Privacy Policy

Yarqat LTD is the data controller for the personal data described in this policy. Our operating address is 128 City Road, London EC1V 2NX, United Kingdom, and the founder handles data protection questions personally at the address at the end of this page. Our UK company registration is being put back on a current footing; if you need the registration details for a supplier record, ask and we will give you the current position rather than a number that is out of date.

We have not appointed a Data Protection Officer, because our processing does not meet the threshold in Article 37 of the UK GDPR that would require one. Data protection questions go to the address at the end of this page and are handled by the founder directly.

From the contact and enquiry forms: your name and email address, and optionally your company, phone number, project type, budget range, timeline and message. We also record which page the enquiry was submitted from, so we can tell which parts of the site are useful.

From the consultation booking flow: your name, email address, the slot you chose and the time zone your browser reported, which we need in order to hold the appointment.

From job applications: the contact details and CV you upload, used only to assess your application.

From analytics, and only if you accept them: the pages you view, approximate location derived from your IP address, device and browser characteristics, and, through Microsoft Clarity, a recording of your interactions with the page such as mouse movement, scrolling and clicks. Nothing in this paragraph is collected unless you press Accept on the cookie banner.

We do not collect special-category data, we do not ask for anything we do not need, and we do not buy personal data from anyone.

For enquiries and bookings, our lawful basis is legitimate interest: you contacted us about our services and we have an obvious interest in replying. Where an enquiry becomes an engagement, the basis becomes performance of a contract.

For job applications, the basis is taking steps at your request prior to entering an employment relationship.

For analytics and session recording, the basis is your consent, given through the cookie banner and withdrawable at any time from the link in the footer. Withdrawing consent stops both tools loading on your next page view.

We do not sell your data and we do not share it with anyone for their own marketing. The following processors handle data on our behalf, each under their own contractual terms.

Google (Google Analytics 4), for aggregate traffic measurement. Loaded only after you accept analytics cookies. IP addresses are truncated by Google and we do not use the data to identify individuals.

Microsoft (Clarity), for behavioural analytics and session recording. Loaded only after you accept analytics cookies. It captures how a page is used, and Microsoft applies automatic masking to text input fields.

Cal.com, for consultation scheduling. It receives the name, email address and appointment time you enter in the booking flow.

Cloudflare, which sits in front of this website as a content delivery network and security proxy. It processes connection metadata, including your IP address, for every request in order to serve and protect the site.

Our email provider, which transmits the notification of your enquiry to our inbox and any reply we send you, and therefore handles the contents of that correspondence.

Our server host, which provides the dedicated infrastructure where the site and its database run.

Enquiry, booking and application data is stored in a database on a dedicated server we control, located in Finland, within the European Economic Area. It is encrypted in transit, and access is limited to the people who need it in order to reply to you.

Google, Microsoft and Cloudflare are United States companies that may process data outside the UK and EEA. Those transfers rely on the UK International Data Transfer Addendum to the European Commission Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it. If you decline analytics cookies, no data reaches Google or Microsoft at all.

Enquiries that do not lead to work are kept for up to 24 months so that we can pick up a conversation you may resume, then deleted.

Records relating to an actual engagement are kept for seven years from the end of the engagement, which is the retention period that follows from UK tax and limitation requirements.

Unsuccessful job applications are kept for 12 months and then deleted, unless you ask us to remove them sooner.

Analytics data follows the retention set in each provider: 14 months in Google Analytics, and Clarity deletes recordings after 30 days.

If you are in the UK or the EEA you have the right to be told what personal data we hold about you and to receive a copy of it, to have it corrected if it is wrong, to have it deleted, to restrict or object to our processing of it, to receive it in a portable format, and, where we rely on consent, to withdraw that consent at any time.

To exercise any of these, email us. We will respond within one month, which is the statutory deadline, and we will not charge you for it.

If you think we have handled your data badly, we would rather you told us first so we can fix it. You are entitled to complain to the Information Commissioner regardless, at ico.org.uk or on 0303 123 1113.

The site is served over HTTPS with HSTS, enforces a content security policy, and stores administrative credentials as salted hashes. Access to the database and the admin area is limited to the founder.

If a breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner within 72 hours of becoming aware of it, and we will tell you directly where the risk to you is high.

Security issues in this website can be reported to the address published at /.well-known/security.txt.

When we change this policy we update the date at the top of the page. Where a change materially affects how we use data you have already given us, we will tell the people affected rather than relying on them to re-read the page.