Legal
Privacy policy
Template: this policy is a starting point written for a UK business. Fill in every item in [BRACKETS] and have it reviewed by a qualified adviser before relying on it.
1. Who we are
amberDNA is a trading name of [LEGAL ENTITY NAME], a company registered in [England and Wales] under company number [COMPANY NUMBER], with its registered office at [REGISTERED ADDRESS] ("amberDNA", "we", "us").
We are the controller of the personal data described in this policy. We are registered with the Information Commissioner's Office (ICO) under registration number [ICO REGISTRATION NUMBER].
If you have any questions about this policy or how we handle your data, contact us at [PRIVACY EMAIL ADDRESS] or write to us at the address above.
2. What this policy covers
This policy explains how we handle personal data collected through this website and in the course of dealing with prospective and existing customers. Where we process data on behalf of our customers as part of the backup services we provide, we act as a processor under a separate data processing agreement, and that customer's own privacy notice applies.
3. The data we collect
When you contact us or request a backup review
- Your name, company name, work email address and phone number
- The services you are interested in and the size of your organisation
- Anything else you choose to tell us in your message
When you visit the website
- Technical information such as your IP address, browser type and the pages you request, which our hosting provider processes to deliver and secure the site
- Information used by Cloudflare Turnstile to check that a form is being submitted by a person rather than an automated program
When you become a customer
- Contact details for your key staff, billing information and records of our communications and support requests
4. How we use your data and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Responding to your enquiry and arranging a backup review | Taking steps at your request before entering into a contract, and our legitimate interest in responding to business enquiries |
| Providing and supporting our services, and invoicing | Performance of our contract with you |
| Protecting the website and our forms from spam and abuse | Our legitimate interest in keeping our systems secure |
| Keeping business and accounting records | Compliance with our legal obligations |
| Sending you relevant updates about our services | Our legitimate interest in business-to-business marketing, or your consent where required. You can opt out at any time. |
5. Who we share your data with
We do not sell your personal data. We share it only with service providers who help us run our business, under contracts that require them to protect it:
- Cloudflare: website hosting and Turnstile bot protection
- Resend: delivery of contact form submissions to our inbox
- Google: fonts used on this website, which are loaded from Google's servers
- [EMAIL PROVIDER]: our email service
- [ACCOUNTING / CRM PROVIDERS]: billing and customer records
- Our technology partners, where needed to provide the services you have bought from us
- Professional advisers, regulators or law enforcement where required by law
6. International transfers
Some of our service providers process data outside the UK, including in the United States. Where this happens, we make sure appropriate safeguards are in place, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the UK–US data bridge.
7. How long we keep your data
- Enquiries that do not lead to a contract: up to [24 months] after our last contact
- Customer records: for the length of our contract and [6 years] afterwards, to meet legal and accounting requirements
8. Cookies
We only use strictly necessary cookies unless you choose to allow optional ones. See our cookie policy for the full list and to change your choices at any time.
9. Your rights
Under UK data protection law you have the right to:
- Ask for a copy of the personal data we hold about you
- Ask us to correct data that is inaccurate or incomplete
- Ask us to delete your data
- Ask us to restrict how we use your data
- Object to our use of your data, including for direct marketing
- Ask us to transfer your data to another organisation
- Withdraw your consent at any time, where we rely on consent
To exercise any of these rights, email [PRIVACY EMAIL ADDRESS]. We will respond within one month.
10. Security
We use appropriate technical and organisational measures to protect your personal data, including encryption in transit, access controls and multi-factor authentication on the systems we use.
11. Complaints
If you are unhappy with how we have handled your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
12. Changes to this policy
We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated.