Privacy policy

This policy covers two different things, and the difference matters. It explains what we do with the details you give us when you get in touch, and it explains how we treat the personal data that happens to be on a device you send us to recover.

1. Two roles, and which one applies when

When you contact us, we decide what to do with your name, your number and your description of the fault. For that we are the data controller.

When your device reaches the lab it may hold anything: photographs, correspondence, medical or financial records, and personal data about people other than you. We handle that material only so far as your recovery instructions, diagnostics and result verification require. If you are a business or organisation acting as controller of that data, we act as your data processor and can provide a separate data processing agreement. For a personal device, the same handling limits and security controls apply under our contract with you.

2. Who we are

Datraction is a trading name of EVOLFE LIMITED, registered in England and Wales, company number 12142547, registered office 86 South Norwood Hill, London, England, SE25 6AQ. The recovery lab is at 136 Kingston Road, London SW19 1LY.

EVOLFE LIMITED also trades under other names. Whichever name you came through, the company handling your data and your device is the same one, at the same lab.

For anything in this policy, write to hello@datraction.co.uk or call 020 8543 7088.

3. What we collect, and why we are allowed to

Every purpose below needs a lawful basis under UK GDPR. Ours are:

What	Why	Lawful basis
Name, email, phone, company	To answer your enquiry and quote for the work	Steps taken at your request before entering a contract
Device, media and fault details	To diagnose the fault and estimate what is recoverable	Steps taken at your request before entering a contract
Job records, invoices, correspondence	To carry out the recovery and keep proper accounts	Performance of the contract, and our legal obligations
The data held on your device	To recover it and return it to you	Performance of our contract with you; for business customers, processing on the controller's instructions
CCTV images, date, time and location	To protect customers' devices, staff and the premises, and investigate incidents	Our legitimate interests in security and crime prevention

We do not ask you to send us special category data and we do not go looking for it. It is in the nature of recovery work that some devices contain it. Where they do, we handle it under only so far as recovering, checking and returning it requires.

4. What we do not do

• We do not sell personal data.
• We do not inspect file contents beyond what recovery, your stated priorities and result verification require.
• We do not copy or keep your files for any purpose other than recovering and returning them.
• We do not use anything found on a customer device for marketing or for training anything.
• We do not carry out automated decision-making or profiling.

5. Who else sees it

Enquiry and job data is handled by service providers acting on our instructions — email, hosting and accounting — under contracts requiring them to protect it. Ask and we will tell you who they currently are.

A small number of recoveries need a specialist partner lab, chip-off work in particular. That happens only with your explicit agreement, arranged case by case, and we tell you before anything leaves our hands.

We will disclose data where the law requires it, and will tell you when we are permitted to.

6. How long we keep it

Our working copy of recovered data is kept for up to 48 hours after you receive or collect the recovered data, unless you ask us to delete it sooner or confirm by email that it is no longer needed, then securely destroyed.

Enquiries that do not become jobs are kept only while we need them to answer you, manage follow-up questions and deal with a complaint or legal claim, then deleted or anonymised.

Job records and invoices are kept as long as tax and accounting law requires, which for a UK business is normally six years from the end of the accounting period.

Devices left with us and not collected are dealt with under our terms and conditions.

CCTV is kept only for as long as reasonably necessary for site security, incident review and legal claims; footage connected with an incident may be retained for longer. Access is restricted to people who need it for those purposes.

7. How it is protected

Devices are photographed on arrival, registered against a job record, and tracked for as long as they are with us. Devices and recovery media are stored in a safe while they are not being worked on, and the office is protected by an active camera system recording 24 hours a day. Recovered data sits on lab systems with restricted access and is transferred to you on media you keep.

No lab can promise data is never at risk. We can promise we do not keep it longer than the job needs, and that our copy is destroyed when the job is done.

8. Where your data is

Recovery work happens in the United Kingdom. Where a service provider processes data outside the UK, we rely on the transfer safeguards UK data protection law requires.

9. Cookies and browser storage

This site offers optional Google Analytics 4. The Google tag does not load unless you allow analytics, and rejecting it does not limit the site. If allowed, it provides aggregate information about pages viewed, navigation, browser and device category, and approximate location. Google signals and advertising-personalisation signals are disabled in our site configuration. You can change your choice through “Cookie settings” in the footer.

The site also stores a light or dark appearance choice and your analytics-consent choice in your browser. The appearance preference is not sent to us. Cookie names, purposes, durations and controls are listed on our cookie policy and settings page.

10. Your rights

For data we hold as controller you can ask for a copy, ask us to correct or erase it, ask us to restrict or stop certain processing, and ask for it in a portable format. Write to hello@datraction.co.uk and we will respond within one month.

For the data on a device, tell us the job number and what you need us to do. Where a business customer is the controller, we assist that customer with relevant rights requests as its processor.

To make a data protection complaint, email hello@datraction.co.uk with “Data protection complaint” in the subject line. We acknowledge it within 30 days, keep you informed and respond without undue delay. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. Raising it with us first does not affect your right to contact the ICO.

11. Changes

When this policy changes materially we update the date at the top of the page.