Privacy and cookies

Who is responsible?

Squirrel Forensics Ltd is the controller of personal information used to run sqfr.uk and manage its enquiries and customer relationships. We are registered in England and Wales, company number 13806513. Our registered office is 86-90 Paul Street, London, EC2A 4NE.

Email info@sqfr.uk for privacy questions. This notice covers the website, not evidence you examine on your own Acorn workstation. Do not send case evidence, passwords or confidential client material through our enquiry form. Any separate evidence-handling service needs its own agreed scope and data-protection arrangements.

What we use, and why

We receive information directly from you, your organisation or its authorised representative. Our website also receives technical information needed to deliver pages and protect the service.

Enquiries and demonstrations

Name, role, contact details, organisation, country, requirements and correspondence. We use these to answer questions, arrange demonstrations and prepare quotations. Our basis is taking steps towards a contract where you are the prospective customer, or our legitimate interest in responding to business contacts and managing enquiries.

Customers and support

Account, order, delivery, invoice and support records where relevant. We use these to fulfil contracts, provide agreed support, maintain business records and deal with disputes. The bases are contract, legal obligations such as accounting duties, and legitimate interests in managing business relationships and legal claims.

Launch updates

Your email address, request and consent record. We use consent to send the updates you request. The form sends your request to the SQFR team; it does not automatically create a mailing-list subscription or reserve a product. Withdraw consent at any time by emailing us or using an unsubscribe option in the message. Withdrawal does not affect earlier lawful use.

Website security

Our host and security services may receive IP addresses, request times, requested pages and browser information. This helps deliver the site, prevent abuse and investigate faults. Our legitimate interests are a working, secure service. The enquiry form uses a short-lived, keyed hash of an IP address for rate limiting, rather than storing the address in that limiter.

Optional analytics

With your consent, Google Analytics measures visits and use of the Acorn marketing pages. It uses cookie identifiers and receives page, browser and device information. Google also receives your IP address as part of the network connection. Advertising features are disabled in our tag. We do not load the Google tag on enquiry, launch-signup, account or payment pages, or on URLs containing search or other non-campaign query parameters. SQFR also stores daily totals of page views and demo-link clicks, without visitor identifiers. Hosting security logs are separate. Our basis for optional analytics is consent.

Required form fields let us respond and understand the request. If you prefer not to complete the form, email us with the minimum information needed for your question. We do not use these enquiries to make decisions with legal or similarly significant effects solely by automated processing.

Who receives information?

When you submit the contact form, Google reCAPTCHA v3 checks for automated spam. Google receives technical information, including your IP address and browser and device information, and uses a security cookie. We send the verification token to Google, not the text of your enquiry. A failed check prevents submission; you can email info@sqfr.uk instead. Google’s Privacy Policy and Terms of Service apply.

Access is limited to people who need it for the relevant purpose. Our service providers include website hosting, email delivery and storage, website security, and providers involved in an account, payment or delivery where applicable. Professional advisers and public authorities may receive relevant records where needed for advice, a legal duty or a legal claim. We do not sell enquiry details for advertising.

Fasthosts provides the website hosting. Existing account and basket pages use Cloudflare Turnstile to help prevent automated abuse; Cloudflare receives technical information when that service runs. See Cloudflare's privacy notice. A payment provider's own notice applies when you use its service. The planned Acorn bundle is not currently available to order.

Some providers may process information outside the UK. A restricted transfer requires a lawful safeguard, such as UK adequacy regulations or approved contractual safeguards with the necessary assessment. Contact us for information about the safeguards relevant to your data or a copy where available. We do not promise that every provider processes data only in the UK.

If you allow analytics, Google receives the analytics data described above. Processing can take place outside the UK. See Google’s privacy policy and how Google uses information from partner sites.

How long is information kept?

There is no single GDPR retention period for every enquiry. We keep personal information only for as long as its purpose or an applicable legal requirement needs it.

• Enquiries that do not become orders: for the time needed to answer the question, complete reasonable follow-up and resolve any issue arising from the correspondence. Continued negotiations, a complaint or a legal claim may justify longer retention. Information no longer needed should be deleted or made anonymous.
• Customer and financial records: for the relationship, relevant support obligations and applicable accounting or legal-claim periods. Company accounting records normally need to be kept for six years from the end of the relevant financial year; some circumstances require longer.
• Launch-update requests: while the requested updates remain relevant and consent remains in place. After an opt-out, a minimal suppression or consent record may be needed to respect the choice and demonstrate compliance.
• SQFR visit counts: a rolling 30-day reporting window, with scheduled removal of older totals. These are aggregate counts, not individual browsing histories.
• Google Analytics: the cookies set by our tag last for up to 180 days and are removed when you withdraw consent here. Google-held data is separate from browser storage; retention is controlled in the Analytics account and by Google’s service terms. Contact us about retention or deletion of your data. Removing cookies does not delete information already received by Google.
• Form rate limiter: a 15-minute validity window. Expired technical records are cleared through the site's maintenance processes.
• Security logs and backups: according to their security, fault-resolution and recovery purpose. Access is restricted; an investigation or legal obligation can require relevant records to be retained longer. Backup deletion follows the relevant rotation cycle.

Ask us about the retention of a particular record. A deletion request is considered against its purpose, your rights and any duty to retain it.

Cookies and device storage

Optional Google Analytics and SQFR visit counts stay off until you accept them. We do not load advertising pixels or embedded social-media trackers. External links take you to separate sites with their own policies.

Choosing essential only does not stop necessary page delivery, enquiry security or a requested login. Refusing optional analytics does not prevent you from using the Acorn pages.

Site search runs in your browser against a public index. Search terms are not sent to SQFR's analytics endpoint. Any experimental browser-assistant tools on these pages provide public information only; they do not submit enquiries, upload evidence or make payments.

Consent previously given for SQFR-only totals does not enable Google Analytics. The updated banner asks you to choose again. Use Cookie settings at any time to change your choice. Withdrawal does not affect processing that took place before you withdrew consent.

Your data-protection rights

Depending on the circumstances, you can ask for access, correction, deletion, restriction or transfer of your personal information. You can object to processing based on legitimate interests and to direct marketing. You can withdraw consent without losing access to the website. These rights are not absolute; we will explain any applicable limit.

Email info@sqfr.uk. We may need enough information to identify you and locate the records. Requests are normally answered without charge and within one month. Where the law allows an extension, identity check or clarification, we will explain what is needed and the applicable timetable.

Questions or complaints

Send a data-protection complaint to info@sqfr.uk, or write to our registered office. Describe the issue and the outcome you seek; do not send unnecessary evidence or identity documents.

We will acknowledge a data-protection complaint within 30 days, investigate it and explain the outcome without undue delay. You can also raise a concern with the Information Commissioner's Office, the UK regulator. See the ICO's complaints guidance.

We will update this notice if our practices change. The date above identifies this version. Reading a privacy notice is not consent to marketing or optional tracking.