Ltd collects and uses your information
This page explains the personal data Tiny Acorns Ltd collects in the course of running our business from Hemel Hempstead and how we use it. We collect identity data (for example, name and date of birth where required), contact data (such as postal address, email address and telephone numbers), and transaction and service usage data (including invoices, booking history and support logs).
We also collect technical and behavioural data automatically when you use our website or services — for example IP addresses, device information, browser type, pages visited and interaction data — through cookies and web analytics. In some cases we obtain information from third‑party sources, including public registers, social media platforms and third‑party service providers (for instance credit reference agencies or identity verification services).
Data may be provided directly by you (for example via enquiry forms, telephone calls or email) or collected automatically when you access our site.
Why we collect your information
We collect and process personal data for a limited set of purposes. These include performing a contract with you or providing a requested service (for example processing orders, delivering services, billing and customer support); improving and administering our website and services (including troubleshooting, analytics and testing); communicating with you about your account, bookings or changes to our terms and policies; and meeting our legal and regulatory obligations (for example accounting, tax and fraud prevention). Where required, we rely on your consent for activities such as direct marketing; where consent is relied upon you will be able to withdraw it at any time. For other activities we rely on lawful bases such as performance of a contract, legitimate interests (for example to improve services and protect our business) or legal obligation.
Who we may share your data with
We do not sell personal data. We disclose personal information only where necessary and under appropriate safeguards. Typical recipients include our service providers and suppliers (for example payment processors, IT hosting and cloud services, email and marketing platforms, and website analytics providers); professional advisers such as accountants and legal advisers; regulators and law enforcement where required by law (for example HMRC or a court order); and prospective purchasers or advisers in the event of a reorganisation, sale or transfer of part or all of our business. We may also share limited information with third parties for identity verification or credit checks where required to fulfil a contract. All such third parties act either as processors under contract with Tiny Acorns Ltd or as independent controllers and are required to provide appropriate technical and organisational measures to protect your information.
How long we keep your information
We retain personal data only for as long as necessary for the purposes described and to meet legal or regulatory obligations. Examples of typical retention periods are: accounting and tax records retained for up to six years in line with HMRC guidance; contractual records and service delivery information retained for the length of the contract and for a reasonable period afterwards to deal with queries or legal claims; and marketing preferences retained until you withdraw consent or we consider the record inactive (usually two years of inactivity). Where we no longer need your personal data we will delete it securely or irreversibly anonymise it. If a statutory or regulatory obligation requires longer retention, we will retain the information for the period required.
How we protect your information and your rights
Tiny Acorns Ltd applies technical and organisational safeguards to protect personal data. Technical measures include encryption in transit (TLS) for data sent to and from our website, secure servers and firewalls, and access controls to limit who can view personal data. Organisational measures include staff training, confidentiality obligations, regular security reviews and contractual terms with third‑party processors that require them to meet recognised security standards. We carry out risk assessments where appropriate and maintain an incident response plan to manage any data breach, including notification to the Information Commissioner’s Office and affected individuals when required by law. You have rights under UK data protection law, including the right to access the personal data we hold about you, request rectification or erasure, request restriction of processing, object to processing (including profiling), and request data portability where applicable. To exercise your rights or ask questions about our practices, please contact us using the contact details provided on our website. If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner’s Office.
Policy Overview — Tiny Acorns Ltd
How we collect, use and protect personal information
This Privacy Policy explains how Tiny Acorns Ltd, based in Hemel Hempstead, United Kingdom, collects, uses and safeguards personal information from users of our website. It sets out the legal bases for processing personal data, our commitment to data minimisation and security, and how we meet our obligations under UK data protection law, including the UK General Data Protection Regulation and the Data Protection Act 2018.
The purpose of this page is to be transparent and help build trust with our community.
We collect only the personal data necessary to deliver our services and respond to enquiries received via the website.
Typical categories of information we process include contact details you provide (name, email address, telephone number), information contained in messages and forms submitted on the site, technical data collected automatically (IP address, browser type, device information) and cookie data for analytics and essential site functionality.
We do not collect special category data through the website unless you provide it voluntarily and give explicit consent.
We rely on clear legal bases for processing personal data: consent where you opt in to marketing or cookies, performance of a contract when providing paid or agreed services, compliance with legal obligations, and legitimate interests for necessary business administration and fraud prevention subject to appropriate safeguards.
Where processing is based on consent, you can withdraw consent at any time without affecting processing based on another lawful basis.
Tiny Acorns Ltd is committed to data minimisation and will retain personal information only for as long as reasonably necessary to fulfil the purpose for which it was collected, to comply with legal obligations, or to resolve disputes.
We apply a documented retention schedule; for example, enquiry records are retained for a limited period to allow us to respond effectively and to meet statutory requirements.
We implement appropriate technical and organisational measures to protect personal information, including secure servers, access controls, encryption where appropriate, regular vulnerability testing, and staff training on data protection.
Where we engage third-party service providers (such as hosting, analytics, or email services), we put in place written contracts requiring them to protect personal data and act only on our instructions.
