DataFab / Privacy
Privacy notice · last updated [DATE]
What we collect, and what we don’t.
This notice covers the datafab.ai website and the enquiries made through it. It is written to be read rather than to be survived, and it is deliberately short, because this website collects almost nothing.
Who we are
The controller.
DataFab Ltd is the data controller for personal data collected through this website. We are registered in England and Wales, company number [COMPANY NUMBER], registered office [REGISTERED ADDRESS].
Data protection enquiries, and any request to exercise the rights below: [email protected]. We answer within one month, and usually within a few days.
Collected automatically
Only standard server logs.
Visiting a page writes an entry to our hosting provider’s logs — IP address, timestamp, the page requested and your browser’s user agent. An IP address is an online identifier and can be personal data, so we treat it as such rather than pretending it is invisible. That is the whole of what happens automatically.
Technical logs, and nothing built on them
IP address, timestamp, page requested, user agent. Kept by [HOSTING PROVIDER] for security, abuse prevention and keeping the site running. We do not use them to build a profile, we do not combine them with anything else, and we do not attempt to identify you from them. Retained for [LOG RETENTION], then deleted.
Lawful basis: legitimate interests — running a website securely.
No tracking, in any form
These are precise claims, and you can verify every one with your browser’s developer tools open.
Because nothing is set that requires consent. Every page asset — fonts, styles, scripts, images — is served first-party. Your browser makes no requests to third-party analytics, advertising, font, tag-management or tracking services. Our hosting provider necessarily receives the page request and maintains the limited technical logs described above.
What you give us
Only what you type into a form.
Three forms on this site collect personal data. Nothing else on the site collects anything, and none of the forms are pre-filled from any other source.
| Form | What is collected | Why |
|---|---|---|
| Quick question | Name, work email, organisation (optional), your message | To answer the question |
| Scope a deployment | Name, work email, organisation, role, area of interest, sector, deployment posture, your message | To prepare a useful first conversation rather than a generic one |
| Request access | Name, work email, organisation, role, what you need, sector, organisation size, preferred contact, your message, and your recorded request for the dossier under NDA | To send the mutual NDA, release the documents, and keep a record that you asked and were authorised to |
On the dossier form, the checkbox records that you are requesting documents under mutual NDA and confirming you are authorised to receive them. It is a contractual record, not consent to marketing. Ticking it does not sign you up to anything, and there is nothing to unsubscribe from.
Lawful basis
Why we are allowed to hold it.
Almost everything here rests on legitimate interests. We have not stretched for a legal obligation we cannot name, and we do not claim a contract with you personally where none exists.
Legitimate interests
Responding to a business enquiry you initiated, and keeping an internal record of who requested confidential material and on what terms. Our interest is in answering you and in being able to evidence a document release; the effect on you is that a person at DataFab reads what you sent and replies. Our balancing assessment is available on request.
Contract, or steps before one
Where the agreement is with you personally — a sole trader, or an individual signing in their own name — processing your details to put an NDA in place is necessary for steps you asked for prior to a contract. Where you are acting for your employer, the contract is with the organisation and we rely on legitimate interests instead.
Legal obligation
Only where a specific UK legal obligation requires it — retaining records for tax or accounting purposes, for example, once a commercial relationship exists. We do not rely on this basis simply because a record feels prudent to keep.
You are under no statutory or contractual obligation to give us anything. If you would rather not complete a form, email us directly. The only consequence of not providing a field is that we may not be able to answer as usefully — for a document release under NDA, we do need to know who is receiving it.
Who sees it
Us, and the minimum needed to reach us.
Enquiries are read by the people at DataFab who can answer them. Dossier and assurance requests are read by the assurance team.
To be precise about a claim that is easy to overstate: the form does not post to a third-party form platform, and no third party is involved in your browser at all. But the enquiry is delivered by a transactional email processor, so it does pass through one processor on the way to us. Both are named below.
We do not sell personal data, we do not share it with advertisers or data brokers, we do not use it for advertising or profiling, and we take no automated decisions about you.
Hosting
[HOSTING PROVIDER] — serves the site and keeps the technical logs described above.
Email delivery
[EMAIL DELIVERY PROVIDER] — a transactional email service that transmits your enquiry from our endpoint to our inbox. Your name, email address and message pass through it, and it may store them in the course of delivery.
Email and CRM
[MAILBOX / CRM PROVIDER] — where the enquiry is read and tracked so it is not lost.
Where it goes
Processing takes place in [UK / EEA]. Where a processor operates outside that area, transfers rely on [UK IDTA / EU SCCs / adequacy]. Details on request.
How long
Not indefinitely.
Enquiries that go nowhere
Deleted after [PERIOD] from the last contact.
Enquiries that become a conversation
Retained for the duration of the relationship and [PERIOD] afterwards.
NDA and document-release records
Retained for [PERIOD], because we may need to evidence who received confidential material and under what terms.
Server logs
Retained for [LOG RETENTION], then deleted automatically.
Your rights
What you can ask us to do — and where it applies.
Not every right applies to every kind of processing, and a notice that implies otherwise is misleading. Because we rely mainly on legitimate interests, two of these are narrower than they look. Email [email protected] for any of them. There is no charge, and we will not make it difficult.
| Right | What it means | Applies here |
|---|---|---|
| Access · Art 15 | A copy of the personal data we hold about you | Always |
| Rectification · Art 16 | Correction of anything inaccurate or incomplete | Always |
| Objection · Art 21 | An objection to processing based on legitimate interests, which we must then justify or stop | Always — and absolute for direct marketing, which we do not do |
| Restriction · Art 18 | A pause on processing while a question is resolved | Always |
| Erasure · Art 17 | Deletion of your data | Usually, but not absolute — where we must evidence an NDA or a document release, we will keep that record, tell you which one, and delete everything else |
| Portability · Art 20 | Your data in a structured, machine-readable form | Only where processing is based on consent or a contract with you and is automated. It does not apply to data we hold on legitimate interests, which is most of what is described here |
| Withdraw consent · Art 7(3) | Withdrawal without affecting what came before | Only where we rely on consent. We currently do not, so in practice there is nothing to withdraw |
| Complain · Art 77 | To the supervisory authority | Always — the Information Commissioner’s Office at ico.org.uk. We would rather you came to us first, but you are not obliged to |
No automated decision-making or profiling within the meaning of Article 22 takes place through this website.
The website is not the product
Two different things, governed differently.
This notice covers the website. It does not cover the DataFab platform, which processes data inside your own environment under a data processing agreement, where you are the controller and we are the processor.
Raw records never leave
The fabric reads in place. The control plane holds metadata, policy and configuration — never raw data. The claim defined per edition →
We do not train on your data
Customer data, work product and privileged material are never used to train models.
A DPA governs it
Roles, sub-processors, transfers, security measures and breach notification are set out there, not here.
Changes
If this notice changes.
We will update the date at the top. If a change materially affects how we handle data you have already given us, we will tell the people affected directly rather than relying on you to re-read the page.
Questions, or anything that reads as evasive: [email protected].