Privacy notice

Last updated July 2026

Who we are

This portal is operated by Hestora [CONFIRM legal entity name, company number and registered address]. We are the data controller for the personal data described here. If you have a question about this notice, contact us at privacy@hestora.net.

What we collect

When you ask for access to the portal, we collect:

• your name;
• your work email address;
• your company name;
• a short description of your role;
• your phone number, if you choose to give it (optional).

Once you have access, we also hold a record that your account exists, which company it belongs to, and when you last signed in.

Why we collect it, and our lawful basis

We use these details to assess and administer access to the portal — deciding whether to grant access, linking you to your company, and keeping the account list current. Our lawful basis is legitimate interests: running a controlled-access technical resource for trade partners, and knowing who has access to it. We judge this to have a minimal privacy impact, because the data is business-contact information, provided by you, and used only for the purpose you provided it for.

We do not use your details for marketing, and we do not sell or share them for anyone else's marketing.

Who else sees it

We use a small number of service providers to run the portal:

• WorkOS — our identity provider. It handles sign-in and holds your email address and name. We never see or store your password; in fact the portal has no passwords at all.
• Resend — sends the emails involved in approving access.
• Fly.io — hosts the application and its database.

We do not use analytics, advertising or third-party tracking scripts on this portal.

How long we keep it

• Access requests — deleted automatically 12 months after they are made, whether they were approved or rejected.
• Account records — kept while your access is live, and for a reasonable period afterwards so we have a record of who had access to what. Ask us and we will remove yours.
• Administrative audit records — we keep a log of access being granted or withdrawn, which includes the email address concerned. This is what lets us answer "who had access, and when".

Your rights

You can ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, or object to our using it. Email privacy@hestora.net and we will respond within one month.

Because our basis is legitimate interests, you have the right to object to that use. If you object, we will usually have to close your portal account, since we cannot administer access without knowing who has it.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk.

Cookies

See our cookie notice — in short, one essential sign-in cookie and nothing else.