Privacy Policy

This notice covers personal data we handle through this website at ipasuk.com. It is deliberately short, because this website does very little with your data.

If you go on to become a client, we will handle further information under our engagement letter and the terms agreed with you, including any information we see while auditing or reviewing your management system. That is outside the scope of this notice. Ask us and we will set out separately what we do with it.

There are only three ways this website results in us holding information about you.

1. What you send us through the enquiry form

If you complete the form on our contact page, we receive whatever you put into it. Four fields are required and the rest are optional:

• Required: your name, your email address, your company name, and your message.
• Optional: your phone number, your preferred contact method, the service you are asking about, and the standard you are interested in.

Please do not send us sensitive information through this form. We do not ask for and do not want data about health, ethnicity, religion, political opinions, sexual orientation, trade union membership, criminal records or biometrics. If you send it anyway we will delete it.

2. Your IP address, briefly, to stop spam

When the form is submitted, our server holds the submitting IP address in memory for up to one hour so it can enforce a limit of five submissions per hour. This is what stops automated bots flooding the form. It is never written to a database, never linked to your enquiry, and is discarded when the hour passes or the server restarts, whichever comes first.

3. Standard server logs

Like every website, our hosting provider records basic technical information about requests: IP address, the page requested, the time, the referring page and your browser user agent string. These logs exist so the site can be kept secure and working. We do not use them to build a picture of you, and we do not combine them with anything else.

UK GDPR requires us to have a specific lawful basis for each purpose. Ours are:

To read and reply to your enquiry

Our lawful basis is legitimate interests (Article 6(1)(f)). You contacted us asking for a reply, and replying to a business enquiry is the plainest possible expectation. Where your enquiry is a step towards engaging us, we also rely on steps prior to entering a contract (Article 6(1)(b)).

To send you an automatic acknowledgement

Same basis. When you submit the form we email you a copy of what you sent, so you have a record and can spot a typo in your own details.

To keep the site secure and stop form abuse

Legitimate interests (Article 6(1)(f)). We have a clear interest in not having our contact form used to send spam, and you have an interest in the site staying up.

To remember your light or dark theme choice

This is stored in your own browser and never reaches us, so no lawful basis is needed. See our cookie policy.

Where we rely on legitimate interests you have the right to object. Section 10 explains how.

This is worth stating plainly, because a lot of privacy policies imply far more activity than actually happens. On this website:

• We run no analytics. No Google Analytics, no Google Tag Manager, no Vercel Analytics, no heatmaps, no session recording.
• We run no advertising or tracking pixels. No Meta pixel, no LinkedIn Insight Tag, no Google Ads remarketing tag.
• We set no cookies whatsoever. Not one, including our own.
• We load no third-party fonts, scripts or embeds. Everything the page needs is served from our own domain, so simply reading the site discloses your IP address to nobody but our host.
• We never sell, rent or share your personal data for anyone else's marketing.
• We do no profiling and no automated decision-making. Every reply you get from us is written by a person.
• We do not add you to a mailing list because you made an enquiry. If we ever start a newsletter it will be a separate opt-in that you have to actively choose.

We do not sell your data or pass it to anyone for their own purposes. We do use a small number of service providers who process it on our instructions and cannot use it for anything else. Each is bound by a written data processing agreement under Article 28 of the UK GDPR.

Resend (email delivery)

Delivers the notification email to us and the acknowledgement email to you. Resend therefore processes the contents of your enquiry. See Resend's privacy policy.

Vercel (website hosting)

Serves this website and keeps the technical request logs described in section 3. See Vercel's privacy policy.

Our business email provider

Your enquiry lands in a mailbox and stays there while we deal with it, so our email provider holds it in the same way it holds any other email sent to us.

We may also disclose information where we are legally required to, for example in response to a valid court order, or where we need to take or defend legal advice. We would not expect this to ever arise from a website enquiry.

We are a UK business and we would rather keep everything in the UK. One of our providers means that is not entirely the case, and we would rather tell you than bury it.

Resend stores data in the United States. That includes the content of the emails generated by your enquiry and the associated delivery logs. Resend offers a sending region setting, but that setting affects how mail is routed rather than where it is stored, so there is currently no option to keep stored data in the UK or EU.

The transfer is covered by the International Data Transfer Addendum to the European Commission Standard Contractual Clauses, incorporated into Resend's data processing addendum, and Resend also participates in the EU-US Data Privacy Framework. In practice, the content that reaches the United States is the enquiry you chose to send us, and Resend deletes email and log data after 30 days.

Vercel is also a United States company and may process the technical request logs outside the UK under equivalent safeguards.

If you would rather no part of your enquiry passed through a United States provider, email or call us directly using the details at the bottom of this page instead of using the form.

Your enquiry and any correspondence about it

Up to 24 months from our last contact with you, then deleted. We keep it that long because ISO projects have long lead times and enquirers often come back to us a year or more later, and it is unhelpful for both of us if we have lost the thread.

Emails held by Resend

30 days, then deleted by Resend automatically.

The IP address used for rate limiting

Up to one hour, held only in memory.

Technical server logs

Kept for a short period by our hosting provider under their own retention schedule, and not retained by us separately.

Records relating to an actual engagement

If you become a client, the records move onto our client retention schedule, which is longer because of our legal, tax and professional obligations. We will tell you about that when we engage.

No website can promise perfect security, but here is what is actually in place:

• The whole site is served over HTTPS and forces it, so what you type into the form is encrypted in transit.
• The form is rate limited and includes a hidden anti-bot field, and submissions are validated and escaped on the server before they are put into an email.
• Enquiries are emailed to a monitored mailbox rather than being stored in a database on this website. There is no visitor database on this site to breach.
• Access to the mailbox is limited to the people at IPAS who need to answer enquiries.
• The site sends security headers including HSTS, X-Content-Type-Options and a restrictive Permissions-Policy that switches off camera, microphone, geolocation and browsing topics.

If you believe you have found a security problem with this website, please email contact@ipasuk.com and we will look into it.

Under UK GDPR you have the following rights over your personal data. They are free to use and we will not treat you any differently for exercising them.

• Access. Ask for a copy of the personal data we hold about you.
• Rectification. Have inaccurate data corrected or incomplete data completed.
• Erasure. Ask us to delete your data where we no longer need it.
• Restriction. Ask us to pause using your data while a dispute about it is resolved.
• Objection. Object to our processing where we rely on legitimate interests.
• Portability. Receive your data in a portable format, where it applies.
• Withdraw consent. Where we ever rely on consent, withdraw it at any time.

To use any of these, email contact@ipasuk.com. We will respond within one month, as the law requires, and usually much sooner. We may ask you to confirm your identity first, so that we do not hand your data to somebody else.

In practice, for a website enquiry, "please delete my enquiry" is a one-line email and we will action it.

If you are unhappy with how we have handled your personal data, please tell us first at contact@ipasuk.com so we have the chance to put it right.

You also have the right to complain to the Information Commissioner's Office, the UK data protection regulator, at any time. You do not have to come to us first.

Information Commissioner's Office

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
ico.org.uk/make-a-complaint

This website and our services are aimed at businesses and the people who work in them. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us information through this site, contact us and we will delete it.

If we change how this website handles personal data, we will update this page and change the date at the top. If we ever introduce something that requires your consent, such as analytics, we will ask for it properly before it runs, rather than quietly amending this page and treating your continued use as agreement.

You may also want to read our cookie policy and our terms of use.