Privacy Notice
What this website does with personal data, described against what it actually does rather than against a template.
Who we are
ASTRI DEVS LTD ("we", "us") is the controller of the personal data described in this notice. We are a private limited company registered in England and Wales under company number 16684595, with our registered office at 9 Oxford Court, Manchester, England, M2 3WQ, United Kingdom.
You can contact us about anything in this notice at info@astridevs.co.uk, or by writing to us at the registered office address above.
We are not required to appoint a statutory data protection officer and have not appointed one. Data protection questions are handled through the address above.
What this notice covers
This notice covers personal data we process through this website, at astridevs.co.uk. It does not cover personal data we process on behalf of a client under a contract — in that situation the client is normally the controller and their own privacy information applies, with our obligations set out in the contract between us.
What we collect, why, and on what basis
We collect as little as we can. There is no account to create, no newsletter to join at present, and no advertising technology on this site.
Responding to an enquiry sent through the contact form
Personal data: Name; Work email address; Organisation, where provided; Telephone number, where provided; Enquiry type; Procurement or tender reference, where provided; The content of the message; Date and time of submission.
Purpose: To read the enquiry, decide whether the company is a suitable supplier, and reply to the sender.
Lawful basis (UK GDPR and EU GDPR): Legitimate interests. It is in the company’s interests, and in the interests of the person contacting it, to respond to a business enquiry that person chose to send. Where the enquiry leads to a contract, processing is also necessary to take steps at the sender’s request before entering into that contract.
Retention: Enquiries are kept for as long as needed to deal with the enquiry and any resulting engagement, and are then deleted.
Preventing automated abuse of the contact form
Personal data: IP address; A short-lived hash derived from the IP address, used for rate limiting; Timing and submission metadata.
Purpose: To stop automated submissions from flooding the mailbox and to keep the form available to genuine senders.
Lawful basis (UK GDPR and EU GDPR): Legitimate interests. The company has an interest in keeping its contact channel usable and in protecting its systems from automated abuse. The data used is the minimum needed and is short-lived.
Retention: Rate-limiting records are held in memory at the edge for the length of the rate-limit window and are not written to long-term storage.
Operating and securing the website
Personal data: IP address; Request URL, date and time; HTTP status, user agent and referrer.
Purpose: To deliver the website, diagnose faults and protect the site against attack and abuse.
Lawful basis (UK GDPR and EU GDPR): Legitimate interests. Server and edge logging is a normal, expected part of operating a website securely.
Retention: Retained by the hosting and content delivery provider under its standard log retention arrangements.
Recording cookie and tracking preferences
Personal data: The choices made in the consent manager; The version of the consent notice those choices were given against; The date and time the choices were recorded.
Purpose: To honour the visitor’s choice on optional storage and to be able to demonstrate what was chosen and when.
Lawful basis (UK GDPR and EU GDPR): Legal obligation, and legitimate interests in keeping a record. The record is stored in the visitor’s own browser. It is not transmitted to the company and is not linked to any identifier the company holds.
Retention: Stored in the visitor’s browser for up to 12 months, or until the visitor changes or clears the choice.
How we collect it
Everything above is collected either because you typed it into the contact form and chose to send it, or because it is part of the technical record of a request to a web server — an IP address, a request line and a timestamp. We do not buy personal data, we do not enrich it from third-party sources, and we do not track you across other websites.
Who else processes it
We use the following processors. Each acts on our instructions under a contract that limits what they may do with the data.
| Processor | What they do | Where |
|---|---|---|
| Cloudflare, Inc. (opens in a new tab) | Content delivery network, DNS and website hosting. Processes connection metadata, including IP addresses, to serve the site and protect it from abuse. | Global edge network, including locations outside the UK |
| Resend, Inc. (opens in a new tab) | Transactional email delivery. Processes the contents of an enquiry submitted through the contact form in order to deliver it to the company mailbox. | United States |
| Company email provider | Receives and stores enquiry emails in the company mailbox. | To be confirmed |
We do not sell personal data, and we do not share it with third parties for their own marketing purposes. We may disclose personal data where we are required to by law, or where it is necessary to establish, exercise or defend legal claims.
International transfers
Some of the processors above operate outside the United Kingdom, so personal data associated with this website is transferred internationally. Where that happens, the transfer is made under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or under the Standard Contractual Clauses where EU law applies, as set out in each provider's data processing terms.
We do not claim that all data stays in the United Kingdom, because it does not. A content delivery network by definition serves requests from the location nearest the visitor, and our email delivery provider operates in the United States.
How long we keep it
We keep enquiry correspondence for as long as it takes to deal with the enquiry and any engagement that results from it, together with any period we are required to keep business records for. We then delete it. Server and edge logs are kept for the period set by our hosting and content delivery provider under its standard arrangements.
Where a specific retention period has not yet been fixed, we have said so rather than publishing a number we do not actually apply. If you want to know how long we hold something in particular, ask us at info@astridevs.co.uk.
Security
This website is a static build with no content management system, no database and no administrative login. It is served over HTTPS with HTTP Strict Transport Security and a restrictive Content-Security-Policy. The contact form validates submissions on the server, applies rate limiting, and does not store what you send in any system other than the email inbox it is delivered to. Access to that inbox is restricted and protected by multi-factor authentication.
Our wider security approach is described at /security.
Your rights
Under the UK GDPR, and under the EU GDPR where it applies to our processing, you have the right to:
- be informed about how we use your personal data, which is what this notice is for;
- request a copy of the personal data we hold about you (access);
- have inaccurate personal data corrected (rectification);
- ask us to delete personal data (erasure), in the circumstances where that right applies;
- ask us to restrict how we use it (restriction);
- object to processing carried out on the basis of legitimate interests, including profiling — we do not profile;
- receive personal data you gave us in a portable format (portability), where the processing is based on consent or contract and is automated; and
- withdraw consent at any time, where we rely on consent.
Most of our processing relies on legitimate interests rather than consent, so the right to object is usually the relevant one. If you object, we will stop unless we have compelling legitimate grounds that override your interests, and we will explain our reasoning either way.
To exercise any of these rights, see /data-rights or email info@astridevs.co.uk. We will respond within one month. We will ask for enough information to be satisfied who you are, and no more — we will not ask you to send identity documents through a web form.
Cookies and similar technologies
This website sets no advertising cookies, uses no analytics product and loads no third-party tracking scripts. The only thing stored on your device is a record of the privacy choice you make, kept in your browser's local storage and never sent to us. Full detail is at /cookies.
Children
This website is aimed at organisations and the people who work for them. It is not directed at children, and we do not knowingly collect personal data from children. If you believe a child has sent us personal data, tell us and we will delete it.
Changes to this notice
We update this notice when what we do changes, and we review it at least annually. The effective date and the date it was last reviewed are shown at the top of this page.
How to complain
If you are unhappy with how we have handled your personal data, tell us first at info@astridevs.co.uk — we would rather put it right.
You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection, at ico.org.uk/make-a-complaint (opens in a new tab) . If you are in the European Union, you may complain to the supervisory authority in your country of residence, place of work, or where the alleged infringement took place.