Privacy policy
How TopNotch collects, uses and protects personal data. Last updated October 29, 2026.
Who we are
This website is operated by Top Notch Ltd., PO Box 260, Erie, CO 80516 ("TopNotch," "we," "us"). We are the data controller for the personal data described in this policy. You can contact us about privacy at contact@topnotchltd.com
Summary
- We collect personal data only when you contact us (through our form or by email) or subscribe to our newsletter.
- This website does not use cookies, analytics, advertising trackers or social media plugins.
- Our fonts are hosted on our own server, so loading a page does not send your data to third parties.
- We never sell your personal data.
What we collect and why
When you contact us
If you use our contact form or email us, we collect your name, email address, company name (optional), the service and timeline you select, and the content of your message. We use this to reply to your inquiry and, if you ask us to, to prepare a proposal.
Legal basis: taking steps at your request before entering into a contract (Article 6(1)(b) GDPR) and, for general inquiries, our legitimate interest in responding to people who contact us (Article 6(1)(f) GDPR).
When you subscribe to our newsletter
If you sign up for our newsletter, we collect your email address and use it only to send you our newsletter: occasional articles and updates about QA, test automation and AI. We do not share it with anyone except the service that sends our emails.
Legal basis: your consent (Article 6(1)(a) GDPR). You can withdraw it at any time using the unsubscribe link in any newsletter, or by emailing us.
When you visit the website
Like all websites, our hosting provider automatically processes technical data needed to deliver pages securely, such as your IP address, browser type, the page requested and the time of the request. These server logs are used only to operate and secure the website.
Protecting our contact form
When you send the contact form, our server checks it before it is delivered: it removes code and hidden characters, checks the details are complete and valid, and screens for offensive language. To stop automated spam, it also counts recent submissions using an anonymized code derived from your IP address, which is deleted after one hour.
Legal basis: our legitimate interest in keeping the website and our inbox secure and free of abuse (Article 6(1)(f) GDPR).
Legal basis: our legitimate interest in running a secure, working website (Article 6(1)(f) GDPR).
Cookies and similar technologies
This website does not set any cookies and does not use local storage, tracking pixels or analytics. Because nothing is stored on your device, we do not show a cookie banner. If this changes, we will update this policy and ask for your consent where required before using any non-essential cookies.
Who we share data with
We share personal data only with service providers that help us run this website and our business, under contracts that require them to protect it and use it only on our instructions:
- Website hosting: Hetzner Online GmbH, Germany, which provides the server we run the website on. The server serves the website, runs our contact form checks and keeps server logs. It is located in Hetzner's data center in Hillsboro, Oregon, USA.
- Email: Google, USA, which hosts our business email (Google Workspace) and delivers contact form submissions to us after our own server has checked them.
- Newsletter: Mailchimp (Intuit Inc, USA), which stores subscriber email addresses and sends our newsletter.
We may also disclose data where required by law.
International transfers
Some of our providers are located outside the European Economic Area and the United Kingdom, including in the United States. Where this happens, we rely on an adequacy decision (such as the EU-U.S. Data Privacy Framework, where the provider is certified) or on the European Commission's Standard Contractual Clauses to protect your data.
How long we keep data
- Inquiries: up to 12 months after our last contact, unless you become a client, in which case we keep records for as long as needed for the engagement and our legal obligations.
- Newsletter subscribers: until you unsubscribe. We then keep only a record that you unsubscribed, so we don't email you again.
- Server logs: no longer than 7 days, unless needed to investigate a security incident.
- Spam protection: to limit abuse, our server keeps a one-way, anonymized code derived from your IP address (not the address itself) and the time of each form submission, for one hour.
Your rights
Under the GDPR and UK GDPR, you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased;
- restrict or object to how we use your data, including where we rely on legitimate interests;
- receive your data in a portable format;
- withdraw consent at any time, where we rely on consent.
To exercise any of these rights, email contact@topnotchltd.com We will respond within one month. You also have the right to complain to a data protection authority, in particular in the country where you live or work.
Automated decisions
We do not make decisions about you based solely on automated processing, including profiling.
Security
This website is served only over encrypted HTTPS connections. We limit access to personal data to people who need it, and we require the same of our service providers.
Changes to this policy
We may update this policy from time to time. The date at the top of this page shows when it was last changed.