Privacy policy

Last updated 12 November 2026

This policy explains what personal data JSA Group Ltd collects through High Street HQ, why, how long we keep it and what your rights are. It covers this website, businesses that use High Street HQ, and the customers of those businesses.

Who we are

High Street HQ is run by JSA Group Ltd, a company registered in England and Wales, company number 16494212, based in Upminster, Essex. For any privacy question, or to use any of your rights, email admin@jsagroupltd.co.uk.

Two different roles

• Businesses that use High Street HQ, and visitors to this site. For your details (name, business, contact and billing details, and how you use the service) we are the data controller.
• Customers of those businesses. When you message, order from, book with or pay a shop that uses High Street HQ, that shop is the data controller for your details and we act as its processor, handling the data only to run the service for it and under a written agreement. Please contact the shop first about your data. If you can't reach them, contact us and we will help.

What we collect

• Enquiries. If you ask about a place, we receive what you send: your name, business, town, phone number and message.
• Business accounts. Contact details of the owner and staff who use the service, billing details, and settings.
• Shop customer data, on a shop's behalf. Names, phone numbers, email addresses, messages sent to the shop, orders, bookings and payment status. We do not see or store full card or bank details; those are handled by Stripe or GoCardless.
• Technical data. IP address, browser and request times, kept to secure the service and stop abuse.

This website does not use cookies, analytics or advertising trackers.

Why we use it, and our lawful basis

• To answer enquiries: our legitimate interest in replying, or steps you asked us to take before a contract.
• To provide, support and bill High Street HQ for businesses: performing our contract with them.
• To process shop customer data: on the instructions of the shop, which is responsible for having its own lawful basis.
• To keep the service secure and keep tax records: our legitimate interests and legal obligations.

We never sell personal data. We do not use shop customer data for our own marketing.

Automated replies

High Street HQ uses AI to answer messages for a shop, based on the information the shop provides. It does not make decisions with legal or similarly significant effects about anyone. Conversations can be passed to a person at the shop at any time, and you can always ask to speak to someone.

Who we share it with

Only the providers we need to run the service, each under its own data protection terms:

• Amazon Web Services and Cloudflare, for hosting. Our servers are in the United Kingdom.
• Meta (WhatsApp Business Platform), to send and receive WhatsApp messages for a shop.
• Stripe and GoCardless, to take card, bank and Direct Debit payments for a shop. Payments go into the shop's own account with them.
• OpenAI, to generate automated replies. Message content is sent to produce a reply and is not used by them to train their models under our business terms.
• Xero, when a shop chooses to connect its accounts.
• Microsoft 365, for our email, and Google Fonts, which supplies this site's typefaces.
• Our accountants and professional advisers, where needed.

Some providers may process data outside the UK. Where they do, they rely on safeguards recognised under UK law, such as the UK International Data Transfer Agreement or adequacy regulations.

How long we keep it

• Enquiries that do not lead to a sign-up: up to 24 months from last contact.
• Business account and billing records: while the account is open, then 6 years for tax and accounting.
• Shop customer data: as long as the shop uses High Street HQ, or less if the shop deletes it. When a shop leaves, we give it a copy and delete it from our systems within 90 days, except where the law requires us to keep it.
• Security logs: up to 12 months.

How we protect it

Data is encrypted in transit, each shop can only see its own data, access is limited to people who need it, and backups are encrypted.

Your rights

Under UK data protection law you can ask for a copy of your data, ask us to correct or delete it, object to or restrict how we use it, and ask for it in a portable format. Email admin@jsagroupltd.co.uk and we will reply within one month. If you are a shop's customer, we will pass your request to that shop where it is theirs to answer. You can also complain to the Information Commissioner's Office at ico.org.uk, though we would appreciate the chance to put it right first.

Changes

If we change this policy we will update the date at the top of the page, and tell businesses using the service about any significant change.