Privacy Policy
Last updated: 16 July 2026
This is a starter template. Replace every [bracketed] placeholder with your real details and have it reviewed by legal counsel before relying on it.
1. Who we are (Data Controller)
The controller responsible for your personal data is [Company legal name], [Address], [Country]. Registration number: [Registration no.]. You can reach us about data protection at [email protected].
2. What data we collect and why
We only collect personal data you actively provide, plus the minimum our servers need to operate securely.
Contact form — your name, email address, message, and the IP address the request came from. We use this to answer you and to guard the form against spam and abuse.
Customer document access — your name, email address and phone number, so we can review your request and email you a private access link.
Technical logs — standard server logs (IP address, timestamp) kept briefly for security.
3. Legal basis for processing
Consent (Art. 6(1)(a) GDPR) — when you tick the box to submit the contact or access-request form.
Legitimate interests (Art. 6(1)(f) GDPR) — securing our website and preventing abuse.
Performance of a contract / steps prior to a contract (Art. 6(1)(b) GDPR) — handling your enquiry or document-access request.
4. How long we keep it
We keep contact messages and account records for no longer than necessary — normally [retention period, e.g. 24 months] — and then delete them. You can ask us to erase your data sooner at any time (see section 6).
5. Who we share it with
We do not sell your data. We share it only with service providers that help us run the site (for example our hosting provider [hosting provider] and our email provider [email/SMTP provider]), each acting as a processor under a data-processing agreement. We do not transfer your data outside the EU/EEA unless a lawful transfer mechanism is in place.
6. Your rights
Under the GDPR you have the right to: access your data, correct it, erase it ("right to be forgotten"), restrict or object to processing, and receive your data in a portable format. Where processing is based on consent, you may withdraw that consent at any time.
To exercise any of these rights, email us at [email protected], or use our data removal page to request erasure of your data. We respond within one month.
You also have the right to lodge a complaint with your local data protection authority.
7. Cookies
See our Cookie Policy for details of the cookies and local storage this site uses and how to control them.
8. Changes to this policy
We may update this policy as our practices or the law change. The "last updated" date above always reflects the current version.