Privacy Policy

1. Introduction

Leafbit Limited ("Leafbit", "we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit leafbit.uk or engage our services. It complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We are the data controller for personal data collected through this website and our consulting engagements. Our details are:

• Leafbit Limited, company number 16583520, registered in England and Wales
• Registered office: 8-10 South Street, Epsom, Surrey, KT18 7PF, United Kingdom
• Email: [email protected]

The Leafbit customer portal at portal.leafbit.uk is covered by its own separate privacy notice. This policy applies only to leafbit.uk and the consulting services we provide.

2. Information We Collect

We may collect the following types of information:

• Contact information: Name, email address, company name, and any details you choose to include in messages sent via our contact form or directly by email
• Communication records: Correspondence with us, including enquiries, project briefs, and meeting notes
• Project data: Information you provide so we can deliver your project, including business requirements, technical specifications, and any credentials or access you grant us
• Infrastructure telemetry: Cloudflare, which hosts our site, processes limited technical data such as IP address, request URL, user agent, and response status to deliver the site, mitigate abuse, and report aggregate traffic and error metrics to us. We do not run any third-party analytics, advertising, or marketing tracking on this website
• Anti-abuse data: When you submit our contact form we use Cloudflare Turnstile, which processes a small amount of technical data to confirm the request is not automated

3. How We Use Your Information

We use collected information for:

• Providing and managing our technology consulting services
• Communicating with you about projects and enquiries
• Improving our website and services
• Sending marketing communications (with your consent)
• Complying with legal obligations
• Preventing fraud and ensuring security

4. Legal Basis for Processing

Under UK GDPR, we process your personal data based on:

• Contract Performance: Processing necessary to fulfil our services
• Legitimate Interests: For business operations and service improvement
• Consent: Where you have given explicit permission
• Legal Obligation: Where required by law

5. Data Sharing and Sub-processors

We rely on a small number of trusted third-party providers to operate the website and deliver our services. Each acts as our data processor under a contract that requires them to safeguard your data and use it only on our instructions:

• Cloudflare, Inc.: Content delivery, DNS, DDoS protection, and Turnstile CAPTCHA on our contact form. Cloudflare processes connection metadata at its edge network to deliver and protect the site
• Supabase Inc.: Database and serverless function that receives and stores contact form submissions. Our Supabase project is hosted in the UK / European region
• Resend (Resend Labs, Inc.): Transactional email delivery for messages sent via our contact form and for replies we send to you. Resend is configured to use its EU region

We may also disclose information to:

• Professional advisers such as our accountants and, where necessary, legal advisers
• Law enforcement, regulators, or other authorities where we are required to do so by law
• A prospective buyer or successor in the event of a sale, merger, or restructuring of the business, under appropriate confidentiality obligations

We do not sell, rent, or trade your personal information, and we do not share it with third parties for their own marketing purposes.

6. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes set out in this policy or as required by law. Typical retention periods are:

• Contact form submissions and general enquiries: up to 24 months from the last contact, then deleted unless they have become part of a client record
• Client project records, contracts, and correspondence: 7 years after the end of the engagement, to comply with HMRC and other UK statutory record-keeping obligations
• Invoices and accounting records: 7 years, as required by HMRC for limited companies
• Cloudflare and infrastructure logs: retained for short periods in line with our providers' standard log retention

When the retention period expires, records are deleted or anonymised. Where data is held in Supabase, deletion is enforced by routine housekeeping of the underlying tables.

8. Your Rights

Under UK GDPR, you have the right to:

• Access: Request copies of your personal data
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your data (right to be forgotten)
• Restriction: Request limitation of processing
• Data Portability: Request transfer of your data
• Object: Object to processing of your data
• Withdraw Consent: Withdraw consent for processing where applicable

To exercise these rights, please contact us at [email protected]

9. Cookies and Similar Technologies

leafbit.uk does not set any analytics, advertising, or marketing cookies, and we do not run any third-party tracking on the site.

Cloudflare, which fronts our site, may set strictly necessary cookies to deliver the site securely and to mitigate abuse (for example, when our contact form uses Cloudflare Turnstile to verify that a submission is not automated). These cookies are required for the site to function and are not used for profiling or advertising. You can clear or block cookies at any time through your browser settings.

10. International Data Transfers

Our Supabase and Resend instances are hosted in the United Kingdom and European Economic Area, so contact form submissions and project data are processed within the UK/EEA. Cloudflare operates a global edge network, and limited connection metadata may be processed outside the UK as part of its delivery and security services. Where any personal data is transferred outside the UK or EEA, we rely on UK GDPR safeguards such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or transfers to jurisdictions covered by a UK adequacy decision.

11. Children's Privacy

Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal information from children.

12. Changes to This Policy

We may update this Privacy Policy periodically. Changes will be posted on this page with an updated revision date. We encourage you to review this policy regularly.

13. Contact Us

For questions about this Privacy Policy or to exercise your rights, contact us at:

• Email: [email protected]
• Leafbit Limited (company no. 16583520)
• Registered office: 8-10 South Street, Epsom, Surrey, KT18 7PF, United Kingdom

14. Complaints

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection authority:

• Website: ico.org.uk
• Phone: 0303 123 1113