Privacy Policy

Last updated: October 2026 · TreeKey is a trading name of Nicholas Michael Secular, a sole trader

1. Who We Are

TreeKey ("we", "us", "our") operates the website treekey.co.uk and the lead-generation service described in our Terms of Service. TreeKey is a trading name of Nicholas Michael Secular, a sole trader, who is the data controller for the personal data described below. Our correspondence address (a PO Box) is Nicholas Secular / TreeKey, Unit 173384, PO Box 7169, Poole, BH15 9EL. For privacy matters, contact support@treekey.co.uk.

2. The Two Kinds of Personal Data We Handle

2.1 Customer data — information about you, our paying customer: name, business name, email, phone number, billing details (processed by Stripe), and your usage of the Service.

2.2 Lead data — information about a third party named in a Lead: typically a planning applicant's or agent's name, sourced from public UK council planning records, and in some cases a business or director name sourced from Companies House. This is data about people who are not our customers and have not signed up to anything.

3. Our Lawful Basis for Processing Lead Data

We process Lead data on the basis of legitimate interests under UK GDPR Article 6(1)(f): our commercial interest in aggregating publicly available planning and company data into a usable directory for tree surgery and arboricultural businesses. A person named in Lead data has the right to object to this processing (Section 8) — where someone objects, we stop processing their data for this purpose unless we can demonstrate compelling legitimate grounds that override their interests, or the data is needed for a legal claim.

4. What We Use Personal Data For

• Operating and improving the Service (both kinds of data);
• Providing customer support and processing payments (customer data);
• Compiling, classifying, and displaying Leads to subscribed customers (Lead data);
• Sending customers service-related communications and, where not opted out, marketing about the Service;
• Complying with our legal obligations (e.g. tax, accounting).

We do not use Lead data to build profiles about the individuals named in it beyond what's needed to classify a Lead's relevance.

5. Where Lead Data Comes From

UK local council planning application registers, Companies House (available under the Open Government Licence), and, where used, publicly listed business contact details. We do not purchase Lead data from private data brokers or scrape data that is not otherwise publicly accessible.

6. Who We Share Data With

• Stripe (payment processing) — customer payment and billing data.
• Render (hosting) — the application and database run on Render's infrastructure.
• Intelliprint (printing and posting) — the homeowner's name and postal address and the content of the letter, so that the letter can be printed and handed to Royal Mail for delivery.
• Royal Mail (delivery) — the postal address on the letter.
• Our customers — Lead data is disclosed to subscribing customers as the core of the Service.

We do not sell personal data to data brokers or advertisers. We do commercially license access to Lead data as the Service itself — stated plainly here, not denied.

7. International Data Transfers

Some of our processors (including Stripe and Render) may process data outside the UK. Where this happens, transfers are protected by the UK's International Data Transfer Addendum to the EU Standard Contractual Clauses, or an equivalent lawful transfer mechanism, as provided by each processor's standard terms.

8. Your Rights

Both customers and individuals named in Lead data have the right, under UK GDPR, to: request access to the personal data we hold about them; request correction of inaccurate data; request erasure ("right to be forgotten"), subject to our legal bases for retaining it; object to processing based on legitimate interests (Section 3); request restriction of processing in certain circumstances; and lodge a complaint with the Information Commissioner's Office (ico.org.uk).

To exercise any of these rights, email support@treekey.co.uk. If you have a TreeKey account, you can also sign in and use the request form at the bottom of My Account (“Close account / request data deletion”). The form only submits a request: it does not delete anything or cancel a subscription by itself, and we review every request by hand.

We will respond to a rights request without undue delay and at the latest within one month of receiving it (counted from when we have any information we reasonably need to confirm who you are). If a request is complex, or you make several, we may extend that by up to two further months, and we will tell you within the first month if we do. Responding means telling you what we have done, or will do, and why if we cannot do something; some records (for example payment and accounting records, and suppression records that stop us contacting someone again) may have to be kept. You can complain to the Information Commissioner’s Office (ico.org.uk).

9. Data Retention

Lead data for a planning application that is never purchased is permanently deleted after 60 days.

Once a Lead is purchased and a physical letter to the homeowner is dispatched, the homeowner's name, home address, and the personalised letter content are permanently deleted from our live application database once 72 hours have passed since our mailing provider confirmed that the letter had been handed to Royal Mail for delivery (our system records the time at which it sees that confirmation). This is carried out by an automated process that checks for newly-eligible records approximately every 20 minutes, so in normal operation deletion happens within minutes of the 72-hour mark, not after a further delay. If our systems are briefly unavailable (for example during a deployment or an outage), the check resumes as soon as service is restored and deletes anything that became eligible in the meantime -- so we do not guarantee deletion at the exact 72-hour mark in every circumstance, only that it is not left to a manual or indefinite process. A minimal record of the transaction (payment reference, dispatch confirmation, and any postal-suppression request) is kept for accounting, complaint-handling, and legal purposes; we have not yet set a fixed expiry for that minimal record.

This deletion applies to our own live application database. It does not, and cannot, reach: routine backups of that database, which persist on their own separate schedule until they age out or are overwritten; records our mailing provider keeps of a letter it has already printed and posted (see the next paragraph); or the physical letter itself once it has reached the homeowner's postal address. We do not control those systems and do not claim to delete data from them.

Our mailing provider, Intelliprint, has told us in writing that it keeps the PDF of each letter for 90 days from the date the print job is confirmed, and that its separate recipient and letter records have no automatic deletion period. It has told us those records can be deleted on request, subject to legal requirements. We have not been given a provider deletion guarantee beyond that. If you want your information deleted from those provider records, email support@treekey.co.uk and we will ask the provider to delete it, subject to those legal requirements.

Customer account data is retained for the life of the account. We do not currently operate an automated deletion process for billing records or for data belonging to a closed account.

10. Security

We take reasonable technical and organisational measures to protect personal data: encrypted (HTTPS) connections throughout the Service; account sessions secured with signed, tamper-evident tokens rather than plain credentials; no customer passwords are stored at all (login uses a one-time emailed link, so there is no password database to be breached); and administrative and automated-scan functions are protected by a separate access secret, not exposed publicly.

11. Cookies

Tree Key sets one strictly necessary cookie: a signed session cookie (treekey_contractor_session) used solely to keep you logged in, marked HttpOnly, Secure, and SameSite=Lax. This is a strictly necessary cookie required for the Service to function, so under UK PECR rules it does not require a cookie consent banner.

If you press Accept on our cookie banner, we also use Google Analytics, which sets analytics cookies (such as _ga) to show us how many people visit TreeKey and which pages they use. These cookies are off unless you accept, and nothing is sent to Google before then. Your choice is stored in your browser; clear your browser data for this site to be asked again.

12. Children

The Service is intended for business use and is not directed at children. We do not knowingly collect personal data from children.

13. Changes to This Policy

We may update this policy from time to time; material changes will be reflected by an updated "last updated" date, and significant changes affecting Lead data subjects' rights will be communicated where practical.

14. Contact

Privacy questions or requests regarding this policy: support@treekey.co.uk.

← Back to Home