Privacy Policy
Last updated: 5 November 2026
Draft for legal review. This document has been prepared to UK standards but has not yet been reviewed or approved by a qualified solicitor. Items highlighted like this are facts we have not been able to verify and must be completed before publication.
1. Who we are
The controller of personal data collected through this website is IronLedge Ltd (trading as IronLedge), company number 14876824, registered office International House, 36-38 Cornhill, London, United Kingdom, EC3V 3NG.
ICO registration number: [ICO registration number: to be confirmed]. Privacy contact [DPO or privacy contact email: to be confirmed]. We have not confirmed whether we are required to appoint a Data Protection Officer; if we are, their details will appear here.
2. Scope of this policy
This policy covers personal data we collect through this website: when you send us an enquiry, browse the site, or use the admin features if you are our staff. It does not cover personal data processed through the IronLedge platform (for example bank account data that a customer shares with a platform customer). Where we act on behalf of a customer in that setting, the customer's own privacy notice and our contract with them apply. [Confirm controller/processor roles for platform data and add a link to the platform privacy notice: to be confirmed]
3. The personal data we collect
| Source | Data |
|---|---|
| Contact form | First and last name, work email address, company, role, enquiry type, your message, the time of submission and a record that the privacy notice was shown. |
| Email you send us | Your email address, name, content and any attachments. |
| Technical data | IP address, browser type, pages requested and timestamps in server and security logs. IP addresses are also used briefly to limit repeated form submissions. |
| Browser storage | Your cookie choice and whether you dismissed an announcement. See section 10. |
We do not ask for, and you should not send us, special category data, bank login details, card numbers or passwords.
4. How and why we use it
| Purpose | Lawful basis (UK GDPR Article 6) |
|---|---|
| Reply to your enquiry and arrange a demo or call | Legitimate interests (responding to people who contact us) and, where you ask about entering a contract, steps taken at your request before a contract. |
| Keep the website secure, prevent abuse and spam, and fix faults | Legitimate interests (security and reliability of our systems). |
| Manage and improve the website content | Legitimate interests. |
| Marketing emails to you | We do not add you to marketing lists from a contact form. If we later offer a newsletter we will ask for your consent (or rely on the PECR "soft opt-in" for business contacts where it applies) and you can opt out at any time. |
| Comply with legal obligations and defend legal claims | Legal obligation and legitimate interests. |
We balance our legitimate interests against your rights. You can ask us how, using the contact details below. We do not make decisions about you using solely automated processing.
5. Who we share it with
We share personal data only where needed and under contracts that require appropriate protection:
- our hosting and infrastructure providers: [Name hosting provider and region: to be confirmed];
- our email, CRM or ticketing providers, if the contact form webhook is connected: [Name CRM or email processor, or state none: to be confirmed];
- professional advisers (lawyers, accountants, insurers) where necessary;
- regulators, law enforcement or courts if the law requires or permits it.
We do not sell personal data.
6. International transfers
We aim to keep personal data in the United Kingdom or in countries covered by UK adequacy regulations. If a provider processes data outside the UK, we will use a lawful transfer mechanism such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. [Confirm provider locations and transfer mechanisms: to be confirmed]
7. How long we keep it
| Data | Proposed retention |
|---|---|
| Contact form enquiries that do not lead to a contract | [Proposed: 12 months from last contact, to be confirmed: to be confirmed] |
| Enquiries that lead to a customer relationship | Held under the customer contract terms and our records policy. |
| Server and security logs | [Proposed: up to 90 days, to be confirmed: to be confirmed] |
| Browser storage items | Until you clear them, as described in the Cookie notice. |
8. Your rights
Under UK data protection law you have the right to: be informed about how we use your data; access a copy of it; have inaccurate data corrected; have data erased in certain cases; restrict or object to some processing (including processing based on legitimate interests); data portability in certain cases; and withdraw consent at any time where we rely on it. You will not be charged a fee unless a request is manifestly unfounded or excessive. We aim to respond within one month. To exercise a right, contact us. We may need to verify your identity first.
9. Security
We use measures appropriate to the risk, including access controls on the admin area (password-protected, signed session cookie, rate limiting), restricted access to submitted enquiries and transport encryption (HTTPS) when the site is deployed. No system is perfectly secure. If a personal data breach is likely to result in a risk to your rights and freedoms we will notify the ICO within 72 hours where required and tell you when the law requires it.
10. Cookies and similar technologies
We use only strictly necessary storage today and no analytics or advertising cookies. Details are in our Cookie notice.
11. Children
This website is for businesses and professionals and is not directed at children. We do not knowingly collect personal data from anyone under 16.
12. Complaints
Please contact us first so we can try to put things right. You also have the right to complain to the Information Commissioner's Office, the UK data protection regulator: ico.org.uk/make-a-complaint.
13. Changes
We may update this policy. The current version is always on this page with its "last updated" date. If a change is significant we will make that clear.
14. Contact
Privacy requests and questions: info@ironledge.co.uk, or our Contact page.
Questions about this document? Contact us.