SurveyPhrase Pro is a trading name of Castle Surveyors Limited, Company No. 05117824
Last updated: 21 April 2026 • Version 1.0 • This policy explains how we collect, use and protect your personal data.
1.1 This Privacy Policy applies to SurveyPhrase Pro, operated by Castle Surveyors Limited (trading as SurveyPhrase Pro) of 2 Southwood Close, Walkford, Christchurch, BH23 5RW, Company No. 05117824, registered in England and Wales ("we", "us", "our"). SurveyPhrase Pro is a trading name of Castle Surveyors Limited.
1.2 We are the data controller for the personal data described in this policy. This means we determine the purposes and means of processing your personal data.
1.3 We are registered with the Information Commissioner's Office (ICO) under registration number Z3637574.
1.4 Our Data Protection contact is: The Director, reachable at [email protected].
1.5 We take our obligations under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 seriously and are committed to protecting your personal data.
2.1 This policy applies to:
2.2 This policy does not apply to third-party websites, services or applications that may be linked from our Website. We are not responsible for the privacy practices of third parties.
2.3 Where you access SurveyPhrase Pro as part of a firm or organisation licence, your firm's own data controller obligations are not affected by this policy. You should also consult your organisation's privacy arrangements.
2.4 The Product itself (the SurveyPhrase Pro HTML tool) runs in your browser. Phrases, customisations, favourites and edits you create within the tool are stored in your own browser's local storage and are not transmitted to us unless you expressly choose to use a feature that requires such transmission.
3.1 We collect personal data in the following ways and for the following purposes:
| Category of Data | Examples | How Collected | Purpose |
|---|---|---|---|
| Identity data | Name, job title, firm name | Purchase form; contact form | Processing your order; account management; communications |
| Contact data | Email address, postal address, phone number | Purchase form; contact form; email correspondence | Delivering the Product; sending purchase confirmation; product updates; support |
| Financial/transaction data | Purchase amount; order reference; payment method type (not full card details) | Payment processor; purchase records | Processing payment; VAT compliance; financial record-keeping |
| Technical data | IP address; browser type and version; operating system; device type; time zone; referring URL | Automatically on website visit via cookies and server logs | Website security; analytics; diagnosing technical issues; preventing fraud |
| Usage data | Pages visited; time on site; clicks; navigation paths | Automatically via analytics tools (see Cookies section) | Understanding how visitors use the site; improving the Product and Website |
| Marketing preferences | Whether you have consented to marketing emails | Purchase form; preference centre | Sending you product updates and relevant information where you have consented |
| Communications data | Content of emails, enquiries or support requests sent to us | Direct communications from you | Responding to your enquiry; support; maintaining records of correspondence |
| Search feature data | Search queries entered into the Phrase Search feature | Processed locally in your browser — not transmitted | See section 14 (Search and Optional Features) |
3.2 We do not intentionally collect special category data (such as health data, racial or ethnic origin, political opinions, religious beliefs, or biometric data). Please do not submit such data to us.
3.3 We do not collect or store full payment card details. Payment processing is handled entirely by our third-party payment processor and we receive only transaction confirmation and limited transaction metadata.
3.4 We do not knowingly collect data from children under the age of 18. See section 12.
4.1 Under the UK GDPR, we must have a lawful basis for processing personal data. We rely on the following lawful bases:
| Processing Activity | Lawful Basis |
|---|---|
| Processing your purchase and delivering the Product | Contract (Article 6(1)(b) UK GDPR) — processing is necessary to perform the contract with you |
| Sending purchase confirmation and access details | Contract (Article 6(1)(b) UK GDPR) |
| Financial record-keeping and VAT compliance | Legal obligation (Article 6(1)(c) UK GDPR) — required by tax and accounting law |
| Responding to enquiries and support requests | Legitimate interests (Article 6(1)(f) UK GDPR) — necessary to operate our business and support our customers |
| Website analytics and performance monitoring | Legitimate interests (Article 6(1)(f) UK GDPR) — improving and securing our Website and Product |
| Fraud prevention and website security | Legitimate interests (Article 6(1)(f) UK GDPR) |
| Sending marketing emails and product update notifications | Consent (Article 6(1)(a) UK GDPR) — only where you have opted in; or Legitimate interests for direct marketing to existing customers regarding similar products under the UK Privacy and Electronic Communications Regulations (PECR) soft opt-in rules |
| Enforcing our Terms and Conditions and legal rights | Legitimate interests (Article 6(1)(f) UK GDPR) |
4.2 Where we rely on legitimate interests as a lawful basis, we have assessed that our legitimate interests are not overridden by your interests, fundamental rights or freedoms. You have the right to object to processing based on legitimate interests — see section 11.
