Privacy policy
Last updated: 2 October 2026
This policy explains what personal information CodeFirst collects through this website and when you contact us, what we do with it and what rights you have. It is written to be read, so it is short. If anything is unclear, ask us.
Who we are
CodeFirst Limited is a company registered in England and Wales, company number 08672649. Our registered office is 11 Yeo Business Park, Clyst St. Mary, Exeter EX5 1DP, and our main office is at 43 Temple Row, Birmingham B2 5LS.
For the information described in this policy, CodeFirst is the controller, which means we decide how and why it is used.
To ask about this policy or to use any of your rights, email contact@codefirst.net or call 0800 433 7990.
The information we collect
When you send us an enquiry. The contact form asks for your name, company, work email address and a description of what you need. A telephone number, a budget range and how you heard about us are optional. We also keep the emails you send us and notes of calls.
When you ask for a reminder. If you ask to be reminded before support for a product ends, we keep your email address and the product you asked about.
When you send us a result from one of our tools. The tools on this site work in your browser. Nothing you enter is sent to us unless you choose to send it, in which case we receive your email address, the result and the answers that produced it.
When you run our end-of-support check script. It runs on your own machine and sends nothing to us. We see its output only if you email it to us.
When you browse the site. The company that hosts the site keeps standard technical records of requests, such as IP address, browser type and the page requested, to keep the site secure and available. If you agree to analytics, Google Analytics and PostHog record how you use the site, including replays of how pages were used with anything typed into a form masked. Our cookie policy explains this.
When you become a client. We keep the contact, contract and billing details needed to work with you.
Please do not send passwords, source code or personal records about other people in a first enquiry. If we need access to a system, we will arrange a secure way to receive it.
What we use it for, and the legal basis
| What we do | Legal basis |
|---|---|
| Reply to your enquiry and discuss the work | Our legitimate interest in answering people who contact us, and steps taken at your request before a contract |
| Send a reminder you asked for | Your request |
| Provide services to clients, and invoice for them | Performance of a contract |
| Keep accounting and tax records | Legal obligation |
| Keep the website secure and working | Our legitimate interest in running a secure site |
| Measure how the site is used | Your consent, which you can withdraw at any time |
We do not sell personal information. We do not add people who enquire to a mailing list, and we do not make decisions about you by automated means.
Who we share it with
We use a small number of suppliers to run the business, and they process information on our behalf under contract:
- Microsoft, for email and documents (Microsoft 365). Enquiries from this site are delivered to our Microsoft 365 mailboxes.
- Cloudflare, which hosts this website and protects it from attack.
- Google, for Google Analytics, only if you agree to analytics.
- PostHog, for product analytics and session replay, hosted in the European Union, only if you agree to analytics.
We may also share information with our professional advisers, or where the law requires us to.
These suppliers may process information outside the United Kingdom. Where they do, the transfer is covered by a safeguard recognised in UK data protection law, such as an adequacy decision or approved contract terms.
How long we keep it
- Enquiries that do not lead to work: up to two years after our last contact, then deleted.
- Reminder requests: until the reminder has been sent, or until you ask us to remove it.
- Client records: for the length of the contract, and afterwards for as long as the law requires accounting records to be kept, which is normally six years.
- Analytics data: 14 months in Google Analytics; session replays in PostHog are kept for 30 days and other analytics data there for no more than 14 months.
Your rights
Under UK data protection law you have the right to:
- ask for a copy of the information we hold about you
- have inaccurate information corrected
- have information erased, in certain circumstances
- restrict or object to our use of your information, in certain circumstances
- receive information you gave us in a portable form, in certain circumstances
- withdraw consent at any time, where we rely on consent
To use any of these rights, email contact@codefirst.net. There is no charge. We will reply within one month.
If you are unhappy with how we have handled your information, please tell us first so that we can put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
Information we handle for our clients
When we maintain or build a system for a client, we may have access to personal information held in that system. In that case the client is the controller and we act on their instructions as a processor, under the terms of our agreement with them. This policy does not cover that information. If your question is about data held in a system we look after, please contact the organisation that runs it.
Links to other websites
This site links to other websites, including our pages on LinkedIn, Facebook and X. Those sites have their own privacy policies, and we are not responsible for how they use information.
Changes to this policy
We will update this page when what we do changes, and change the date at the top. If a change is significant, we will say so on the site.