1. Who is responsible for your data
Scapebridge Ltd, registered in the United Kingdom, is the controller of personal data collected through scapebridge.com when we determine why and how that data is used. This policy covers our public website, business enquiries and related correspondence. Personal data processed on behalf of clients is subject to the relevant client agreement and processing instructions, not just this website policy.
Registered address and dedicated privacy contact: pending confirmation. See section 9 for rights and contact information.
2. What we collect and why
Our enquiry form collects your name, work email, job title, company, description of what you need, and any country, phone number or referral source you provide. We also store the email domain, submission time and whether the enquiry came from the homepage or Journey page. Later correspondence may include information you choose to share about your business requirements.
We use this information to respond, assess whether our services are suitable, prepare proposals and manage business relationships. We do not require you to provide personal data simply to browse the site. Fields required by the form are needed to process that enquiry; without them the form cannot be submitted. Optional fields can be left blank.
Please do not include passwords, financial-account details, health information or other sensitive personal data in an enquiry, or information about other people unless you are entitled to provide it.
Website hosting and security providers may process technical information such as IP addresses, request times, device/browser information and error records to deliver and protect the site. The exact production logging arrangements remain under review.
3. UK and European lawful bases
- Steps towards a contract or performance of a contract: where processing is necessary to discuss or deliver a service you request as a contracting party.
- Legitimate interests: responding to business contacts, evaluating enquiries, managing business relationships, and maintaining a secure, reliable website. We balance these interests against your rights; you may object to processing based on legitimate interests.
- Legal obligations: where applicable laws require record keeping, disclosure or handling of rights requests.
- Consent: where legally required for optional tracking or communications. Consent, when used, can be withdrawn without affecting the lawfulness of earlier processing.
Submitting an enquiry is not consent to unrelated marketing. Our website describes a personal follow-up, not enrolment in a drip campaign. Any separate marketing activity requires its own appropriate legal basis and, where necessary, consent.
4. Browser storage and external services
The website stores your light/dark theme choice in local storage under sb-theme. This is a preference, not an advertising identifier. It remains until overwritten or cleared through your browser settings; removing it resets your saved choice.
The site loads fonts from Google Fonts, which involves a connection from your browser to Google and can expose technical request information. Enquiries are stored using Lovable Cloud. Our hosting environment supports website delivery and may support security and error diagnostics.
Some Journey links open Calendly in a new tab. Calendly is not embedded in the enquiry form; data you submit on its website is also governed by its own privacy notice. Logos of other tools on our website do not mean your enquiry is sent to those tools.
The reviewed application does not configure advertising pixels or conventional audience analytics. Hosting-level tracking, cookies and diagnostic behaviour still require verification. If optional tracking is introduced, we must provide the necessary notice and choices before it is used where required by law.
5. Who receives data and overseas processing
Enquiries may be accessed by authorised Scapebridge personnel and providers supporting hosting, storage and business correspondence, as necessary for those purposes. Data may also need to be disclosed to professional advisers or authorities when required by law or necessary to establish, exercise or defend legal claims.
Some providers may process data outside the UK or European Economic Area. Where restricted transfers occur, applicable law requires an appropriate mechanism, such as an adequacy decision or approved contractual safeguards (including UK arrangements where relevant). Provider locations, contracts and safeguards must be confirmed; this draft does not certify that those arrangements are already in place. Once confirmed, information about relevant safeguards can be requested using our privacy contact.
6. How long information is kept
GDPR and CCPA do not prescribe a single standard retention period for all enquiries or client records. Retention must be proportionate to the purpose and applicable legal requirements.
- Enquiries and proposals: for the period needed to respond, evaluate the opportunity and conclude relevant follow-up; records should then be deleted or anonymised unless another justified purpose applies.
- Client and transaction records: for the relationship and any additional period required for tax, accounting, contractual obligations or legal claims.
- Technical and security records: for the period necessary to operate the website, investigate incidents and protect it.
- Rights-request records: as necessary to document and demonstrate the handling of the request.
A documented retention schedule, periodic review and backup deletion arrangements still need to be confirmed. This notice does not itself implement automatic deletion.
7. Security and automated decisions
Appropriate access restrictions and technical and organisational safeguards are needed to protect personal data. No transmission or storage method is entirely risk-free. The website enquiry process validates and stores your submission; it is not designed to make solely automated decisions producing legal or similarly significant effects about you.
8. California notice and rights
The CCPA, as amended by the CPRA, applies to businesses meeting its legal criteria; UK registration alone does not establish whether it applies. Where it applies, California residents have the rights described below. The following describes the current website collection flow, not a verified inventory of all company practices during the preceding 12 months.
- Identifiers: name, email and optional telephone number, from you, used for enquiry handling and business correspondence, and disclosed as necessary to service providers.
- Professional or employment-related information: job title, company and business requirements, from you, used to evaluate and respond to your request.
- Other information you provide: country, referral source and correspondence, used for context and follow-up. Country is not precise geolocation.
- Internet or technical activity: originating enquiry page, theme preference and technical records that providers may process, used for site operation, preferences and security.
Retention criteria are in section 6. The form does not intentionally request sensitive personal information. We must verify actual collection, recipient categories and any sale or sharing across the business for the preceding 12 months before finalising these disclosures. No sale or cross-context behavioural advertising sharing is configured in the reviewed enquiry flow; this is not a company-wide attestation.
Subject to applicable exceptions, covered California residents may request to know or access personal information and disclosures, request deletion, correct inaccurate information, and receive non-discriminatory treatment for exercising their rights. Where applicable, they may opt out of sale or sharing and limit uses of sensitive personal information beyond legally permitted purposes.
If sale or sharing takes place, an effective opt-out method and recognition of applicable opt-out preference signals, including Global Privacy Control, are required. Publishing this policy alone does not provide those controls. We do not claim that such controls have been implemented.
Requests may be made through an authorised agent. Proportionate verification of identity and, when appropriate, the agent’s authority is needed; do not send identity documents unless requested through a secure process. Covered businesses generally acknowledge requests to know, delete or correct within 10 business days and respond within 45 calendar days, with a permitted extension and explanation where applicable.
9. Your rights and how to contact us
Under applicable UK/EU law, you may request access, correction, erasure, restriction or portability of your personal data, object to processing based on legitimate interests, and withdraw consent where processing relies on it. Rights depend on the circumstances and may be subject to legal exceptions. UK/EU requests normally require a response within one month; permitted extensions must be explained.
Our dedicated privacy email and postal address are awaiting confirmation. A final notice must provide a working way to submit privacy requests. The business-enquiry form requires a work email and is not a substitute for an accessible privacy-rights request channel.
You may complain to the UK Information Commissioner’s Office at ico.org.uk, or to the competent authority in the EU country where you live, work or believe an infringement occurred. California residents can find guidance from the California Attorney General and the California Privacy Protection Agency.
10. Children and policy updates
This website is directed at business users, not children, and the enquiry form is not intended to collect children’s personal data. If you believe a child has provided data, please raise this with us once the privacy contact is available so it can be investigated.
We will revise this policy when practices or legal requirements change, show the latest revision date and provide additional notice where required. If the CCPA applies, the policy must be reviewed and updated at least annually.