4.3 Where we rely on consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before withdrawal.
5.1 We use the data we collect to:
5.2 We will not use your data in ways that are incompatible with the purposes set out in this policy without giving you prior notice and, where required, obtaining your consent.
5.3 You may opt out of marketing communications at any time by clicking the unsubscribe link in any marketing email or by contacting us at [email protected].
6.1 Our Website uses cookies and similar tracking technologies. A cookie is a small text file stored on your device by your browser when you visit a website.
6.2 We use the following categories of cookies:
| Cookie Type | Purpose | Consent Required |
|---|---|---|
| Strictly necessary | Essential for the Website to function (e.g. session management, security). This includes the Cloudflare Access authentication cookie used to verify subscriber access to the Members Area. These cookies cannot be disabled as the site cannot function without them. | No — necessary for service delivery |
| Functional | Remember your preferences (e.g. language, settings). | Yes — consent required |
| Analytics / performance | Understand how visitors use the site (e.g. pages visited, time on site, errors). Data is aggregated and anonymised where possible. | Yes — consent required |
| Marketing / targeting | Track visits across websites to display relevant advertising. | Yes — consent required |
6.3 When you first visit our Website, you will be shown a cookie consent banner. You may accept all cookies, reject optional cookies, or manage your preferences individually. You can change your cookie preferences at any time via the cookie settings link in our footer.
6.4 You can also control cookies through your browser settings. Disabling certain cookies may affect the functionality of the Website.
6.5 Local Storage in the Product tool: The SurveyPhrase Pro HTML tool uses browser local storage (not cookies) to save your phrases, favourites, edits and preferences on your device. This data is stored entirely on your device and is not accessible to us. It is not personal data in our hands.
6.6 We may use third-party analytics services (such as [ANALYTICS PROVIDER, e.g. Google Analytics]). Where such services process personal data on our behalf, we have entered into appropriate data processing agreements and have implemented available privacy-protective settings (such as IP anonymisation). See section 7 for more detail on third-party processors.
7.1 We do not sell, rent or trade your personal data to any third party for their own marketing purposes.
7.2 We may share your data with the following categories of third party where necessary:
7.3 Where we share data with third-party processors, we ensure that appropriate contractual safeguards are in place, including Data Processing Agreements where required under UK GDPR Article 28.
7.4 In the event of a sale, merger, acquisition or restructuring of our business, personal data may be transferred to the acquiring entity, subject to equivalent data protection safeguards.
8.1 Where we transfer your personal data outside the United Kingdom, we will ensure that such transfers are protected by appropriate safeguards as required by UK GDPR.
8.2 Appropriate safeguards may include:
8.3 Some of our third-party service providers (including, potentially, analytics and email service providers) may process data in countries outside the UK. We take appropriate steps to ensure such transfers comply with our legal obligations.
8.4 For specific information about the safeguards applicable to any particular transfer, please contact us at [email protected].
9.1 We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting or reporting requirements.
9.2 Our standard retention periods are as follows:
| Data Category | Retention Period | Reason |
|---|---|---|
| Purchase and identity data | 7 years from date of purchase | Legal obligation: HMRC accounting records requirement |
| Email correspondence and support records | 3 years from last contact | Legitimate interests: potential dispute or claim |
| Marketing consent records | Until consent is withdrawn, plus 3 years | Legal obligation: evidence of consent |
| Website analytics data | 26 months (or as set in analytics platform) | Legitimate interests: website improvement |
| Server logs (including IP addresses) | 90 days | Security and fraud prevention |
| Data subject access request records | 3 years from date of response | Legal obligation: evidence of compliance |
9.3 After the applicable retention period, personal data will be securely deleted or anonymised.
9.4 In some circumstances, we may retain personal data for longer periods where required by law, by court order, or where retention is necessary to establish, exercise or defend legal claims.
10.1 We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures include:
10.2 No method of transmission over the internet or electronic storage is 100% secure. While we take reasonable steps to protect your data, we cannot guarantee absolute security.
10.3 In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware of the breach, as required by UK GDPR Article 33. Where the breach is likely to result in a high risk to you, we will also notify you directly without undue delay.
