Privacy Policy
Last updated: [DATE OF PUBLICATION]
1. Who we are
The data controller for personal data collected through this Site is:
- [COMPANY LEGAL NAME]
- Address: [REGISTERED ADDRESS]
- Email: [CONTACT EMAIL]
- Telephone: [PHONE NUMBER]
- Legal representative: [FIRST NAME LAST NAME]
See also the Legal Notice / Imprint.
2. Data Protection Officer (DPO)
- Status: [the company has not appointed a DPO / has appointed a DPO]
- Contact: [DPO EMAIL]
3. What data do we collect and why?
We collect only the data necessary for the purposes described below.
3.1. Hosting, CDN and security logs
- Data: IP address, User-Agent, requested URL, HTTP response code, timestamp.
- Purpose: delivering the Site (CDN), security (anti-DDoS, anti-bot), incident diagnosis.
- Legal basis: legitimate interest (Art. 6.1.f GDPR) in providing a reliable, secure service.
- Processor: Cloudflare, Inc.
- Retention: [TO COMPLETE — e.g. 30 days for Cloudflare security logs].
3.2. Analytics
- Data: pages visited, interaction events, session ID, timestamp, IP anonymisation.
- Purpose: understanding how the Site is used and improving content.
- Legal basis: consent (Art. 6.1.a GDPR) — non-essential analytics are disabled until you accept “Analytics” cookies.
- Processor: PostHog (Cloud EU).
- Retention: [TO COMPLETE — e.g. 13 months].
- Transfers outside the EEA: PostHog Cloud EU stores data in EU data centres; no transfer to third countries is performed on our behalf.
3.3. Cookies
See our Cookie Policy. No non-essential cookies are set without consent.
3.4. Contact and lead forms
- Data: name, email, message, any further information you choose to share.
- Purpose: responding to your enquiry, discussing a potential engagement.
- Legal basis: pre-contractual / contractual steps (Art. 6.1.b GDPR) or legitimate interest (Art. 6.1.f GDPR) for sales follow-up.
- Processors: [TO COMPLETE — form and email vendors].
- Retention: [TO COMPLETE — e.g. 3 years from last contact].
4. Who receives your data?
Your data is processed exclusively by:
- the Site publisher (and any internal sub-team),
- our technical processors listed in the sub-processor list.
No transfer is made for commercial or marketing purposes.
5. International transfers
| Processor | Location | Safeguards |
|---|---|---|
| Cloudflare, Inc. | United States | EU-US Data Privacy Framework adequacy decision + Standard Contractual Clauses |
| PostHog (Cloud EU) | European Union (e.g. Germany, Ireland) | No transfer outside the EEA on our behalf |
Whenever this list changes, we update this page.
6. How long do we keep your data?
| Type of data | Retention period |
|---|---|
| Hosting / security logs | [TO COMPLETE] |
| Analytics data (PostHog) | [TO COMPLETE — e.g. 13 months] |
| Contact enquiries | [TO COMPLETE — e.g. 3 years] |
After these periods, data is deleted or irreversibly anonymised.
7. Sub-processors
| Processor | Service | Data location | Policy |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, CDN, security | Worldwide (EU + US) | cloudflare.com/gdpr/subprocessors/cloudflare-services |
| PostHog, Inc. | Product analytics | Cloud EU | posthog.com/dpa |
| [TO COMPLETE] | Email / forms | [TO COMPLETE] | [TO COMPLETE] |
8. Your rights
Under the UK GDPR / EU GDPR, you have the following rights at any time:
- Right of access (Art. 15)
- to know what data we hold on you and obtain a copy.
- Right to rectification (Art. 16)
- to correct inaccurate or incomplete data.
- Right to erasure (Art. 17)
- to request deletion, subject to our legal obligations.
- Right to restriction (Art. 18)
- to temporarily freeze the use of your data.
- Right to portability (Art. 20)
- to receive your data in a structured, machine-readable format.
- Right to object (Art. 21)
- to object to processing based on legitimate interest or profiling.
- Right to withdraw consent (Art. 7.3)
- without affecting the lawfulness of prior processing.
- Right to lodge a complaint
- with a supervisory authority (see §9).
To exercise your rights, contact us at [CONTACT EMAIL] with proof of identity. We will respond within one month of receiving your request (extendable by two further months for complex requests).
9. Complaint to a supervisory authority
If, after contacting us, you believe your rights are not being respected, you may lodge a complaint with the competent supervisory authority:
- United Kingdom: Information Commissioner’s Office (ICO) — Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF — https://ico.org.uk/make-a-complaint/
- France / EU: CNIL — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — https://www.cnil.fr/fr/plaintes
If you reside in another EU Member State, you may lodge a complaint with your national supervisory authority.
10. Automated decision-making
None of our processing produces decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR).
11. Security
We implement appropriate technical and organisational measures to protect your data (HTTPS/TLS 1.3 encryption, authentication, logging, backups, access control). Despite these measures, no system is perfectly secure; we cannot guarantee absolute security.
12. Changes to this policy
This policy may be updated to reflect our practices and regulatory developments. The date of the last update is shown at the top of this page. For material changes, we will notify you through an appropriate channel.
13. Contact
For any question about this policy or your personal data, contact us at [CONTACT EMAIL].