01Who we are
RefynData is a service operated by Hamari Agency Ltd, a company registered in England and Wales under company number 10713877, with its registered office at 6th Floor, Regus, 120 Bark Street, Bolton BL1 2AX.
RefynData is a trading name of Hamari Agency Ltd, not a separate company. Where this notice says “we” it means Hamari Agency Ltd.
For the purposes of the UK GDPR we are the controller of the personal data described in this notice. That means we decide what is collected and why.
We are registered with the UK Information Commissioner’s Office under registration reference ZA789689.
We have not appointed a Data Protection Officer. We are not required to: we do not carry out large-scale monitoring or process special-category data as a core activity. Questions about this notice go to [email protected].
02What this notice covers
This notice covers the refyndata.ai website — what happens when you read it and what happens when you send us an enquiry through the form.
It does not cover data we process on behalf of a customer under a services agreement. When we process a customer’s product catalogue we do that as a processor, on their instructions, and the terms of that engagement govern it rather than this page.
03What we collect, and why
There is one place on this site that collects personal data: the enquiry form behind the “Book a demo”, “Send us a messy file” and question buttons. If you do not open that form, the list below does not apply to you at all.
| What | Where it comes from | Why | Lawful basis |
|---|---|---|---|
| Your name | You, in the form | So a reply can address you | Legitimate interests |
| Your work email address | You, in the form | So we can reply at all | Legitimate interests |
| Your company name | You, in the form (optional) | Context for the reply | Legitimate interests |
| Your message | You, in the form | To answer what you asked | Legitimate interests |
| Which button you used | Recorded automatically | Routes the reply — a demo request and a file question get different answers | Legitimate interests |
| Your IP address | Your browser’s connection | Rate-limiting the form, and triaging abuse if it is misused | Legitimate interests |
| Your browser user-agent string | Your browser’s connection | Triaging abuse alongside the IP address | Legitimate interests |
| A Cloudflare Turnstile result | Cloudflare, when you submit | Confirming a person sent the form, not a script | Legitimate interests |
The IP address and user-agent string are worth calling out, because they are not fields you can see. They are read from the connection and included in the enquiry email that reaches us, so that a form being abused can be traced. Both are personal data and both are treated as such here.
None of this is something you are obliged to give us. There is no statutory or contractual requirement to fill the form in, and nothing on the site is withheld if you do not. The only field the form actually needs is your email address, because without it there is no way to reply; name, company and message are optional. If you do not give us the email, the form will not send, and that is the whole of the consequence.
We run no analytics, no advertising or marketing tags, and no profiling. Nothing on this site builds a picture of you across visits, and no decision about you is made automatically. See the cookie policy for the measurements behind that claim.
04Why legitimate interests, and how to object
Most of the table above rests on legitimate interests — Article 6(1)(f). Two interests are in play, and both are narrow:
- Replying to you. You filled in a form asking a business to contact you. Using your name and email to do exactly that is what you asked for, and is hard to be surprised by. Where an enquiry leads towards a contract, Article 6(1)(b) — steps taken at your request before entering into a contract — applies as well.
- Keeping the form usable. A public form that sends email is a spam relay unless something stands in the way. The IP address, the user-agent string and the Turnstile check exist for that and nothing else. They are not used to profile you or to market to you.
We have weighed those interests against your rights and consider them proportionate: the data is small, you supplied most of it knowingly, it is not combined with anything else, and it is not sold or shared for advertising.
You can object to processing based on legitimate interests at any time, and we will stop unless we have compelling grounds not to. Email [email protected] and say so — you do not need to give a reason or use any particular form of words.
06Who else handles it
We use a small number of suppliers to run the site and deliver the mail. They process your data on our instructions, under contract, and for no purpose of their own.
| Who | What they do | What they see |
|---|---|---|
| Netlify | Hosts the site and runs the form’s server code | Your IP address and request details, in ordinary server logs |
| Krystal Hosting | Provides the mailbox the enquiry is sent to, and stores it | The whole enquiry, including the IP and user agent |
| Cloudflare | Runs the Turnstile check that tells a person from a script | Your IP address and browser characteristics, at the moment you submit |
| Storyblok | Content management for the site’s pages | Nothing from the form. It never touches an enquiry. |
Article 28 processor terms are in place with all three. Krystal’s data processing agreement applies on purchase of its hosting, and Netlify’s and Cloudflare’s are incorporated into the subscription agreements we accepted. None of them required a separate signature, and you can ask us for a copy of any of them.
We may also disclose personal data where the law requires it, or to establish or defend a legal claim. We do not sell personal data, and we do not share it with anyone for their own marketing.
07Transfers outside the UK
Some of the suppliers above operate globally, so your data may be processed outside the UK — in practice this means the United States.
Where that happens we rely on the safeguards the UK regime provides for it: the International Data Transfer Agreement, the UK Addendum to the European Commission’s Standard Contractual Clauses, or UK adequacy regulations covering the destination. You can ask us for a copy of the safeguard that applies to a particular supplier.
08How long we keep it
An enquiry arrives as an email in the [email protected] mailbox. It is not written to a database on this site, and there is no CRM behind it.
- Enquiries that do not lead anywhere are kept for as long as is reasonably necessary to deal with them, and no longer. In practice that means while a conversation is still live, and for a period afterwards in case you come back to us. We review the mailbox periodically and delete what no longer has a reason to be there. As a guide, an enquiry that goes nowhere is not normally kept beyond two years from our last contact with you.
- Enquiries that become customer relationships are kept for as long as that relationship runs, and then for the period our records and tax obligations require.
- Server logs are kept for the short period our hosting provider retains them, and are not archived by us.
You can ask us to delete an enquiry sooner. See your rights below.
09Your rights
Under the UK GDPR you have the right to:
- Get a copy of the personal data we hold about you.
- Have it corrected if it is wrong or incomplete.
- Have it erased, where we have no overriding reason to keep it.
- Restrict how we use it while a dispute about it is resolved.
- Object to our using it, including any processing based on legitimate interests.
- Receive it in a portable form, where the processing is automated and based on consent or a contract.
- Withdraw consent, where consent is what we relied on. Withdrawing it does not undo anything done beforehand.
To exercise any of these, email [email protected]. There is no charge, and we will respond within one month. We may need to confirm who you are first, so that we do not hand your data to somebody else.
If you are unhappy with how we have handled your data you can complain to a regulator. In the UK that is the Information Commissioner’s Office. We would rather you came to us first, but you are not obliged to.
10How it is protected
- The site is served over HTTPS, so what you type into the form is encrypted in transit.
- The enquiry is delivered over an authenticated, encrypted SMTP connection to the mailbox. It is not stored on the web server.
- The form is protected by a bot check, a rate limit and a hidden trap field, so that it cannot easily be used to send mail on somebody else’s behalf.
- Access to the mailbox is limited to the people who need to answer enquiries.
No system is perfectly secure. If we ever suffer a breach that is likely to put your rights at risk, we will tell you and the relevant regulator as the law requires.
11Children
This is a business-to-business service. The site is not directed at children and we do not knowingly collect data about anyone under 18. If you think a child has sent us their details, tell us and we will delete them.
12Changes to this notice
We will update this page when what we do changes, and the date at the top will change with it. If a change materially affects how we use data you have already given us, we will tell the people affected rather than relying on you to re-read the page.
13Contact
Questions, requests and objections all go to the same place: [email protected].
By post: Hamari Agency Ltd, 6th Floor, Regus, 120 Bark Street, Bolton BL1 2AX.