Privacy policy
1. Who we are
This policy explains how Tocsin, run by Espresso Group Ltd (company number 16232595, registered office Suite 8, Bourne Gate, 25 Bourne Valley Road, Poole, Dorset, BH12 1DY), handles personal information. Contact: support@tocsin.co.uk.
Our role depends on the information:
- For sign-in and billing details of the people who use your account, we are the controller.
- For the details of people you ask us to alert, and the content of alerts, you are the controller and we are your processor, acting on your instructions.
2. What we collect
| Information | What it is | Where it comes from |
|---|---|---|
| Account details | Name of your organisation, sign-in email address, role, and the temporary and chosen password (stored securely by our sign-in provider, never visible to us) | You, or the person who invited you |
| Responders | Names, email addresses and mobile phone numbers of people you set up to be alerted | You |
| Alerts | The text of each alert (title, details, source, severity) and what happened to it: who was told, when, and who acknowledged or resolved it | Your monitoring tools, emails you forward, and your team |
| Delivery records | For each text, call or email: the number or address, time, result and any error | Generated by the service and our delivery providers |
| Replies | Texts sent back to Tocsin (for example “ACK”) and keys pressed during calls | The person who replies |
| Usage | Monthly counts of texts, calls and emails sent, and credit balance | Generated by the service |
| Email sent to your inboxes | The message sent to your Tocsin alert address, which becomes an alert | Your monitoring tools |
| Technical information | IP address and request details in our service logs, used for security and fixing problems | Your browser or tool |
We do not use advertising or analytics cookies or trackers on our website or dashboard. The dashboard stores your sign-in session in your browser so you stay signed in, which it needs in order to work.
3. Why we use it, and our legal basis
- To provide Tocsin to you: sending alerts and managing accounts. (Contract.)
- To keep the service secure and working: preventing misuse, finding faults, limiting abuse. (Our legitimate interests.)
- To bill you and keep financial records. (Contract and legal obligation.)
- To contact you about your account, changes and support. (Contract and legitimate interests.)
We do not sell personal information, and we do not use it for advertising or to train artificial intelligence models. Our staff can see account details, usage and recent alert activity so that we can provide support, keep the service running and deal with misuse. Staff sign in with a separate login and an authenticator code, and every time they look at an account is recorded.
4. Who we share it with
We use these providers to run Tocsin. They handle information only to provide their service to us.
| Provider | What for | Where |
|---|---|---|
| Amazon Web Services | Hosting, database, sign-in, email sending and receiving | London (eu-west-2) |
| Twilio | Sending texts and making phone calls, and receiving replies | United States (Twilio’s US1 region). Phone numbers and message text pass through Twilio and your mobile network |
| Cloudflare | Domain name (DNS) records only; it does not see your content | Global |
| Google Fonts | Our website loads fonts from Google, so your browser contacts Google when you visit our pages | Global |
| Stripe | Taking card payments. Card details go straight to Stripe and we never see or store full card numbers. | Stripe’s own systems; see Stripe’s privacy policy |
We may also share information where the law requires it, or to protect people from serious harm. If our business is ever sold, your information may transfer to the new owner under the same protections.
5. Transfers outside the UK
Our main systems are in the UK (London). Twilio processes texts and calls in the United States, so phone numbers and message text are sent outside the UK. Where that happens we rely on the safeguards the UK GDPR allows, such as the UK addendum to standard contractual clauses or an adequacy decision.
6. How long we keep it
- Account, responder and alert information: for as long as your account is open. When you close your account we delete it, apart from what we must keep for legal or accounting reasons. This happens within 30 days of the account closing.
- Emails sent to your alert addresses: the raw message is deleted automatically after 7 days. The alert created from it stays with your alerts.
- Short-lived records: the record that links a phone number to a recent alert, so replies reach the right alert, is deleted after 24 hours.
- Financial records: kept for the period the law requires.
7. How we protect it
- Each organisation’s information is kept separate from every other organisation’s, and access is checked on every request.
- Data is encrypted in transit and stored in secure, access-controlled cloud systems.
- API keys are stored in a form that cannot be read back, and are shown to you only once.
- Passwords are handled by our sign-in provider and are never visible to us.
- Our provider settings and credentials are kept out of our code.
No system is perfectly secure. If a breach affects you, we will tell you and the regulator where the law requires.
8. Your rights
Under UK data protection law you can ask to see the information we hold about you, correct it, delete it, restrict or object to how we use it, and receive a copy in a portable form. To do so, email support@tocsin.co.uk. We aim to reply within one month.
If you are a person who was added to an organisation’s on-call list, the organisation that added you is the controller of your details, so please ask them first. We will help them respond.
You can also complain to the Information Commissioner’s Office at ico.org.uk. We would appreciate the chance to put things right first.
9. Stopping texts and calls
If you get alerts by text and want them to stop, ask the organisation that set up Tocsin to remove or change your number. You can also email us and we will pass the request on.
10. Children
Tocsin is a business service and is not meant for anyone under 16.
11. Changes to this policy
We will update this page when what we do changes, and tell account administrators about material changes by email or in the dashboard.