DRAFT FOR LEGAL REVIEW. This draft reflects how the website actually works. It has not been reviewed by a solicitor and must be before publication. Items in square brackets must be completed.
This policy explains what personal data Axsia Howmar collects through this website, why we collect it, who handles it for us, how long we keep it and your rights. In short: we collect what you send us in an enquiry, we use it only to answer that enquiry, and we do not sell it or use it for marketing.
Who we are
The data controller is Axsia Howmar Limited, trading as Axsia Howmar, registered in England and Wales under company number 17467149. Registered office: Devonshire House, 582 Honeypot Lane, Stanmore, Greater London, HA7 1JS, United Kingdom. Contact for privacy matters: enquiries@axsiahowmar.com. ICO registration:.
What we collect and why
| Data | When | Purpose | Lawful basis (UK GDPR Article 6) |
|---|---|---|---|
| Name, work email, company, job title, telephone, country, and the content of your message | When you send an enquiry or request for quotation | To answer the enquiry, prepare a quotation and keep a record of it | Steps taken at your request before entering a contract (6(1)(b)); our legitimate interest in answering business enquiries (6(1)(f)) |
| Files you attach, such as nameplate photos, datasheets or drawings | When you attach them to an enquiry | To identify equipment and parts | As above |
| Country of the project or delivery | With every enquiry | Export control and sanctions screening | Compliance with a legal obligation (6(1)(c)) |
| A salted, irreversible hash of your IP address, held for a short period | When you submit a form | To limit repeated automated submissions | Legitimate interest in keeping the form secure (6(1)(f)) |
| Technical data processed by Cloudflare Turnstile, such as IP address and browser characteristics | When a page with the enquiry form loads, if the check is enabled | To tell people from automated spam | Legitimate interest in keeping the form secure (6(1)(f)) |
| Server logs: IP address, browser type, pages requested, time | On every visit | Security and fault finding | Legitimate interest in running a secure website (6(1)(f)) |
| Analytics data: pages viewed, approximate location, device type, and coded events such as “enquiry sent” | Only if you choose Accept on the cookie banner | To understand which pages are useful | Consent (6(1)(a)) |
We never send your name, email address, telephone number, attached files, file names, part or serial numbers you type, or the content of your message to any analytics service. Web addresses are stripped of search words and similar details before any analytics record is made.
We do not ask for, and ask you not to send, special category data or information your employer classes as confidential.
Marketing
We do not collect a marketing opt-in on this website and we do not add people who send an enquiry to any mailing list. We use your details only to deal with your enquiry and any business that follows from it.
Who processes data for us
- Website hosting: Kinsta Inc., on servers located in London, United Kingdom.
- Email: Microsoft 365, provided by Microsoft Ireland Operations Limited. Enquiries are delivered to our mailbox.
- Sending of website emails, such as the acknowledgement of your enquiry: Brevo, provided by Sendinblue SAS (trading as Brevo), Paris, France, with data held in the European Union.
- Spam protection: Cloudflare Turnstile, provided by Cloudflare, Inc.
- Analytics, only with your consent: Google Analytics 4, provided by Google Ireland Limited.
We share enquiry details with a manufacturer or supplier only where that is needed to prepare your quotation, and we tell you before we share anything beyond technical requirements. We disclose data to authorities where the law requires it, including for export control.
Transfers outside the United Kingdom
Microsoft, Brevo, Cloudflare and Google may process data outside the United Kingdom. Where they do, the transfer relies on UK adequacy regulations, including the UK extension to the EU–US Data Privacy Framework where the provider is certified, or on the International Data Transfer Agreement or Addendum. [FOR LEGAL REVIEW: confirm the mechanism for each provider at the date of publication.]
How long we keep data
- Enquiry records on the website: deleted automatically after 36 months.
- Files attached to enquiries: deleted automatically from the website after 18 months.
- Emails and project records arising from an enquiry: kept for as long as needed for the business relationship and then for 6 years after the last contact, in line with limitation periods.
- Export screening records: kept for at least 4 years, in line with UK export control record-keeping requirements.
- IP address hashes for rate limiting: no more than 24 hours. Server logs are kept by our hosting provider for a short period under its own retention policy.
- Analytics data: 14 months at most.
How we protect data
The site is served over HTTPS. Attached files are stored outside the public web folder under random names and can be opened only by a signed-in administrator through a time-limited link. Enquiry records are visible to administrators only.
Your rights
Under UK data protection law you have the right to be informed, to access your data, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent at any time where we rely on it. To use any of these rights, write to enquiries@axsiahowmar.com. We reply within one month. We make no decisions by automated means that have legal or similar effects on you.
You can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to deal with your concern first. If you are in the European Economic Area you may also complain to your local supervisory authority. [FOR LEGAL REVIEW: whether an EU representative under Article 27 EU GDPR is required.]
Changes to this policy
We will post any changes on this page and update the review date shown with it.