Privacy policy

This policy covers personal data we process through our public website, our contact and enquiry forms, and any direct communication you start with us by email.

Engagements with clients are governed by a separate written agreement and, where relevant, a data processing agreement. Those documents take precedence for client-specific processing activities.

We only collect data you give us, plus a small amount of technical data needed to run the site.

We use a small number of strictly necessary cookies to run the site. Any non-essential cookies load only after you opt in.

You can change your preferences at any time from the cookie settings panel, also linked from the footer.

We share data only with service providers that help us run the site. They act as processors under written agreements that meet GDPR requirements. We do not sell personal data.

• Form processor: [FORM PROCESSOR] receives contact form submissions on our behalf.
• Email host: [EMAIL PROVIDER] hosts our inbox and routes replies to you.
• Analytics: [ANALYTICS PROVIDER] produces aggregated usage reports.
• Hosting and CDN: [HOSTING PROVIDER] serves the site and stores access logs.

Where a provider processes personal data outside the European Economic Area, we rely on the European Commission Standard Contractual Clauses and, where needed, supplementary technical and organizational measures to keep your data protected at an essentially equivalent level.

We use commercially reasonable measures to protect personal data, including:

• Encryption in transit using TLS for all site traffic
• Access controls and unique accounts for team members who handle data
• Logging and monitoring to detect unusual activity
• Regular review of subprocessors and their security posture
• A documented process to handle data subject requests and incidents

If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours of becoming aware of it, as required by Art. 33 GDPR. Where the breach is likely to result in a high risk, we will also notify affected users without undue delay, as required by Art. 34 GDPR.

You have the right to:

• Be informed about how we process your data, which is what this policy is for.
• Access the personal data we hold about you.
• Rectification of inaccurate or incomplete data.
• Erasure of data we no longer need to keep.
• Restriction of processing in specific situations.
• Object to processing based on legitimate interest.
• Portability of data you provided to us, in a structured machine-readable format.

To exercise any right, email [DPO EMAIL]. We respond within one month. You also have the right to lodge a complaint with [SUPERVISORY AUTHORITY] or with the supervisory authority in your country of residence.

This site is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at [DPO EMAIL] and we will delete it.

We may update this policy as our service or applicable law changes. The dates at the top of the page reflect the latest version. For material changes we will provide a clearer notice on the site.

For any privacy question or request, please use the details below.

You can also review our terms and conditions.