Privacy notice

1. Who we are

The PI Calculator for Schedule of Loss at apicalculator.co.uk (“the service”) is provided by Yeti Trading and Holding Company Limited, trading as Posttime (“we”, “us”, “our”). This notice explains how we handle personal data, and your rights, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Our registered details are:

• Trading name: Posttime
• Registered company name: Yeti Trading and Holding Company Limited
• Company number: 16962101 (registered in England & Wales)
• Registered address: Garden Flat, 48 Lower Oldfield Park, Bath, BA2 3HP, United Kingdom
• ICO registration number: ZC157856
• Data protection contact: privacy@posttime.uk

2. Controller and processor roles

We act in two different capacities depending on the data:

• As a controller: for data about the individuals who hold an account, for case-pass purchases, for support correspondence, and for visits to this website.
• As a processor: for the claimant data you enter into a schedule of loss. The firm or practitioner using the service is the controller of that data and decides how it is used; we process it only on their documented instructions under our terms and our data processing terms. A claimant who wants to exercise their rights should contact the firm or practitioner handling their claim.

3. Data we collect

4. How and why we use data

• To create and administer your account and let you sign in.
• To provide the calculator and schedule builder and generate the documents you ask for.
• To take payment for case passes, record what each pass unlocks and when it ends, and keep financial records.
• To provide support and respond to your enquiries.
• To keep the service secure, prevent abuse and investigate incidents.
• To send service messages, such as sign-in links.
• To understand, in aggregate, which pages of this website are used.
• To meet our legal, accounting and regulatory obligations.

5. Lawful bases

Where we act as a controller, we rely on the following lawful bases under Article 6 of the UK GDPR:

6. Sharing & sub-processors

We never sell personal data. We share it only with providers who help us run the service, each bound by contract to protect it and use it only on our instructions:

• Cloud hosting and storage: a European cloud infrastructure provider in the EEA (Germany), to host the application and database.
• Payment processing: Stripe, to take payment for case passes. Stripe is a controller in its own right for the card data it collects.
• Email delivery: Resend, to send sign-in links.
• Sign-in identity: Google or Microsoft, only if you choose to sign in with that provider.

We use schedule data only to provide the service: to store it, calculate from it and generate the documents you ask for. We do not use it for anything else, we do not use it to train any model, and we do not sell it.

We may also disclose data where required by law, to enforce our agreements, or in connection with a merger, acquisition or sale of assets (with appropriate safeguards). Our current list of sub-processors, with their purpose, location and transfer safeguards, is published in full.

7. International transfers

We aim to keep personal data within the UK or European Economic Area. The service and its database are hosted in Germany. Where data is transferred outside the UK, we ensure an appropriate safeguard is in place, such as an adequacy decision, the UK International Data Transfer Agreement, or Standard Contractual Clauses with the UK Addendum.

8. Retention

We keep personal data only for as long as necessary:

• Account data: for as long as your account is open, and deleted when the account is closed.
• Sessions: until you sign out or the session expires, at most 30 days.
• Schedule data: until you delete the schedule or close your account. A deleted schedule is removed from the live database immediately; backups age out within 14 days.
• Purchase records: kept for at least six years to meet UK tax and accounting requirements.
• Support correspondence: typically up to 24 months.

9. Security

We use appropriate technical and organisational measures to protect personal data, including encryption in transit (TLS on every connection, enforced by HSTS), a strict Content Security Policy, access scoped to each account, sign-in and session tokens stored only in hashed form, and per-IP rate limiting. Payment card data never reaches our servers. No system is completely secure, but we work hard to protect your information and will notify you and the ICO of a personal data breach where we are legally required to do so.

10. Your rights

Subject to certain conditions, you have the right to:

• be informed about how your data is used;
• access a copy of your data;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to processing;
• data portability;
• withdraw consent at any time; and
• not be subject to solely automated decisions with legal effects (we do not carry out such decisions).

To exercise any of these rights, email privacy@posttime.uk. We will respond within one month. Where the data is schedule data, for which we are a processor, we will refer your request to the firm or practitioner concerned.

11. Cookies

The service sets two strictly necessary cookies, both to do with signing in, and no advertising or analytics cookies. See our cookie policy.

12. Children

The service is a professional tool and is not intended for, or directed at, children. We do not knowingly collect data from anyone under 16 as a user. A schedule may concern a child claimant; that data is processed on behalf of the firm or practitioner as described in section 2.

13. Changes to this notice

We may update this notice from time to time. We will post the new version here and, where changes are significant, notify account holders by email. The “last updated” date shows when it last changed.

14. Contact & complaints

If you have any questions or concerns about how we handle your data, please contact us first at privacy@posttime.uk or by post at Yeti Trading and Holding Company Limited, Garden Flat, 48 Lower Oldfield Park, Bath, BA2 3HP, United Kingdom.

You also have the right to complain to the UK’s supervisory authority, the Information Commissioner’s Office (ICO), at ico.org.uk or by calling 0303 123 1113.