1. Who we are
We are Haydn Maguire, based in the United Kingdom. We supply and support Quote Analysis Tool (QAT), desktop quoting software typically deployed on the customer’s own site infrastructure.
| Item | Detail |
|---|---|
| Legal name | Haydn Maguire |
| Status | Individual supplier (sole trader) until a limited company is formed |
| Correspondence | United Kingdom — available on request |
| Company number | Not applicable / available on request |
| VAT number | Available on request if VAT registered |
| ICO registration | Available on request if registered with the ICO |
| Sales / privacy | sales@nyx.uk |
| Support | support@nyx.uk |
For most licensed deployments of QAT, the customer organisation is the controller of operational data held in their database. We act as controller for this marketing website and for our own sales/support records. Where we access customer systems for contracted support, we act as a processor (or sub-processor) only to the extent set out in the customer’s licence / support agreement and written instructions.
2. Scope
This policy covers:
- Visitors to this QAT marketing website;
- People who send licence or support enquiries to us;
- How personal data is handled in relation to QAT software we supply (roles and responsibilities); and
- Security and retention practices relevant to supply-chain and Cyber Essentials–style assessments.
It does not replace the customer’s own privacy notice for their employees or end users of a licensed QAT installation. Customers remain responsible for informing their staff and for their own UK GDPR compliance on systems they control.
3. Website personal data
3.1 What we collect
If you use our contact forms, your browser typically opens your email application (mailto) with details you entered, such as:
- Name;
- Company / site name;
- Email address;
- Approximate user count or support topic/urgency; and
- Any message content you choose to include.
This static website does not run a server-side contact database, analytics cookies, advertising pixels, or third-party tracking scripts as part of its standard build. Server or CDN logs (if any host you use records them) may include IP address, user agent, and request time under that host’s own terms.
3.2 What we do not collect via the site forms
- Payment card data (licensing is arranged offline / by invoice);
- Special category data (please do not send health or similar data in enquiry forms);
- Password credentials for your QAT deployment (use agreed secure channels for support).
4. Licensed software deployments
QAT is designed for on-premises / customer-controlled deployment: Windows clients and, in production, a customer-managed PostgreSQL server. Quote, user, rate, audit, and related operational data remain on infrastructure the customer controls. We do not operate a multi-tenant public cloud that stores customer job data as part of the standard licence.
Typical personal data categories in a customer deployment (controlled by the customer) may include:
- User account identifiers, names, roles/permissions, and authentication artefacts;
- Workstation / access identity signals used for security logging;
- Audit trails of sensitive actions;
- Business contact details held in quote or customer records the organisation chooses to store.
Optional local AI features (for example Ollama) run on infrastructure the customer configures. Customers must assess whether any content sent to local models is appropriate under their policies.
5. Purposes and lawful bases
| Purpose | Examples | Lawful basis (UK GDPR) |
|---|---|---|
| Respond to enquiries | Licence requests, demos, support tickets opened by email | Legitimate interests (Art. 6(1)(f)) — responding to business enquiries; or steps prior to contract (Art. 6(1)(b)) |
| Contract administration | Proposals, invoices, licence fulfilment, maintenance | Contract (Art. 6(1)(b)); legal obligation for tax records where applicable |
| Support as processor | Diagnosing faults on customer systems under instruction | Customer’s instructions / Art. 28 processor terms in the commercial agreement |
| Security and abuse prevention | Investigating suspected misuse of our email or site | Legitimate interests (Art. 6(1)(f)) |
| Improve documentation | Aggregated, non-identifying notes from support themes | Legitimate interests (Art. 6(1)(f)) |
Where we rely on legitimate interests, we balance those interests against your rights. You may object — see Your rights.
6. Sharing and processors
We do not sell personal data. We may share data with:
- Email and IT providers that process messages you send to our sales/support addresses;
- Professional advisers (legal, accounting) under confidentiality where required;
- Authorities if required by law; and
- Website hosting / DNS providers that may process connection logs.
We select providers with appropriate security expectations for UK SME use. Where a provider acts as our processor, we put appropriate contractual protections in place.
