Legal
Privacy policy
What this website collects, why we collect it, who else sees it, and what you can ask us to do about it.
Last updated 30 August 2026
01
Who we are
This website is run by [LEGAL_ENTITY], registered at [REGISTERED_ADDRESS]. For everything in this policy we are the data controller — the party that decides why and how your personal data is used.
Write to [PRIVACY_EMAIL] and a human answers.
02
What this policy covers
The pages you are reading, the contact form, and the emails that follow from it.
It does not cover work we do inside a client's own systems. When we build or run something for you, data handling is set by the agreement we sign, and that agreement takes precedence over this page.
03
What we collect
Three things, and nothing else.
| Source | What it is |
|---|---|
| What you send us | Name, company, sector, email address, an optional phone number, and whatever you write in the message field of the contact form. |
| What your browser sends | Ordinary server records: IP address, browser and device type, the page requested, the page you came from, and a timestamp. Every web server keeps these. |
| What you choose | Your canvas preference (light or dark) and your answer to the cookie notice. Both stay in your browser and are never sent to us — see the cookie policy. |
We do not buy contact lists and we do not build advertising profiles. We never ask for sensitive data — health, beliefs, biometrics, financial details — so please keep it out of the message field.
04
Why we use it, and on what basis
| Purpose | Data used | Legal basis |
|---|---|---|
| Answering your enquiry and arranging a call | What you send us | Steps taken at your request before a contract — UK/EU GDPR Art. 6(1)(b) |
| Keeping the site up and resisting abuse | Server records | Our legitimate interest in a site that works — Art. 6(1)(f) |
| Seeing which pages are worth keeping | Analytics data, only if you accept it | Your consent — Art. 6(1)(a), withdrawable at any time |
| Occasional email about our work | Your email address | Your consent, asked for separately. An enquiry alone never adds you to a list. |
05
Who else sees it
The list of suppliers is short, and we name them.
| Supplier | What they do | Where |
|---|---|---|
| Vercel | Serves this site and holds the server records | [HOSTING_REGION] |
| Resend | Carries the email your enquiry becomes | [EMAIL_REGION] |
| HubSpot | Holds your contact details in our customer records so a human can follow up | [CRM_REGION] |
| Vercel Web Analytics | Counts page views, only if you accept analytics. Cookieless, and never told who you are. | [ANALYTICS_REGION] |
Each one works under a written processing agreement. We do not sell personal data and we do not share it for anyone else's marketing.
We will hand over data where the law genuinely requires it — a court order, a regulator, a legal obligation — and we will tell you unless we are forbidden to.
06
Where it goes
Some suppliers process data outside the UK and the EEA. Where they do, the transfer runs on the UK International Data Transfer Agreement or the European Commission's standard contractual clauses, with a transfer risk assessment on file. Ask at [PRIVACY_EMAIL] and we will send you the current list.
07
How long we keep it
| What | How long |
|---|---|
| Enquiries that do not become work | 24 months from your last message, then deleted |
| Enquiries that become work | For the engagement, then 7 years for tax and contract records |
| Server records | 90 days |
| Analytics data, if you accepted it | The visitor hash Vercel derives from the request is discarded after 24 hours; the aggregated counts are kept for [ANALYTICS_RETENTION] |
| Your answer to the cookie notice | 12 months, then we ask again |
08
Your rights
Under UK and EU data protection law you can ask us to:
- Show you the personal data we hold about you
- Correct anything that is wrong
- Delete it, where we have no overriding reason to keep it
- Pause the processing while a dispute is settled
- Hand it to you, or to someone else, in a portable format
- Stop processing that rests on our legitimate interests
- Withdraw a consent you gave, without affecting what came before
Write to [PRIVACY_EMAIL]. We answer within one month, free of charge. If we get it wrong you can complain to [SUPERVISORY_AUTHORITY] — though we would rather you told us first.
09
How we protect it
Access is least-privilege and reviewed: only the people who need your enquiry can open it. Traffic is encrypted in transit, and accounts carry multi-factor authentication. No system is perfect, so if a breach ever puts you at risk we will tell you and the regulator inside the deadlines the law sets.
10
Children
This site is for people doing their job. It is not aimed at children and we do not knowingly collect data from anyone under 16. If you think we have, write to [PRIVACY_EMAIL] and we will delete it.
11
Changes to this policy
When this policy changes we update the date at the top and keep the previous version on file. If a change materially affects data you have already given us, we will tell you directly rather than leave you to notice.
12
Contact
Questions, corrections, or a request about your data: [PRIVACY_EMAIL], or write to [LEGAL_ENTITY], [REGISTERED_ADDRESS].
Two documents, kept in step. If the site changes what it stores, both change with it.