Privacy Policy

This website is operated by CONFLUXUS LTD, a company registered in England and Wales (company number 17400384), whose registered office is 66 Paul Street, London, England, EC2A 4NA. CONFLUXUS LTD is the data controller for the information described below.

This policy covers our public website. Our client workspace at app.confluxus.co.uk is invitation-only and has its own privacy policy covering workspace accounts and client work.

ICO registration number: ZC227857.

Anyone can browse this site without telling us who they are. We collect personal data in two situations.

• Enquiries you send us. When you complete a contact form we receive your name, email address, the subject you choose and the message you write. These are the only fields we ask for — there is no hidden collection.
• If you email us directly. Your email address and whatever you choose to put in the message.
• Technical basics. Standard web server logs, including IP address and browser type, kept by our hosting provider for security and reliability.
• Analytics, only if you accept. See Cookies below. If you reject, no analytics cookies are set at all.

We do not run advertising or cross-site tracking, we do not buy contact lists, and we do not sell data to anyone.

We use enquiry details to respond to your enquiry — to answer your question, prepare a quote or proposal, and follow up on that conversation. Our lawful basis is legitimate interests: you contacted us about our services, and replying is what you would reasonably expect. Where responding is a step towards entering a contract with you, we rely on taking steps at your request prior to entering into a contract.

We use server logs to keep the site secure and available, which is also our legitimate interest. We use analytics, where you have consented, to understand which pages are useful.

We will not add you to a marketing mailing list off the back of an enquiry without asking you separately and clearly.

Enquiries submitted through this site are written into our platform’s leads database, hosted with Supabase in the EU (Ireland region), and the site is served through Cloudflare. Our team reads and replies to them. Access is restricted to the people who need it to respond to you.

The full list of providers we rely on is published on our sub-processors page.

Enquiry data is held in the EU, which the UK’s adequacy regulations treat as offering equivalent protection. Two categories of data go further afield. The emails we send are delivered by a provider in the United States, so a recipient’s name, email address and the content of that message are transferred there. And some design, development and support work is delivered by contracted personnel in South Africa, who may access the project content they are working on. Both transfers are made under the UK International Data Transfer Addendum, supported by a transfer risk assessment. Our sub-processors page lists everyone involved.

Essential cookies and local storage needed to run the site and remember your cookie choice are always active — these do not require consent.

Beyond that, the only non-essential technology is Google Analytics, which sets its own cookies to measure site usage. It does not load unless you accept. When you first arrive you are asked, with “Reject all” offered just as prominently as “Accept all”. Nothing is pre-ticked. If you reject, no analytics cookies are set and we clear any that already exist. You can change your mind by clearing this site’s data in your browser, which makes the banner appear again.

Enquiries are kept for as long as we need them to deal with your request and to keep a record of business conversations — normally up to two years from our last contact, and longer only where we go on to work together and need the record for the engagement or for legal obligations. You can ask us to delete your enquiry sooner.

Under UK GDPR you can ask for a copy of your personal data, ask us to correct or delete it, object to or restrict processing, and ask for it in a portable format. Where we rely on legitimate interests you have the right to object, and where we rely on consent you can withdraw it at any time.

To exercise any of these, email hello@confluxus.co.uk. You can also complain to the Information Commissioner’s Office, the UK supervisory authority, at ico.org.uk.

If this policy changes materially we will note it here and update the date above.