Privacy policy

This policy explains how Northfold Labs ("we", "us", "our") collects and uses personal information when you use this website or get in touch with us. We are the controller of that information. We work with businesses around the world, so this policy applies wherever you are. You can reach us about anything in it at contact@northfoldlabs.com.

This policy covers this website only. Our products have their own websites, and those sites have their own privacy notices. When we do work for a client, we handle the information we are given under our agreement with that client, not under this policy.

What we collect and where it comes from

From you, when you use the contact form

• Your name, email address and company.
• Your role, company size, the topic you are asking about, your project stage and timeline, if you choose to tell us.
• Whatever you write in your message.

From you, when you email or speak to us

The contents of your emails and the details you give us, such as your name, job title, company and phone number.

From your browser, when you visit

• Your IP address, browser type, device type and the pages you request. Our hosting provider records this in server logs.
• We use your IP address briefly to limit repeated submissions of the contact form. A hidden field on the form helps us spot automated spam.

We do not collect payment details through this website. We do not knowingly collect information about children, and this website is not aimed at anyone under 18.

Why we use it, and our legal basis

• To reply to your enquiry and, if you ask, to prepare a proposal. Our legal basis is taking steps at your request before a contract, and our legitimate interest in answering people who contact us about our services. Where the law of your country uses different terms, we rely on the closest equivalent.
• To run the website, keep it secure and prevent abuse such as spam. Our legal basis is our legitimate interest in keeping a safe and working service.
• To keep records we must keep by law, such as accounting and tax records if you become a client. Our legal basis is a legal obligation.
• To contact you about our services after your enquiry, such as following up a proposal. Our legal basis is our legitimate interest in following up business enquiries. You can ask us to stop at any time.

We do not add you to a mailing list because you used the contact form. We do not sell your information, and we do not make decisions about you by automated means.

Where we rely on legitimate interests, we have weighed them against your rights and expectations. You can ask us for details of that assessment.

Who we share it with

We use a small number of providers to run the website and handle your messages. They process information on our instructions and under a contract, and may not use it for their own purposes.

• Resend, which delivers contact form messages to our email.
• Vercel, which hosts the website and keeps server logs.
• Sanity, which holds the website content. It does not receive contact form messages.
• Our email and office software providers, which hold the emails we send and receive.

We may also share information if the law requires it, or to protect our rights, for example in a legal claim. If our business is sold or reorganised, information may pass to the new owner, who must continue to protect it.

Where your information is processed

We work internationally, and our providers store and process information in several countries, including the United States. Where your information is sent to another country, we make sure it is protected by a safeguard that the law allows, such as an adequacy decision or standard contractual clauses approved for that purpose. You can ask us for details of the safeguard that applies.

How long we keep it

• Enquiries that do not lead to work: up to two years after our last contact, in case you come back to us. We then delete them.
• Clients: for the length of our agreement, then for as long as the law requires us to keep business and tax records, which is usually several years.
• Server logs: held by our hosting provider for a short period, and then deleted automatically.

How we protect it

The website is served over an encrypted connection. Contact form messages are sent to us by a secure email service and are not stored in a database on the website. Access to our inboxes and systems is limited to the people who need it. No system is completely secure, so please do not put sensitive information in a contact form.

Your rights

Depending on where you live, data protection laws such as the UK GDPR and EU GDPR, and similar laws in other countries, give you rights over your information. These can include the right to:

• ask for a copy of the personal information we hold about you;
• ask us to correct information that is wrong or incomplete;
• ask us to delete your information, in some circumstances;
• ask us to restrict how we use your information, in some circumstances;
• object to us using your information where we rely on legitimate interests;
• ask us to send your information to you or another organisation in a usable format, where it applies.

To use any of these rights, email contact@northfoldlabs.com. We may need to check who you are first. We reply within one month, and we do not charge unless a request is clearly unfounded or excessive.

Complaints

If you are unhappy with how we have handled your information, tell us first at contact@northfoldlabs.com so we can put it right. We will acknowledge your complaint within 30 days and tell you what we find. You also have the right to complain to the data protection authority where you live or work. In the UK that is the Information Commissioner's Office (ico.org.uk), and in the EU it is the authority in your country.

Changes to this policy

We may update this policy from time to time. The date at the top of the page shows when it last changed. If we make a significant change, we will say so on this page.