Personal data may sometimes be transferred outside the UK when necessary to provide services. Such transfers are carried out only where there are appropriate safeguards in place, for example adequacy decisions, standard contractual clauses, or other lawful mechanisms permitted under UK law.
You have rights in relation to your personal information, including the right to access, correct, restrict or erase your data, the right to object to or restrict processing, the right to data portability, and the right to withdraw consent where processing is consent-based.
To exercise any of these rights, or for questions about this Policy, contact our Data Protection contact at info@tinyacorns.co.uk or by post to Tiny Acorns Ltd, 29 Great Elms Road, Hemel Hempstead, Hertfordshire, HP3 9TW.
If you remain dissatisfied after contacting us, you have the right to lodge a complaint with the Information Commissioner’s Office. For details on cookies, marketing communications and more specific processing activities, please refer to our full Privacy Policy and Cookie Notice available on the website.
Tiny Acorns Ltd reviews this Policy periodically and will update it to remain compliant with legal requirements and to reflect changes in our processing activities.
Contact and Data Requests — Tiny Acorns Ltd
If you wish to contact Tiny Acorns Ltd about your personal data or to exercise your data protection rights, please use the contact form on this page or write to our address in Hemel Hempstead. We aim to make the process straightforward and secure. Below we explain how to request access, correction, deletion, restriction or portability, how we verify requests, and how to raise a complaint with the Information Commissioner's Office (ICO) if required.
How to make a request
- Use the contact form on this page for the quickest response. When completing the form, please include enough information to identify the personal data you want us to locate and the specific right you are exercising (for example, access, rectification, erasure, restriction, portability, or objection).
- If you prefer to write to us, send your request by post to: Tiny Acorns Ltd, Data Protection, 29 Great Elms Road, Hemel Hempstead, Hertfordshire, HP3 9TW United Kingdom. Postal requests should be signed and include the same identifying information as the form.
What to include in your request
- Provide your full name and the best contact details for the response you prefer (email or postal address).
- Describe clearly what information you are requesting or the action you want us to take, and, where appropriate, indicate relevant dates or transactions to help us locate the data.
- If you are asking someone else to act on your behalf, include a signed authorisation from the data subject and the agent’s contact details.
How we verify requests
- Before we respond, we must be satisfied that a request comes from the person whose data we hold (or from a properly authorised representative). We will check details you provide against our records and may ask for copies of identity documents such as a government-issued photo ID and a recent proof of address. You can send scans or photos securely via the contact form or by post.
- We use the minimal amount of information necessary for verification and will redact any documents once verification is complete.
- We will not request unnecessary or excessive documentation.
Timeframes and fees
- We will acknowledge receipt of your request promptly and endeavour to respond within one month.
- If your request is complex or numerous, we may extend the deadline by up to two further months; if we do so we will inform you within the first month and explain the reasons for the extension.
- Individuals generally have the right to make requests free of charge. In the case of manifestly unfounded or excessive requests (for example repetitive requests), we may charge a reasonable fee or refuse to act.
- If we intend to charge or refuse, we will explain our reasons and inform you of your right to complain to the ICO.
Access and portability
If you request access to personal data we hold about you, we will provide a copy of the information we process and details of the purposes of processing, recipients, retention periods and the source of the data where relevant.
For data portability requests, where applicable, we will provide the personal data you have supplied to us in a structured, commonly used and machine-readable format (for example CSV or JSON) where processing is carried out by automated means and the right applies.
Correction and deletion
If you ask us to correct inaccurate or incomplete personal data, we will take reasonable steps to verify and update the information. If you request deletion (the right to be forgotten), we will erase personal data without undue delay where there is no overriding legal reason for us to retain it (for example to comply with legal obligations, resolve disputes or enforce agreements).
If we cannot comply in full, we will explain why and the lawful basis for retention.
Restriction and objection
You may request that we restrict processing of your personal data in certain circumstances, for example while we verify a dispute about accuracy. You can also object to processing based on legitimate interests or direct marketing.
On receiving such a request we will assess it promptly, suspend the contested processing where appropriate and inform you of the outcome and any steps we take.
Withdrawing consent
If processing is based on your consent, you can withdraw that consent at any time.
Withdrawing consent will not affect the lawfulness of processing carried out before the withdrawal.
To withdraw consent, use the contact form or write to the address above and specify which consent you wish to withdraw.
Security of responses and data transfer
We use secure methods to receive and send personal data, including secure web forms and, for postal communications, standard safeguards. If you need to send particularly sensitive information, please indicate this in your message and we will advise on the safest method for transfer.
If you are not satisfied If you are unhappy with our response or the way we have handled your request, please contact us by the same channels and we will review your concern. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO).
The ICO’s website is ico.org.uk and their helpline can be reached at 0303 123 1113. The ICO can provide guidance on your rights and help with unresolved complaints.
Further information
If you need assistance making a request or have questions about how we handle personal data at Tiny Acorns Ltd, please use the contact form on this page or write to Tiny Acorns Ltd, Data Protection, Hemel Hempstead, Hertfordshire, United Kingdom.
We will treat your enquiry promptly and professionally.