Privacy Policy

Last updated: 15 September 2026

1. Who we are

eplatforms ltd (“eplatforms”, “we”, “us”) is the controller of the personal data described in this policy. We are a company registered in England and Wales (company number 03954521) and are registered with the UK Information Commissioner’s Office (registration number Z871919X).

For anything about privacy, including requests to use your rights and questions you would put to a data protection officer, contact:

• Email: info@eplatforms.com
• Phone: 0303 666 5485
• Post: eplatforms ltd, Basepoint Business Centre, Little High Street, Shoreham-By-Sea, BN43 5EG, United Kingdom
• Online: our contact form

2. What we collect, why, and our legal basis

When you contact us

What: through our contact form, your name and email address, and if you give them, your phone number, company, the service and budget you pick, and your message. We also record the page the form was sent from, your IP address and the date and time. If you email us, we receive your name, email address, your message and any attachments you send. If you phone us, we have your phone number and any notes we make of the call. We don’t record calls. We keep emails and call notes for the same period as other enquiries (see section 5).

Why: to reply, discuss your project and keep a record of our conversation. Form enquiries are saved in our website database and sent to our team by email. Emails you send us are kept in our business email system.

Legal basis: our legitimate interests in responding to enquiries. Where you ask about working with us, it is also to take steps at your request before entering into a contract.

Spam and abuse protection on the contact form

Our own filter checks each message automatically. No third-party CAPTCHA service is used. It uses your IP address, how long the form took to fill in, and the content of the message. If it blocks a message, we keep a private review record for 90 days so we can check that genuine enquiries aren’t being stopped. The record holds the IP address, name, email address, a short snippet of the message and the reason. The filter also keeps a technical log of its decisions (date, IP address and reason, never the message text). Short-lived rate-limit and duplicate-message records use scrambled (hashed) values and are deleted after 1 to 30 days.

Legal basis: our legitimate interests in protecting our website and inbox from spam and abuse.

The “Help me find…” assistant

On every page, in English, French and Arabic, the text you type into the assistant is sent to our AI provider, Anthropic, to generate an answer. We don’t save your questions in our database. We keep your IP address for a few hours to limit how often the assistant can be used. Anthropic processes the text as our service provider and, under its commercial terms, doesn’t use it to train its models. Under those terms Anthropic keeps the text only for a limited period, for example to prevent misuse, and deletes it within 30 days, unless it has to keep it longer to enforce its usage policy or meet a legal requirement. Please don’t type personal details into the assistant.

Legal basis: our legitimate interests in helping visitors find the right information.

Analytics

If you accept analytics cookies, Google Analytics records the pages you visit, how you arrived, your device and browser type, approximate location, and interactions such as scrolling, linked to a random ID in its cookies. Google Analytics 4 doesn’t store IP addresses. Google signals and advertising features are switched off. In the UK, the EU and EEA, Switzerland, Brazil, Türkiye, South Africa, the Gulf states and every other country except the United States and Canada, Google Analytics isn’t loaded at all without your consent. In the US and Canada it runs with a notice and you can switch it off at any time; Global Privacy Control is honoured everywhere. We estimate your country from your connection, and a choice you’ve saved always takes priority.

Legal basis: your consent (in the US and Canada, notice with the right to opt out), which you can withdraw at any time with the Cookie settings link at the bottom of every page. See our Cookie Policy.

Records of your cookie choices

When you make or change a cookie choice, we record a random consent ID, your choices, the policy version, the page language and page, the date and time, and a shortened IP address with the last part removed. We also record your country code and whether ask-first or notice rules applied.

Legal basis: our legal obligation, and legitimate interest, in being able to show that consent was given.

Server and security logs

Like most websites, our server logs each request: IP address, date and time, the page requested, the referring page, browser type and the result. Cloudflare, which protects and speeds up the site, processes the same kind of data.

Legal basis: our legitimate interests in keeping the site secure, fixing faults and preventing abuse.

Clients and suppliers

If you work with us, we use business contact details, project correspondence and billing information to deliver our services and meet our legal and accounting obligations.

Legal basis: performance of a contract and legal obligation.

When we build, host or support websites and systems for our clients, we process the personal data in them on the client’s behalf and on its instructions. This includes emails we send for clients to their own mailing lists: the client decides who receives them, and its privacy policy and unsubscribe links apply. The client’s own privacy policy explains how that data is used, and requests about it should go to that client. We don’t currently send marketing emails of our own; before we do, we’ll update this policy and ask for any consent needed.

