Privacy Policy

Last updated: 20 April 2025  ·  Controller: Cyber Merchant Ltd  ·  Contact: contact@cybermerchant.co.uk

This policy explains how Cyber Merchant Ltd ("we", "us", "our") collects, uses, stores, and protects your personal data when you visit www.cybermerchant.co.uk or contact us. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are

Cyber Merchant Ltd is the data controller for personal data collected through this website. Our registered office is at 107-111 Fleet Street, London EC4A 2AB. You can contact us about data protection matters at contact@cybermerchant.co.uk.

2. What Personal Data We Collect

2.1 Data you provide to us

  • Contact / enquiry form: First name, last name, work email address, company name, job title, industry, project budget range, and any message you include.
  • Email correspondence: Any information you include when emailing us directly.
  • LinkedIn: If you connect with us via LinkedIn, we receive the information visible on your profile.

2.2 Data collected automatically

  • Usage data: Pages visited, time on page, referral source, browser type, operating system, and approximate geographic location (country/region level).
  • Technical data: IP address, device type, screen resolution.
  • Cookies: See our Cookie Policy for full details.

3. How We Use Your Personal Data

We process your personal data only where we have a lawful basis to do so:

  • Contract performance / pre-contractual steps (Art. 6(1)(b) UK GDPR): Responding to your enquiry, scheduling discovery calls, and delivering our consultancy services.
  • Legitimate interests (Art. 6(1)(f) UK GDPR): Improving our website, analysing usage patterns, detecting fraud, and sending follow-up communications related to your enquiry.
  • Legal obligation (Art. 6(1)(c) UK GDPR): Complying with UK tax, company, and regulatory requirements.
  • Consent (Art. 6(1)(a) UK GDPR): Sending marketing communications where you have opted in.

4. How We Share Your Data

We do not sell your personal data. We may share it with:

  • Formspree Inc. (form processing, US) — bound by standard contractual clauses.
  • Google Analytics (website analytics, US) — anonymised; bound by standard contractual clauses.
  • Email providers used to manage correspondence.
  • Professional advisers (lawyers, accountants) under confidentiality obligations.
  • Regulatory bodies where legally required.

5. International Transfers

Some of our third-party providers are based outside the UK. Where this is the case, we ensure an appropriate safeguard is in place (such as the UK International Data Transfer Agreement or standard contractual clauses) before any transfer occurs.

6. Data Retention

  • Enquiry / contact form data: Retained for up to 3 years from last contact, or the duration of any client engagement plus 7 years (UK statutory accounting requirement).
  • Website analytics data: Retained for 26 months (Google Analytics default).
  • Correspondence: Retained for 7 years for legal and accounting purposes.

7. Your Rights

Under UK GDPR you have the right to:

  • Access the personal data we hold about you (Subject Access Request).
  • Rectification of inaccurate data.
  • Erasure ("right to be forgotten") in certain circumstances.
  • Restriction of processing in certain circumstances.
  • Data portability — receive your data in a structured, machine-readable format.
  • Object to processing based on legitimate interests.
  • Withdraw consent at any time where processing is based on consent.
  • Complain to the Information Commissioner's Office (ICO) at ico.org.uk or call 0303 123 1113.

To exercise any of these rights, please email contact@cybermerchant.co.uk with "Data Rights Request" in the subject line. We will respond within 30 days.

8. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These include TLS encryption in transit, access controls, and regular security reviews. However, no internet transmission is completely secure — please contact us immediately if you believe your data has been compromised.

9. Cookies

This website uses cookies. For full details on what cookies we use and how to manage them, please see our Cookie Policy.

10. Links to Other Websites

Our website may contain links to third-party websites. We are not responsible for their privacy practices and encourage you to review their privacy policies before providing any personal data.

11. Children's Privacy

Our services are directed at business professionals and are not intended for children under 16. We do not knowingly collect personal data from children. If you believe a child has submitted data to us, please contact us so we can delete it.

12. Changes to This Policy

We may update this policy from time to time to reflect changes in our practices or applicable law. The "Last updated" date at the top of this page will reflect any changes. Significant changes will be communicated by a notice on our website.

13. Contact Us

For any questions about this Privacy Policy or your personal data: