Who we are
This privacy notice covers Calvrix Ltd, trading as Calvrix, a company registered in Scotland with company number SC893025 and its registered office at 16 Griffon Crescent, Glasgow G74 4FT, United Kingdom. We operate calvrix.co and the engineering services described on it. We are the data controller for any personal data we collect about visitors to this website.
Contact for any data question: [email protected].
What we collect, and why
We collect the minimum personal data required to operate the website, respond to enquiries, and meet legal obligations. We do not buy, sell, or rent personal data. We do not run advertising trackers.
From a visitor browsing the site
- Theme preference: a single value (light, dark, or system) stored in your browser's local storage if you accept the preferences notice. Never sent to our servers. Lawful basis: your consent, withdrawable at any time by clearing site data.
- Anonymous traffic measurement via Cloudflare Web Analytics. Cloudflare's measurement is cookieless and does not identify individual visitors. Lawful basis: legitimate interest in understanding aggregate traffic to operate and improve the site; the storage and access involved falls under the statistical-purposes exception in Schedule A1 to PECR. You can refuse it at any time: decline the preferences notice, or use the analytics switch on the Cookie Policy page. The script then does not load.
- Strictly-necessary network cookies set by Cloudflare for security and delivery (__cf_bm, cf_clearance). These do not require consent under PECR. See the Cookie Policy.
- Server access logs kept by our infrastructure provider for security and abuse-investigation purposes, including IP address, request URL, response code, user-agent, and timestamp. Retained for 30 days. Lawful basis: legitimate interest in operating a secure service.
If you contact us
- Enquiry submissions via the contact form or by email: name, email address, company, technology stack, and the message body you write. Stored only for as long as required to respond and qualify the enquiry, and for a reasonable record of the engagement conversation. Typically retained for 24 months from the last interaction unless a contract is signed, in which case standard retention applies. Lawful basis: legitimate interest in responding to commercial enquiries directed at us; consent for any subsequent marketing-style follow-up.
If you become a customer
- Engagement records including contract documents, billing records, technical handover artefacts, and the records required for our professional and tax obligations. Retained per statutory periods (typically six years from the end of the engagement for accounting records). Lawful basis: performance of a contract; legal obligation.
We do not collect
- Special-category data (health, biometrics, political views, etc.). The service is platform-engineering; nothing requires it.
- Payment-card details. We invoice on standard commercial terms and do not handle card payment data through this website.
- Behavioural advertising profiles. No ad networks, no remarketing pixels, no third-party trackers.
Who we share data with
We share personal data only with the service providers and advisers strictly necessary to operate the website and respond to enquiries:
- Cloudflare, Inc.: content delivery, DDoS protection, edge analytics. Data may transit Cloudflare infrastructure outside the UK. Cloudflare is bound by an EU/UK data transfer addendum and provides Standard Contractual Clauses.
- Our hosting provider: the Windows server that serves this website, which holds the deployed application files and the access logs described above. We name the company, and where the server sits, on request.
- GoDaddy Operating Company, LLC: the mail service behind our @calvrix.co addresses, so it holds enquiry email. GoDaddy is certified under the UK Extension to the EU-US Data Privacy Framework.
- Twilio Inc. (SendGrid): delivers contact-form submissions to our inbox and keeps a copy in its sending log. Transfers rely on standard contractual clauses with the UK addendum.
- Professional advisers (accountants, auditors, legal counsel) under standard duties of confidence, where required.
Some of these providers are based in the United States, so personal data reaches them there. Each transfer relies on the safeguard named above for that provider: the UK Extension to the EU-US Data Privacy Framework, or standard contractual clauses with the UK addendum. We do not share personal data with anyone for their own marketing purposes.
Your rights under UK GDPR
You have the right to: access your personal data, request correction of inaccurate data, request erasure where the lawful basis is consent or where retention is no longer necessary, restrict processing, object to processing based on legitimate interest, and request portability of data you have provided to us. To exercise any of these, email [email protected]. We will respond within one month.
Complain to us first. If you are unhappy with how we have handled your personal data, email [email protected] with Data protection complaint in the subject line. We will acknowledge the complaint within 30 days and tell you the outcome.
If we cannot resolve it to your satisfaction you may complain to the UK Information Commissioner's Office at ico.org.uk. You do not have to complain to us first.
Retention summary
| Data | Retention | Reason |
|---|---|---|
| Theme preference (your browser) | Until you clear site data | Functional only |
| Anonymous analytics aggregates | 13 months at Cloudflare | Trend analysis |
| Server access logs | 30 days | Security investigation |
| Enquiry messages | 24 months from last interaction | Engagement record |
| Customer engagement records | 6 years from engagement end | Statutory accounting |
Changes to this notice
This notice is versioned. Every change to the wording creates a new version with a new checksum and effective date. You can view every previous version of this document at the version history page. Material changes are surfaced on the website for a reasonable period after publication.