Privacy Notice

TomCRM-POL-003 Rev 3. Last updated: 30 October 2026. Download as PDF

1. Who we are

TomCRM Limited (TomCRM, we, us) is a company registered in England and Wales under number 15662063, with its registered office at 128 City Road, London EC1V 2NX. We are registered with the Information Commissioner's Office under reference ZB691927.

Our data protection lead is Tommy Findlay, Director. Contact us about anything in this notice at hello@tomcrm.co.uk or on 01522 287313. We are not required to appoint a statutory Data Protection Officer and have not done so.

2. The two roles we play

We are the controller of the personal data described in this notice: information about visitors to our website, people who contact us, and the people at our customers who use and pay for TomCRM.

When our customers put their own contacts' personal data into their TomCRM accounts, the customer is the controller and we process that data for them as their processor, under the TomCRM Data Processing Agreement (TomCRM-DPA-001). If you are a customer's contact and want to exercise your rights, please contact that business first; we will help them respond.

3. What we collect and how

4. How we use it and our lawful basis

We record and transcribe our calls and meetings as standard, usually with Gemini (the Google Meet note-taker) or Otter, or another transcription service that meets our data protection standards, so that decisions and actions are captured accurately and so we can improve, automate and streamline how we work. The recorder shows on screen. If you would rather a meeting was not recorded, tell us before it starts and we won't record it.

5. Who we share it with

We share personal data only with the providers we need to run our business and the service, each under a contract that protects it, and with our professional advisers or public authorities where the law requires. We do not sell personal data.

6. Transfers outside the UK

Some of our providers, including HighLevel and Cloudflare, hold or access data in the United States. Where data leaves the UK we rely on the UK Extension to the EU-US Data Privacy Framework for providers certified under it, or on the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. You can ask us for details of the safeguard that applies to a particular provider.

7. How long we keep it

8. How we protect it

The TomCRM platform runs on HighLevel, which is certified to ISO/IEC 27001:2022 and encrypts data in transit and at rest. Access to customer accounts is limited to the people who need it, using individual logins and two-factor authentication. Our Security and Continuity Statement (TomCRM-RPT-001) gives more detail and is available on request.

9. Your rights

Under the UK GDPR you have the right to ask for a copy of your personal data, to have it corrected or deleted, to restrict or object to how we use it, to have it transferred to you or another organisation, and to withdraw consent at any time where we rely on consent. Email hello@tomcrm.co.uk and we will respond within one month.

If you are unhappy with how we have handled your personal data, please tell us first. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

10. Cookies

Our website sets one cookie of its own to remember your cookie choice. Google Analytics cookies are set only after you accept them in our cookie banner. Our chat widget, provided by HighLevel, loads only after you accept or when you click "Chat with us"; it then stores a session ID and how you arrived at our website in your browser's local storage so your conversation can continue. You can change your choice at any time using the Cookie settings link at the bottom of every page, or in your browser settings.

When you submit a form, Cloudflare Turnstile checks that you are a person and not a bot. This is needed to protect the form, so it runs without asking for your consent. It does not set an analytics or advertising cookie, and Cloudflare uses what it collects only for this check and to keep its service secure.

11. Automated decisions and Ai

Our scorecards and assessments produce an automatic score and report from your answers. This does not have any legal or similarly significant effect on you. Our team uses Ai assistance to help read and draft emails, and a person reviews anything that is sent.

12. Changes to this notice

We review this notice at least once a year. The revision number and date at the top show the current version, which is always published at https://www.tomcrm.co.uk/privacy. We will tell customers by email about any significant change.