Privacy Notice

This Privacy Notice explains how WELX collects and uses personal data about you, the Subscriber, when you use the WELX platform and marketing site. It sits alongside the Terms and Conditions and the Data Processing Agreement, which together form the agreement between you and WELX.

1. Who We Are

WELX is a trading name of Maklain Partners Limited, a company registered in England and Wales under company number 17381124 and VAT registration number 527 6816 63, whose registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. We are registered with the Information Commissioner's Office (ICO) under registration reference ZC215976. In this notice, 'WELX', 'we', 'us', and 'our' mean Maklain Partners Limited. We are the data controller for the Account Data described below.

You can contact us about this notice or about your data using the email address registered to your account, or through our support channel. We will respond to any data protection query without undue delay.

2. What This Notice Covers

This notice covers Account Data only: the personal data relating to you as the Subscriber that we hold to provide and administer your subscription. Where we act as the data controller, this notice governs how we handle that data.

This notice does not cover Client Data: the personal data about your own clients that you store in the platform. For Client Data, you are the data controller and WELX is your data processor. That relationship is governed by the Data Processing Agreement, not by this notice. You are responsible for providing your own privacy notice to your clients.

3. What We Collect

3.1Account details: your name, email address, phone number, and business details (such as your trading name) that you provide when you create and maintain your account. Your phone number is required because it is the number your clients contact you on: it powers the one-tap message to a client from their record. We do not use your phone number to market to you.

3.2Billing information: your subscription and payment records. Card and payment details are collected and handled by Stripe as our payment processor. We do not store your full card details on our own systems.

3.3Support correspondence: the messages and information you send us when you contact support, and our replies.

3.4Marketing-site leads: where you join a waitlist or use a calculator or similar tool on our marketing site, the email address and any details you provide at that point.

3.5Sign-in and usage records: the technical records needed to authenticate you (via a single-use code, or a sign-in link, sent to your email) and to keep the platform secure and reliable.

4. Our Lawful Bases

4.1Contract: we process your Account Data because it is necessary to provide the subscription you have signed up for, including running your account, taking payment, and providing support.

4.2Legitimate interests: we process limited data to develop and improve the product, to keep the platform and its users secure, and to communicate with you about your account. We balance these interests against your rights and only rely on this basis where it is proportionate to do so.

4.3Consent and soft opt-in: we rely on your consent, or on the soft opt-in permitted under the Privacy and Electronic Communications Regulations 2003 (PECR), for marketing emails. You can withdraw consent or unsubscribe at any time.

5. How We Use Your Data

We use your Account Data to: provide and administer your subscription; authenticate you and keep your account secure; take payment through Stripe and keep billing records; respond to your support requests; send you transactional messages such as billing confirmations and account notices; and send you product updates and relevant information about WELX where you have not opted out.

6. Sub-processors

We use a small number of trusted third-party services to run WELX. These are listed in full in our Sub-processor Schedule, which is part of the Data Processing Agreement. In summary:

6.1Stripe processes your billing and payment data for your subscription.

6.2Supabase hosts our database and handles authentication. The database is located in London, UK.

6.3Resend delivers our email, including transactional and account messages.

6.4Netlify provides hosting, serverless functions, and content delivery for the platform and marketing site.

6.5Plausible provides cookieless website analytics on our marketing site and does not process personal data.

7. International Transfers

Our primary database (Supabase) is hosted in the UK, so your core Account Data stays in the UK. Some of our sub-processors are US-based (for example Resend and Netlify). Where UK personal data is transferred to them, we rely on the UK-US Data Bridge (the UK Extension to the EU-US Data Privacy Framework), with the International Data Transfer Agreement (IDTA) as a fallback where current certification cannot be confirmed. Full details of each transfer are set out in the Sub-processor Schedule.

8. How Long We Keep Your Data

8.1Account Data: we keep your Account Data for the life of your account, and for 30 days after cancellation to allow you to export or resume, after which it is deleted. This matches clause 3.3 of the Terms and clause 10 of the Data Processing Agreement.

8.2Marketing-site leads: we keep the details of marketing leads (such as waitlist or calculator emails) until you unsubscribe or ask us to delete them.

8.3Legal retention: we may keep limited records for longer where the law requires it, for example billing records kept for tax purposes.

9. Your Rights

Under UK GDPR you have the right to access your data, to have inaccurate data rectified, to have your data erased, to restrict processing, to data portability, and to object to certain processing. You can exercise any of these rights by contacting us using the email registered to your account or through our support channel. We will respond within the time limits set by UK GDPR and will not charge a fee except where the law allows.

10. Marketing and PECR

Where you joined a waitlist or used a tool on our marketing site, we may send you marketing emails on the basis of the PECR soft opt-in, because you gave us your email in connection with a similar service. After you sign up, we may send you product updates and relevant information about WELX. Every marketing email includes a working unsubscribe link, and you can opt out at any time. Transactional emails, such as billing confirmations and account notices, are not marketing and are not subject to the opt-out.

11. Cookies

We use only the cookies and similar storage needed to sign you in and keep your session secure. Our website analytics (Plausible) are cookieless and do not track you across sites or build a profile of you. We do not use advertising or third-party tracking cookies.

12. Complaints

If you have a concern about how we handle your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection, at ico.org.uk.

13. Changes to This Notice

We may update this notice from time to time. The current version and date are shown at the top of this document. Where a change is material, we will let you know by email or in the platform.