1. Lawful processing

We process personal data only where a valid legal basis exists under the GDPR. In practice on this website that mainly means: responding to your contact request (for example steps at your request prior to a contract, or our legitimate interest in answering enquiries), compliance with legal obligations where they arise, and for Google Analytics the basis set out in our Cookie Policy (such as consent and/or legitimate interest, depending on configuration and your country). We do not process special categories of data through the contact form unless you choose to include them in your message.

2. Data minimisation and storage limitation

We do not ask for more information on the website than the contact form fields (name, email, phone, subject, message). We do not require an account. We retain contact messages only as long as needed to deal with your enquiry and any legal duties, and analytics data is handled under Google’s retention tools and our settings.

3. Security of processing

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage.

4. Processors and transfers

Our website is hosted on infrastructure that may involve subprocessors (for example hosting providers). Google acts as a separate provider for Google Analytics under its own terms. We choose providers with appropriate safeguards where the GDPR requires them. Further context is in our Privacy Policy.

5. Rights of data subjects

We respect the rights granted by the GDPR, including:

• Information about processing and access to your data.
• Rectification and erasure where applicable.
• Restriction of processing and objection where applicable.
• Data portability where applicable.
• Rights related to automated decision-making: we do not use solely automated decisions with legal or similarly significant effects about visitors based on browsing or the contact form.

6. Personal data breaches

In the event of a personal data breach likely to result in a risk to rights and freedoms, we will assess the situation and, where required, notify the supervisory authority and affected data subjects without undue delay, in line with the GDPR.