7. International transfers
We aim to keep supplier processing in the UK or a jurisdiction covered by UK adequacy where practical. If a tool we use transfers personal data outside the UK, we will ensure an appropriate transfer mechanism (for example UK International Data Transfer Agreement / Addendum or adequacy) is in place.
Customer QAT databases remain where the customer hosts them. Customers are responsible for any transfers from their own environment.
8. Retention
8.1 Our sales and support records
- Enquiry emails: retained as needed to complete the enquiry, then up to 24 months unless a longer period is needed for an active commercial relationship or dispute;
- Contracts, invoices, and tax records: retained for periods required by UK law (typically up to 6 years after the end of the relevant accounting period);
- Security investigation records: retained for the investigation and a proportionate period afterwards.
8.2 Customer-controlled QAT data (baseline guidance)
Customers should set their own retention schedule. Our product baseline guidance includes:
- Operational quote and master data: retain until the customer authorises deletion/archive;
- Audit / security logs: minimum 12 months;
- Backup artefacts: daily backups ~14 days, weekly backups ~4 weeks (minimum);
- Application error logs: minimum 90 days.
Customers should review retention at least every six months or after major deployment changes.
9. Security measures
We design QAT and our operating practices to support common UK cyber hygiene controls used in Cyber Essentials assessments. Certification is a separate process and must not be assumed from this policy alone.
| Control theme | How we address it |
|---|---|
| Firewalls / boundary | Production guidance: restrict PostgreSQL and admin ports to trusted networks/VPN; avoid open internet exposure of databases. |
| Secure configuration | TLS options for database connections; least-privilege DB users; documented deployment baselines; disable unnecessary exposure of optional services (e.g. Ollama) to untrusted networks. |
| Access control | Role-based portals and permissions; session lock; password hashing; recovery/admin paths limited; Financial Approval gates for money-setting changes. |
| Malware protection | Customers must run maintained endpoint protection on Windows clients and servers hosting QAT components. |
| Patch management | We supply software updates under maintenance agreements; customers must apply OS and database patches on their estate. |
| Logging & incident response | Audit and access identity logging features; customers should retain security logs and follow an incident process (triage, contain, preserve evidence, recover, review). |
No method of transmission or storage is perfectly secure. Report suspected security incidents affecting our website or a licensed deployment to sales@nyx.uk with subject Security incident.
10. Cookies and similar technologies
The standard QAT marketing site build does not set analytics or advertising cookies. Essential browser storage may be used by your browser for normal operation. If we later add non-essential cookies, we will update this policy and provide a consent mechanism where required.
Third-party fonts or CDN assets (if loaded) may result in those providers receiving your IP address. You can block third-party requests with browser settings; the site may fall back to system fonts.
11. Your rights
Under UK GDPR, you may have the right to:
- Access your personal data;
- Rectification of inaccurate data;
- Erasure (in certain circumstances);
- Restriction of processing;
- Data portability (where applicable);
- Object to processing based on legitimate interests; and
- Withdraw consent where processing is consent-based (we do not rely on consent for core enquiry handling).
To exercise rights regarding data we control, email sales@nyx.uk with subject Data protection request. We may need to verify your identity. For data inside a customer’s QAT deployment, contact that organisation first — they are the controller.
12. Children
QAT and this website are aimed at business users. We do not knowingly collect personal data from children. If you believe we have received such data, contact us and we will delete it where appropriate.
13. Changes
We may update this policy from time to time. The “Updated” date and version above will change when we do. Material changes will be reflected on this page. Continued use of the website after an update constitutes notice of the revised policy for website visitors.
14. Complaints
Please contact us first so we can try to resolve your concern. You also have the right to complain to the UK Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint.
15. Contact
Haydn Maguire
Privacy / sales: sales@nyx.uk
Related: Terms of Service · Contact
This notice is provided for transparency and due diligence. It is not legal advice. Signed commercial agreements (licence, maintenance, data processing addendum) prevail where they conflict with this summary for a specific customer.