Privacy Policy

What we collect when you visit this website or get in touch, why we collect it, and the rights you have.

Last updated: 30 September 2026

This policy explains what personal data we collect when you visit your-people.com or get in touch with us, why we collect it, who we share it with and what rights you have. It covers this website only. If you are a member of an association that uses Your People, your association is responsible for your membership data, and you should read its privacy notice.

Who we are

This website is run by Blue Tahiti Software Ltd, trading as Blue Tahiti and Your People, a company registered in England and Wales under number 04952377, with its registered office at Monahans, 6th Floor Whitefriars, Lewins Mead, Bristol, BS1 2NT. We are the data controller for the personal data described in this policy.

We are registered with the UK Information Commissioner's Office (ICO) under registration number ZA152876.

You can contact us about this policy or your personal data at sales@your-people.com, or by post at 3rd Floor, Old Stock Exchange, St Nicholas Street, BS1 1TG.

What we collect and why

Contact form details

What: your name, work email, organisation name, website, and telephone number if you give one

Why: To reply to your enquiry and to arrange a conversation about Your People

Lawful basis: Legitimate interests: responding to people who ask to hear from us. If you have asked us for a call or demo, steps you requested before entering a contract

Correspondence

What: emails, calls and meeting notes after you contact us

Why: To handle your enquiry and keep a record of it

Lawful basis: Legitimate interests: running our business and keeping a record of our dealings

Security and abuse-prevention data

What: your IP address and limited browser and device signals, checked by Cloudflare Turnstile when you submit a form

Why: To stop automated and abusive form submissions and keep the site secure

Lawful basis: Legitimate interests: protecting our website and our team from spam and attack

Server logs

What: IP address, pages requested, date and time, and browser type, held by our hosting provider

Why: To deliver the site, keep it secure and fix faults

Lawful basis: Legitimate interests: operating and securing the website

Analytics and advertising data

What: a cookie and device identifiers, pages viewed, how you arrived, and an approximate location, collected by Google Analytics and Google Ads

Why: To understand how the site is used, measure our marketing and improve what we publish

Lawful basis: Consent, only if you accept on the cookie banner

What: a record of whether you accepted or rejected, saved in your browser

Why: To remember your choice and respect it

Lawful basis: Strictly necessary to honour your choice, so no consent is needed

We do not ask for more than we need. Please do not put sensitive information, such as health details or financial account numbers, in the contact form. We do not knowingly collect data from children, and this site is not aimed at them.

We do not sell your personal data. We do not use it for automated decisions that have a legal or similarly significant effect on you.

Cookies and similar technologies

Under UK law (the Privacy and Electronic Communications Regulations, PECR), we only set cookies or similar technologies that are not strictly necessary after you have agreed.

Strictly necessary. We save your cookie choice in your browser's local storage. It is not sent to us and does not track you.
Analytics and advertising (optional). Google Analytics and Google Ads set cookies and read device identifiers to measure visits and campaigns. These are off by default. Nothing optional is set until you choose Accept on the banner.

If you choose Reject, optional cookies stay off. Google's tags may still send limited signals that do not use cookies or identify you directly, which Google uses for aggregate measurement under Consent Mode.

Accepting and rejecting carry equal weight on the banner. You can change your mind at any time using Cookie settings in the footer, and withdrawing consent is as easy as giving it. Withdrawing does not affect anything we did while you had consented. You can also delete cookies in your browser settings.

We share personal data only with service providers acting on our instructions (processors) and only as far as they need it to do their job:

Cloudflare, Inc. hosts this website and provides Cloudflare Turnstile, the spam check on our forms. Cloudflare sees your IP address and limited browser signals. See the Turnstile Privacy Addendum and Cloudflare's privacy policy.
Resend delivers the email that carries your contact form submission to us. Your form details pass through their systems in transit. Resend's privacy policy.
Google provides Google Analytics and Google Ads, if you accept optional cookies. Google acts as our processor for analytics and may act as an independent controller for some advertising uses. Google's privacy policy.
Our own business systems, such as email and our customer records, which are provided by suppliers who process data for us under contract.

We may also disclose personal data where the law requires it, to protect our rights or to professional advisers under a duty of confidence. If our business were sold or restructured, data could pass to the new owner, who would have to respect this policy.

International transfers

Some of these providers are based in, or process data in, the United States and other countries outside the UK. Where they do, we rely on a safeguard recognised by UK law: an adequacy decision (for example, the UK–US Data Bridge for providers certified under the Data Privacy Framework), or the UK International Data Transfer Addendum or Agreement to standard contractual clauses. You can ask us for details of the safeguard that applies.

How long we keep it

Contact form details and related correspondence: Up to 24 months after our last contact with you, unless you become a customer, when our customer terms and records policy applies
Security and abuse-prevention data: Only as long as Cloudflare keeps it under its own policies
Server logs: Up to 30 days
Analytics data: Up to 14 months, the retention setting on our Google Analytics property
Your cookie choice: Until you change or clear it in your browser

When the time is up, we delete or anonymise the data.

How we protect it

We use measures appropriate to the risk, including encrypted connections (HTTPS), access limited to the people who need it, and a spam and abuse check on every form. No system is perfectly secure. If a breach puts your rights at risk, we will tell you and the ICO as the law requires.

Your rights

Under UK data protection law you can ask us to:

access the personal data we hold about you and get a copy;
correct data that is wrong or incomplete;
erase your data, in some circumstances;
restrict how we use it, in some circumstances;
object to processing based on our legitimate interests, and object at any time to direct marketing;
port data you gave us to you or another organisation, where we process it by consent or contract and by automated means;
withdraw consent at any time, where we rely on it.

To use any of these, contact us using the details above. We will usually reply within one month. We may ask you to confirm who you are. There is normally no charge.

You also have the right to complain to the ICO at ico.org.uk/make-a-complaint or on 0303 123 1113. We would appreciate the chance to put things right first, so please contact us before you do.