legal

GDPR & Your Rights

Last updated: 29 March 2026 · Dominic Cushnan, trading as Wrenlist, complies with UK GDPR and the Data Protection Act 2018.

Wrenlist is committed to your privacy. We collect only what we need, store it securely, and give you full control over your data. If you have any questions, email admin@wrenlist.com — we aim to respond within 3 working days.

Your 7 rights under UK GDPR

Right of access

You can request a copy of all personal data we hold about you. We will provide this within 30 days. Export your data directly from Settings → Export Data, or email admin@wrenlist.com.

Right to rectification

You can correct inaccurate personal data at any time via Settings → Profile. For data you cannot edit yourself, email us and we will correct it within 30 days.

Right to erasure ("right to be forgotten")

You can delete your account and all associated data from Settings → Delete Account. Inventory data is purged within 30 days; billing records are retained for the period required by HMRC as a matter of law.

Right to data portability

You can download all your inventory and sales data in CSV format from Settings → Export Data at any time. Account data can be exported as JSON on request.

Right to restrict processing

You can ask us to restrict how we process your data (for example, while a dispute is being resolved). Email admin@wrenlist.com with your request.

Right to object

You can object to processing based on legitimate interests, including the use of anonymised data to improve Wren AI. Unsubscribe from marketing emails at any time via the link in each email or via Settings → Notifications.

Rights related to automated decision-making

Wrenlist does not make any automated decisions with legal or significant effects about you. Wren AI suggestions are advisory only — you always make the final decision.

How to exercise your rights

Most data actions (export, delete) are available directly in Settings → Export Data. For anything else, email admin@wrenlist.com with the subject line "Data Rights Request". We will respond within 30 days. We may ask you to verify your identity before processing sensitive requests.

Complaints to the ICO

If you are not satisfied with how we have handled your data, you have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator:

Information Commissioner's Office
Website: ico.org.uk · Phone: 0303 123 1113
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

You can make a complaint online at ico.org.uk/make-a-complaint. We encourage you to contact us first — most issues can be resolved quickly and informally.

Data security

We use industry-standard security measures including TLS encryption in transit, encrypted data at rest via Supabase (AWS), and strict access controls. We conduct regular security reviews. In the event of a data breach that poses a risk to your rights, we will notify you and the ICO within 72 hours as required by UK GDPR.

Contact our Data Protection contact

Email: admin@wrenlist.com
Data controller: Dominic Cushnan (sole trader), trading as Wrenlist, England & Wales. Registered with the UK ICO.
Response time: 3 working days for queries, 30 days for formal rights requests.