The boring proof
Privacy notice
The short version: we collect the minimum we need to quote your job, do the work and invoice you. We don't run marketing lists, we don't sell data, and the ordinary pages of this site don't track you or set cookies.
1. Who we are
TRULOX LTD ("Trulox", "we", "us") is an independent locksmith company serving Surrey, South West London, East Berkshire and surrounding areas. We are the data controller for the personal information described in this notice.
- Company: TRULOX LTD, registered in England & Wales, company number 12280106
- Registered office: 292 Cortis Road, London SW15 6XQ
- Privacy contact: hello@trulox.co.uk · 0333 880 9173
- ICO registration: ZC194111
2. What we collect
We only collect information you give us when you get in touch or book work:
- Phone calls — your number, the time you called and how long we spoke, plus brief job notes (the problem, your postcode and the fixed quote we agreed).
- WhatsApp — your number, your messages, and any photos of your door or lock you choose to send for a quote. You start the conversation, and it takes place inside WhatsApp, which is run by Meta; we place no cookies or trackers to run it.
- Quote & callback forms — your name, mobile number, postcode, and a description of the job.
- Email — anything you send to hello@trulox.co.uk.
- Job & payment records — the work done, the invoice, and confirmation that the agreed price was paid. We never see or store your full card details — payment is taken at the end of the job through our payment provider, myPOS.
Call recording
Calls to Trulox are recorded. We tell you at the start of the call, and here is exactly why:
- What we record — the audio of the call, kept against your job notes.
- Why — so the price you're quoted is the price you pay (a recording settles any "what did we agree?" later), to train and improve how we answer, and to help us improve our service and the way we explain things.
- How long — no longer than 90 days (see section 7); we delete recordings on a monthly cycle.
- Your rights — you can ask for a copy of a recording of your own call, or ask us to delete it. Email hello@trulox.co.uk.
When you call, we play a short recorded message telling you the call is
recorded. Its wording is: You're through to Trulox. We record our calls, to keep everyone
honest and get your fixed quote right. Connecting you now.
After the job — one review request
Once your job is done, we may send you a single message (by text or WhatsApp) asking how it went and inviting a Google review. It's one message, not a campaign — reply STOP and we won't send another, and you can tell us at the job that you'd rather we didn't.
3. Why we use it, and on what legal basis
We use your information only to run the job and the business:
- ContractQuoting and doing the work
- To give you a fixed quote and carry out the job — performance of a contract, or steps you ask us to take before one.
- Legal obligationInvoicing & accounts
- To invoice you and keep accounting records — required by HMRC and the Companies Act.
- Legitimate interestsCall recording, one follow-up & the review request
- To record calls (proof of the quote, training and service improvement), to follow up once on a quote you asked for, and to send the single post-job review request. We've weighed this against your privacy; you can object at any time and we'll stop.
We do not use your details for marketing lists, we never sell or rent personal data, and there is no automated decision-making or profiling.
4. Measurement on this site — no cookies, no banner
We count page views in our server logs. No analytics script from anyone else runs on this site. Your day/night theme follows the time of day and your device's setting — nothing is stored on your device, so there's no cookie banner to click through. That isn't a loophole; there is genuinely nothing to consent to.
5. Who we share it with
Only the businesses we need to run yours — a named list, not a vague one:
- Netlify — hosts this site and holds a short-lived backup of form leads (Netlify Blobs).
- Resend — our email-sending provider — relays form leads to our inbox.
- Google Workspace — our email inbox.
- CircleLoop — handles our phone line and stores any call recordings described in section 2. No cookies or identifiers are placed on your device.
- WhatsApp (Meta) — carries the WhatsApp conversations you start with us — your messages and any photos you choose to send. The conversation happens inside WhatsApp; we place no cookies or trackers to run it.
- Telegram — sends an instant alert of your enquiry — including your phone number, the job type and your postcode area — to our locksmith's phone, so we can call you straight back. The service is run by Telegram FZ-LLC in the United Arab Emirates; we place no cookies or trackers to use it.
- myPOS (our payment provider) — to take payment at completion.
- Our accountant — to file our accounts.
- Barclays Business Insurance — administered by Simply Business, and its underwriters, only if a claim is ever made on a job.
No data goes to advertisers or data brokers.
6. Where your data goes
Most of our suppliers process data in the UK or EU. Where data reaches the United States, it's protected as the law requires: Netlify, Resend, Google and Meta (WhatsApp) rely on the UK Extension to the EU–US Data Privacy Framework. Our call provider is UK-based and keeps any recordings in the UK or EU, so your call data is not transferred outside the UK/EU. We also send each enquiry — including your phone number — to our locksmith instantly via Telegram, so we can call you straight back. Telegram is run by Telegram FZ-LLC in the United Arab Emirates, which has no UK adequacy decision, so we make that transfer under the UK International Data Transfer Agreement, the safeguard the law provides for it. If you would rather we did not send your number this way, tell us and we will alert our locksmith without it.
7. How long we keep it
The periods below are the single set we work to. (Your day/night theme isn't in the table because nothing is stored for it — see section 4.)
| What | How long | Why |
|---|---|---|
| Quote & callback form details (backup copy) | 90 days | A short-lived technical backup of the lead, then automatically deleted. |
| Enquiry emails in our inbox | 12 months | So we can follow up a quote and answer you — cleared by hand after this. |
| Call recordings | 90 days | Proof of the fixed quote we agreed, plus training. See section 2. |
| Call records at our call provider | their own default | Our call provider (CircleLoop) keeps basic call metadata to its own default period — their policy, not ours; we are confirming the exact figure with them. |
| WhatsApp threads & photos | 12 months | Cleared by hand on a quarterly review. |
| Job records & invoices | 6 years | Required by HMRC and the Companies Act — exempt from deletion. |
| Server logs (page views) | Short — our host default | Aggregate counts with no identifiers; nothing that points back to you. |
8. Your rights
Under UK GDPR you can ask us to:
- give you access to a copy of your data;
- correct it if it's wrong;
- delete it;
- restrict how we use it;
- object to our use of it; or
- port it elsewhere.
Email hello@trulox.co.uk — we'll respond within one month, free of charge. We may check it's really you, in proportion to the request (usually by the mobile number we already hold for your job).
9. How to complain — to us, then to the ICO
If you're unhappy with how we've handled your data, please tell us first so we can put it right. You can use the short form below, or email hello@trulox.co.uk with "Data protection complaint" in the subject. We will acknowledge your complaint within 30 days.
You also have the right to complain to the Information Commissioner's Office (ICO):
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
10. Changes & version
We'll update this notice when our practices change and bump the version below. The current version is v1.0, last updated 12 July 2026.