Privacy Policy

1. Introduction

This Privacy Policy explains how CM Interactive Limited ("we", "us", "our") collects, uses, stores, and protects your personal data when you visit our website at https://cminteractive.uk, contact us, or engage us for services.

We are committed to protecting your privacy and handling your personal data in an open and transparent manner. We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR).

This policy is governed by, and construed in accordance with, the laws of England and Wales.

By using our website or providing your personal data to us, you confirm that you have read and understood this Privacy Policy.

2. Who we are (data controller)

CM Interactive Limited (company number 15392983) is a limited liability company registered in England and Wales with Companies House. We are the data controller responsible for your personal data.

The correspondence address above is a mail-forwarding address. All work is carried out remotely. If you have any questions about this policy or how we handle your data, please contact us using the details above.

3. The personal data we collect

We only collect the personal data we need. Depending on how you interact with us, this may include:

3.1 Enquiry data (contact form)

When you complete our contact form, we collect your name, your email address, the content of your message, and the technical data necessary to deliver and secure the form (see Section 3.4).

3.2 Booking data (discovery calls)

If you book a discovery call, this is handled through Calendly, which collects your name, email address, chosen time slot, and any details you provide. Calendly processes this data under its own privacy policy.

3.3 Client data

If you become a client, we may process additional information required to deliver our services, such as your business contact details, project requirements, and any materials, source code or data extracts relating to your project. Where those materials contain personal data belonging to other people, Section 5 applies.

3.4 Technical and usage data

When you visit our website, we may automatically collect your IP address and approximate (city-level) location, browser type and device information, pages viewed and how you interact with the site, and your referral source. This is collected through Google Analytics and Google reCAPTCHA (see Section 8).

We also set a consent management cookie called "cm_analytics_consent" to store your cookie preference decision.

3.5 What we do not collect

We do not collect or process any special category data (such as health, racial or ethnic origin, religious beliefs, or biometric data) about visitors to this website. We do not store payment card details. All payments are handled separately by our bank and any third-party payment providers, who act as independent controllers under their own privacy policies.

4. How and why we use your data (lawful bases)

Under UK GDPR we must have a lawful basis for processing your personal data. The bases we rely on are set out below.

Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights and freedoms, and we believe they are not. You have the right to object to this processing (see Section 11).

Where we rely on consent (for example, for analytics cookies), you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. Section 9 explains how.

5. Data we handle on behalf of clients

When we build data warehouses, pipelines or reporting for a client, we may access personal data held inside that client's own systems. This can include employee names on production or shift records, and customer or supplier contact details within order and invoicing data.

In these situations the client is the data controller and we act as a data processor on their behalf. That means:

• We process that data only on the client's documented instructions, under a written agreement that meets the requirements of Article 28 UK GDPR.
• We do not use client data for our own purposes, and we never use it to train models, build demonstrations or produce case studies.
• We access only what the work requires, and prefer to work with anonymised or reduced data sets where the job allows it.
• We return or securely delete the data at the end of the engagement, in line with that agreement.
• We will not engage a sub-processor without the client's agreement.

If you are an employee, customer or supplier of one of our clients and you have a question about your data, please contact that organisation directly, as they are the controller. If you contact us, we will pass your request on to them.

6. How long we keep your data (retention)

We keep personal data only for as long as necessary for the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements.

When the retention period ends, we will securely delete or anonymise your data unless we are required by law to retain it for longer.

7. Who we share your data with

We do not sell your personal data. We only share it where necessary, with service providers (processors) who help us run our website and business (listed in Section 8); professional advisers (such as accountants or legal advisers) where reasonably necessary; and authorities or regulators where we are legally required to do so.

Where a third party acts as our processor, they act only on our instructions and are bound by a written agreement that meets the requirements of UK GDPR.

8. Third-party services

We use the following third-party services. Each has its own privacy policy, which we encourage you to review.

