Legal
Privacy Policy
Last updated: 09/2026
This policy explains how CRS Finance Solutions collects, uses and protects personal data. We keep it simple: we only collect what we need, we use it for the reasons set out below, and we delete it when we no longer need it.
1. Who we are
CRS Finance Solutions is a trading name of Chase Sharman, a sole trader based in England. For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), we are the data controller for the personal data described in this policy, except where section 5 says otherwise.
Contact: chasesharman@crsfsolutions.com
2. What data we collect
When you contact us or book a call: your name, email address, phone number, company name, job title and anything you choose to tell us about your business.
When you become a client: contact details for the people we work with, billing details (company name, address, VAT number if applicable), contracts, proposals, invoices and our correspondence with you.
When you use our website: basic technical information such as your IP address, browser type, pages visited and how you arrived at the site. Some of this is collected through cookies (see section 9).
When we reach out to you: if we contact you about our services, we may hold your name, business email, job title and company, taken from publicly available sources such as your company website or LinkedIn profile.
We do not knowingly collect special category data (such as health information) and we ask that you don't send it to us.
3. How we use your data and why we're allowed to
Where we rely on legitimate interests, we've considered whether those interests are outweighed by your rights. If you'd rather not hear from us, tell us and we'll stop. Every marketing email includes a way to opt out.
| What we do | Legal basis |
|---|---|
| Reply to enquiries and hold discovery calls | Legitimate interests (responding to people who contact us) or taking steps before entering a contract |
| Deliver projects and maintenance services | Performance of a contract |
| Send invoices and keep financial records | Legal obligation (tax and accounting rules) |
| Contact businesses about our services | Legitimate interests (promoting our business to relevant firms) |
| Improve our website | Legitimate interests, or consent where required for cookies |
| Send a newsletter or marketing emails, if you sign up | Consent |
4. Who we share data with
We don't sell personal data. We share it only with service providers who help us run the business, such as:
- website hosting and analytics providers
- email, calendar and video call tools
- CRM and document signing tools
- payment and accounting software
- automation and AI platforms used to build and run client systems
- professional advisers such as our accountant or solicitor, where needed
These providers only process data on our instructions and are required to keep it secure. We may also disclose data if the law requires it.
5. Client data we handle during projects
When we build or maintain automations for a client, we may need access to data held in that client's systems, for example invoices, supplier details or customer records. In that situation the client is the data controller and we act as a data processor on their behalf.
For this data:
- we only access and use it to deliver the agreed work
- we follow the client's instructions and our Data Processing Agreement with them
- we use the minimum access needed and keep access credentials secure
- we don't use client data to train AI models or for any other purpose
- we don't keep copies outside the client's own systems unless the work requires it
If you are a customer of one of our clients and have a question about your data, please contact that business directly, as they decide how it is used.
6. International transfers
Some of our service providers are based outside the UK, for example in the United States or the EU. Where data is transferred outside the UK, we make sure appropriate protections are in place, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
7. How long we keep data
| Data | How long |
|---|---|
| Enquiries that don't lead to work | Up to 12 months after our last contact |
| Outreach contacts who don't respond or opt out | Up to 12 months, then deleted. If you opt out, we keep a minimal record so we don't contact you again |
| Client contracts, invoices and financial records | 6 years after the end of the tax year they relate to, to meet HMRC requirements and cover any contract claims |
| General client correspondence | Up to 2 years after the end of our working relationship |
| Client system data accessed during projects | Returned or deleted within 30 days of the end of the project or maintenance agreement |
| Website analytics | In line with the retention settings of our analytics provider, and no longer than 26 months |
When we stop working together: within 30 days of a project or maintenance agreement ending, we remove our access to your systems, revoke or hand back any credentials, delete any copies of your data held on our side, and confirm this to you in writing if you ask. Automations we built stay in your own accounts and belong to you. We keep only the records we're legally required to hold, such as invoices and the contract itself.
8. Keeping data secure
We use sensible measures to protect personal data, including strong passwords, two-factor authentication, encrypted storage where available, limiting access to what's needed, and using reputable providers. No system is completely secure, but if a data breach happens that affects your data, we'll act quickly and notify you and the ICO where the law requires.
9. Cookies
Our website uses essential cookies to make it work and, with your consent, analytics cookies to understand how people use it. You can accept or reject non-essential cookies through the cookie banner and change your mind at any time. You can also control cookies through your browser settings.
10. Your rights
Under UK data protection law you have the right to:
- ask for a copy of the personal data we hold about you
- ask us to correct data that's wrong or incomplete
- ask us to delete your data
- ask us to limit how we use your data
- object to us using your data, including for direct marketing
- ask us to transfer your data to another organisation
- withdraw consent at any time, where we rely on consent
To use any of these rights, email chasesharman@crsfsolutions.com. We'll respond within one month. There's normally no charge. We may need to confirm your identity first.
Some rights have limits. For example, we can't delete invoices we're legally required to keep.
11. Complaints
If you're unhappy with how we've handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.
12. Changes to this policy
We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated at the top.