Privacy Policy

Who is responsible for your data

MindLox operates this website and is the controller of the personal data described below. Our legal entity details and registered address are confirmed in writing during contracting. For any question about this policy or your data, contact us using the email address on our contact page.

What we collect, and when

This site collects personal data in exactly one place: the project inquiry form. There is no account system, no newsletter signup, and no tracking pixel placed by us. If you never submit the form, we hold no personal data about your visit beyond what our hosting provider logs to operate the service.

When you submit the inquiry form, we receive the information you entered:

• Your name and email address (both required, so we can reply)
• Your company or organization name, if you provide it
• Your website address, if you provide it
• The service area, project type, budget range, and timeline you selected
• The project description you wrote
• Confirmation that you consented to us replying

Our server also processes your IP address at the moment of submission. It is used only to apply a rate limit that prevents automated abuse of the form, is held in memory for a short window, and is not stored alongside your inquiry or used to identify or profile you.

Why we process it, and on what basis

We process inquiry data to respond to you and, if it progresses, to scope and discuss the work. Where consent is the applicable legal basis, you give it with the checkbox on the form; where legitimate interest applies, our interest is responding to a business inquiry you initiated. Rate-limit processing rests on our legitimate interest in keeping the service available.

We do not use inquiry data for marketing. Submitting the form does not add you to a mailing list, and we do not sell, rent, or share your details with third parties for their own marketing purposes.

Who else sees it

Your inquiry is delivered to our own inbox. Reaching it involves a small number of processors acting on our instructions:

• Our hosting provider, which serves this website and runs the form endpoint
• Our email delivery provider, which transmits the notification to us
• Our email and productivity provider, where the resulting correspondence is stored
• A customer relationship tool, only if a configured integration is enabled for this deployment

No analytics or advertising provider receives your inquiry data. Where a provider is located outside your country, transfers rely on the safeguards in that provider's data processing terms. We can tell you exactly which providers are in use on request.

Analytics and cookies

As built, this site sets no cookies of its own and loads no third-party analytics, advertising, or social tracking scripts. There is therefore no cookie banner, because there is nothing to consent to.

If privacy-conscious analytics are enabled on this deployment in future, we will use a provider that does not set identifying cookies or build cross-site profiles, and we will update this section to name it before switching it on.

How long we keep it

Inquiries that do not lead to an engagement are kept while there is a realistic prospect of a conversation, and then deleted. Where an inquiry becomes a client relationship, the correspondence is retained for the duration of that relationship and for the period our tax and contractual record-keeping obligations require, after which it is deleted.

Rate-limit data is held transiently in server memory and is not retained.

Your rights

Subject to the law that applies to you, you can ask us to give you a copy of the personal data we hold about you, correct it, delete it, restrict or object to our processing, or withdraw consent you previously gave. You can also ask us not to contact you again, which we will honor immediately.

Email us to exercise any of these and we will respond within the period the applicable law requires. We will not charge you or make it difficult. If you are not satisfied with our response, you may complain to your local data protection authority.

Security

The site is served over HTTPS, and the form endpoint validates and size-limits every submission before processing it. Provider credentials are held as server-side environment variables and are never included in code sent to your browser. Access to inquiry correspondence is limited to the people who need it to reply to you.

No system is perfectly secure, and we would rather say that than imply otherwise. If we became aware of a breach affecting your data, we would notify you and the relevant authority as the applicable law requires.

Children

This is a business-to-business website and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has submitted data through this site, contact us and we will delete it.

Changes to this policy

If we change what we collect or who processes it, we will update this page and change the date shown at the top. Material changes affecting data we already hold will be communicated directly where we have a way to reach you.