8.1 Google Analytics

Purpose: To understand how visitors use our website.
Data: IP address (anonymised), device and browser data, pages viewed, interactions.
Provider: Google LLC. Data may be transferred outside the UK (see Section 10).
Privacy policy: policies.google.com/privacy

8.2 Google reCAPTCHA

Purpose: To protect our contact form from spam and automated abuse.
Data: IP address, technical and challenge-response data.
Provider: Google LLC.
Privacy policy: policies.google.com/privacy

8.3 Calendly

Purpose: To schedule discovery calls. The Calendly booking widget appears on our discovery call page only, and loads when that page loads. It sets its own cookies and displays its own cookie notice, which you can respond to independently of ours.
Data: Name, email, booking details, and technical data collected by the embedded widget.
Provider: Calendly LLC (US-based).
Privacy policy: calendly.com/privacy

8.4 GitHub Pages

Purpose: Hosting of this website (cminteractive.uk).
Provider: GitHub, Inc.
Privacy policy: GitHub Privacy Statement

8.5 Krystal Hosting

Purpose: Hosting of client websites and applications (not this website).
Provider: Krystal Hosting Ltd (UK-based).
Privacy policy: krystal.io/legal/privacy-policy

8.6 EmailJS

Purpose: To process and deliver messages submitted through our contact form.
Data: Name, email address, and message content entered into the contact form.
Provider: EmailJS Pte. Ltd.
Privacy policy: emailjs.com/legal/privacy-policy

8.7 Resend

Purpose: To handle the delivery (SMTP relay) of transactional emails sent from our contact form.
Data: Name, email address, and message content contained in the email being sent.
Provider: Resend (Plus Five Five, Inc., US-based).
Privacy policy: resend.com/legal/privacy-policy

8.8 Payments

Invoicing and payments are handled by our bank, Monzo Bank Ltd, and may involve other independent payment providers. These organisations are separate data controllers and process your data under their own privacy policies. We do not store your card or banking details.

9. Cookies and analytics

Our website uses cookies and similar technologies. Under PECR, we will only set non-essential cookies (such as Google Analytics cookies) where you have given consent.

• Essential and security: Google reCAPTCHA may set technical data necessary to protect the contact form. We treat these as strictly necessary for the security of our service.
• Essential (cookie preference): We set a cookie titled "cm_analytics_consent" to remember your cookie preference. This cookie stores your choice to either accept or decline analytics and expires after 365 days. It is not shared with third parties, and is necessary for us to respect your preference across visits to our site.
• Analytics: Google Analytics cookies help us understand site usage. These require your consent, which you can give or refuse through our cookie notice and withdraw at any time using the control below.
• Third-party booking widget: The Calendly scheduler on our discovery call page sets its own cookies and shows its own notice. You can decline these through that notice or through your browser settings, and you can always arrange a call by email instead.

You can also control or delete cookies through your browser settings. Doing so may affect how parts of the website function.

10. International transfers

Some of our service providers (such as Google, Calendly, and Resend) are based outside the UK, which may mean your data is transferred internationally.

Where data is transferred outside the UK, we ensure an appropriate safeguard is in place, such as the UK's adequacy regulations, or the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.

11. Your rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right to be informed, about how we use your data (this policy).
• Right of access, to request a copy of the data we hold about you.
• Right to rectification, to have inaccurate data corrected.
• Right to erasure, to ask us to delete your data, subject to our legal retention obligations.
• Right to restrict processing, to limit how we use your data in certain circumstances.
• Right to data portability, to receive your data in a structured, commonly used, machine-readable format.
• Right to object, to processing based on legitimate interests, including direct marketing.
• Rights relating to automated decision-making, we do not carry out automated decision-making or profiling that produces legal or similarly significant effects.

If your data sits inside a client's systems rather than ours, see Section 5. In that case the client is the controller and your request should go to them.

12. How we protect your data

We take appropriate technical and organisational measures to keep your data secure, including HTTPS encryption across the website, reCAPTCHA protection against spam and automated abuse, limiting access to personal data to those who need it, and keeping software and systems up to date.

For client engagements, we additionally apply access controls so that people only see the data their role requires, and we restrict sensitive fields where they are not needed for the work.

No method of transmission over the internet is completely secure. While we work to protect your data, we cannot guarantee absolute security.

13. Children's data

Our website and services are aimed at businesses and are not directed at children. We do not knowingly collect personal data from anyone under the age of 18.

14. Complaints

If you have concerns about how we handle your data, please contact us first at help@cminteractive.uk so we can try to resolve the matter.

You also have the right to complain to the UK supervisory authority:

15. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The "Last updated" date at the top shows when it was last revised. Material changes will be posted on this page.