How Working Order handles your information.
Who this notice is from
Working Order is a sole-trader business run by Michael Stenhouse.
Michael Stenhouse, trading as Working Order
146 Bramhall Lane South, Bramhall, SK7 2ED
hello@workingorder.systems
When Working Order is the controller, and when it is the processor
Working Order is the data controller for enquiries received through this site, for its own client contacts, and for the business records needed to invoice and run the business.
When Working Order handles personal information inside a client's systems (for example a client's CRM, customer records or email) solely on that client's instructions, Working Order will normally act as a processor and the client remains the controller. The respective responsibilities are set out in the engagement terms agreed with each client.
What information is collected
- Enquiries through this site or by email. Your name, business name and URL, email, phone if you provide it, and the context you write in the message.
- Client work. Business documents, systems access, and information shared during a Working Order Review or a subsequent project. Handled per the terms agreed at the start of the engagement.
- Server logs. IP address, browser, page requested, timestamp. Captured by Cloudflare for security and troubleshooting.
How I use your information
To reply to enquiries, run the Working Order Review, deliver client work, invoice for it, and keep the financial records the law requires.
Legal basis
- Responding to enquiries: legitimate interests (operating the business and replying to people who have asked to be contacted), and sometimes steps taken at your request before entering into a contract.
- Managing client relationships and delivering engagements: legitimate interests (running the business).
- Personal data inside a client's own systems: processed on the client's instructions, as their processor.
- Invoicing and tax records: legal obligation.
- Website security and troubleshooting: legitimate interests (keeping the site available and protected).
Who it is shared with
Working Order uses the following services to run the business. None of your information is sold or shared with marketing lists.
- Website hosting and form processing: Cloudflare.
- Fonts: Google Fonts, loaded from Google's servers when a page is viewed.
- Transactional email (site notifications, form replies): Resend.
- Business email at workingorder.systems: Google Workspace.
- Video calls: Zoom.
- File storage: the Mac used to run Working Order (disk-encrypted), Google Drive, and GitHub for code.
- Accounting: Google Sheets.
- AI tools used in technical and analytical work: Anthropic (Claude) and OpenAI (ChatGPT).
The specific services involved in delivering a client project, including any AI tools where personal information from the client's systems may be involved, are named and agreed in that engagement's terms.
International transfers
Some suppliers may process personal information outside the UK, principally in the United States. Where this involves a restricted transfer, Working Order relies on a safeguard recognised under UK data-protection law. This may include UK adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses. Further information is available on request.
How long it is kept
- Enquiries: kept while the conversation is active; archived for up to twelve months afterwards; then deleted.
- Engagement contracts and commercial records: kept for six years after the engagement closes.
- Financial records (invoices, receipts, tax records): kept for six years plus the current year, as HMRC requires.
- Project working files: returned to the client or deleted within twelve months of the engagement closing, unless a longer period has been agreed.
- Server logs: retained by Cloudflare in line with its standard log-retention policy.
How your information is protected
Working Order uses appropriate technical and organisational measures to protect personal information. These include encrypted devices and storage, access controls, multi-factor authentication, and secure handling of credentials. Access is limited to those who need it to deliver the relevant work, including the authorised service providers listed above where necessary.
Automated decision-making
Working Order does not carry out automated decision-making or profiling.
Your rights
Under UK GDPR you can ask for a copy of your information, ask for it to be corrected or deleted, ask that its use be restricted, or ask for it in a portable form. These rights depend on the circumstances and are not all absolute.
To exercise any right, write to hello@workingorder.systems. A response will follow within one month (with the limited extension the law allows in more complex cases).
Complaints
If something about how your information is being handled worries you, please raise it with me first at hello@workingorder.systems. Most things resolve directly. If that does not settle it, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint.
Cookies
This site does not use analytics, advertising or other non-essential cookies. If any are added later, this notice will be updated first.
Updates
Last updated: 28 August 2026. Any material change will show a revised date here.