10.4 If you become aware of any potential security vulnerability or data breach relating to our Website or Product, please notify us immediately at [email protected].
10.5 You are responsible for maintaining the security of any access credentials (including passwords) provided to you. You should not share these credentials with anyone outside the scope of your licence.
11.1 Under the UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data. These rights are not absolute and may be subject to exceptions depending on the circumstances.
You have the right to request a copy of the personal data we hold about you. We will respond within one calendar month of receiving a valid request. There is no charge for the first request; we reserve the right to charge a reasonable fee for manifestly unfounded or excessive requests.
You have the right to ask us to correct inaccurate personal data we hold about you and to complete incomplete personal data.
You have the right to ask us to delete your personal data in certain circumstances — for example, where the data is no longer necessary for the purposes for which it was collected, where you withdraw consent (where consent is the lawful basis), or where you object to processing and there are no overriding legitimate grounds. This right does not apply where we are required to retain the data to comply with a legal obligation or to exercise or defend legal claims.
You have the right to ask us to suspend the processing of your personal data in certain circumstances, for example while the accuracy of data is contested or while an objection to processing is being considered.
Where we process your data by automated means on the basis of consent or contract, you have the right to receive a copy of your data in a structured, commonly used and machine-readable format.
You have the right to object to the processing of your personal data where we rely on legitimate interests as the lawful basis, including profiling. We will cease processing unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or where processing is necessary for the establishment, exercise or defence of legal claims.
You have an absolute right to object to processing for direct marketing purposes at any time. We will cease such processing immediately.
You have the right not to be subject to decisions based solely on automated processing (including profiling) that produce legal effects concerning you or similarly significantly affect you. We do not make such automated decisions.
Where we rely on consent as the lawful basis for processing, you may withdraw your consent at any time. Withdrawal will not affect the lawfulness of processing before withdrawal.
To exercise any of the rights above, please contact us at [email protected] or by post to 2 Southwood Close, Walkford, Christchurch, BH23 5RW. We may ask you to verify your identity before processing your request. We will respond within one calendar month and will not charge a fee in ordinary circumstances.
12.1 SurveyPhrase Pro is a professional tool directed at adults operating in a professional capacity. It is not directed at or intended for use by children under the age of 18.
12.2 We do not knowingly collect personal data from children under 18. If we become aware that we have inadvertently collected such data, we will delete it promptly.
12.3 If you believe that we have collected personal data from a child under 18, please contact us immediately at [email protected].
13.1 Our Website may contain links to third-party websites, services or applications. We are not responsible for the content or privacy practices of any third-party website. We encourage you to read the privacy policy of every website you visit.
13.2 Third-party services referenced in the Product are governed by their own terms and privacy policies. We are not responsible for their data processing activities.
13.3 Our payment processing is handled by a third-party payment provider. Their collection and use of your payment information is governed by their own privacy policy, which you should review before completing a purchase.
14.1 SurveyPhrase Pro includes a Phrase Search feature that allows users to search the phrase library by keyword. This search runs entirely within your browser and no data is transmitted to any third party.
14.2 The Phrase Search feature:
14.3 SurveyPhrase Pro also includes an AI Phrase Generator feature powered by OpenAI. When you use the AI Phrase Generator:
14.4 The AI Phrase Generator requires an internet connection. If you do not wish to use this feature, all other features of the Product work entirely offline.
14.5 The Phrase Suggestion form on our website uses a mailto link to submit suggestions by email. No data from the suggestion form is processed by any third-party service.
15.1 We may update this Privacy Policy from time to time to reflect changes in our practices, the law, or our services.
15.2 Where changes are material, we will notify you by email (where we hold your email address) and will update the "last updated" date at the top of this page.
15.3 We encourage you to review this policy periodically. Continued use of our Website or Product following notification of changes constitutes acceptance of the updated policy.
15.4 Previous versions of this policy can be obtained by contacting us at [email protected].
16.1 If you have any concerns about how we handle your personal data, please contact us in the first instance:
16.2 We will investigate your concern and respond within 30 days.
16.3 If you are not satisfied with our response, or if you believe that we are processing your personal data unlawfully, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
16.4 We would appreciate the opportunity to address your concerns before you approach the ICO, but you are entitled to contact the ICO at any time.
This Privacy Policy was last reviewed on 21 April 2026. Version 1.0. Please retain a copy for your records.
© 2026 Castle Surveyors Limited (trading as SurveyPhrase Pro) • Terms & Conditions • Back to SurveyPhrase Pro