We don’t sell personal information, use it for advertising, or make decisions about you by automated means that have legal or similarly significant effects. We don’t knowingly collect sensitive (special category) data, and this site isn’t aimed at children.

3. Who we share data with

We use these service providers, which act on our instructions under contracts that protect your data:

• Amazon Web Services (AWS): hosts our web server and database in the United Kingdom.
• Cloudflare, Inc.: security and content delivery in front of the website; processes IP addresses and request data on its global network.
• Google (Google Ireland Limited and Google LLC): Google Analytics, only if you consent.
• Anthropic, PBC: answers questions typed into the site assistant.
• Microsoft (Microsoft Ireland Operations Limited and Microsoft Corporation): business email (Microsoft 365), where enquiry notifications and emails you send us are received and stored.
• Xero: accounting and invoicing for clients and suppliers.

We may also share data with professional advisers, with authorities where the law requires it, or with a buyer if our business is sold, under confidentiality.

4. International transfers

Our website server is in the UK. Cloudflare, Google, Anthropic and Microsoft may process data in the United States and other countries, and Xero (Xero Limited, New Zealand) may process data in New Zealand, the United States and Australia. When personal data leaves the UK, we rely on UK adequacy regulations, including the UK Extension to the EU–US Data Privacy Framework for certified companies, or on the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses. For visitors in the EU and EEA, the European Commission has recognised the UK as providing adequate protection. Onward transfers use the EU–US Data Privacy Framework or Standard Contractual Clauses. You can ask us for details of these safeguards.

5. How long we keep data

6. Your rights

Depending on where you live, you have the right to:

• Access: get a copy of the personal data we hold about you.
• Rectification: have inaccurate or incomplete data corrected.
• Erasure: have your data deleted where there’s no good reason for us to keep it.
• Restriction: ask us to limit how we use your data.
• Portability: receive data you gave us in a structured, commonly used format.
• Objection: object to processing based on our legitimate interests.
• Withdraw consent: at any time, for example with Cookie settings. This doesn’t affect processing before you withdrew.

To use any of these rights, email info@eplatforms.com or call 0303 666 5485. It’s free. We may need to confirm your identity, and we’ll respond within one month (or tell you if a complex request needs up to two months more).

7. Complaints

We’d like the chance to put things right, so please contact us first. You can also complain to a data protection authority:

• United Kingdom: Information Commissioner’s Office, ico.org.uk, 0303 123 1113.
• EU and EEA: the supervisory authority where you live, work, or where the issue happened. See the list of authorities.

8. Security

We protect personal data with encrypted connections (HTTPS), restricted access, two-step verification for our website admin area, and security monitoring. No system is completely secure, but we work to keep risks low.

9. Information for specific regions

California (CCPA/CPRA)

This applies to California residents to the extent the California Consumer Privacy Act applies to us.

• Categories collected in the last 12 months: identifiers (name, email, phone, IP address, analytics cookie ID); professional information you give us (company, service interest, budget); internet activity (pages viewed and interactions through analytics, which runs with a notice and can be switched off; server logs); approximate location from IP address; and the content of messages you send. Sources are you and your browser. Purposes and retention are in sections 2 and 5.
• Disclosure: only to the service providers in section 3, for business purposes.
• No sale or sharing: we don’t sell personal information or share it for cross-context behavioural advertising, and haven’t in the past 12 months. Our “Do Not Sell or Share” status is that there is nothing to opt out of. We still honour Global Privacy Control as an opt-out signal, which switches analytics off. We don’t use sensitive personal information to infer characteristics about you.
• Your rights: to know and access, delete and correct your personal information, and not to be discriminated against for using these rights. Contact us as in section 6. An authorised agent can act for you with your signed permission. We verify requests by matching details you’ve given us.

Canada (PIPEDA)

• Accountability: eplatforms ltd is responsible for personal information under its control. Our privacy contact in section 1 is accountable for compliance.
• Consent: in Canada, analytics cookies run on implied consent: a notice tells you when you arrive, and you can switch them off at any time with Cookie settings or Global Privacy Control. When you send an enquiry, you consent to us using your details to reply. You can withdraw consent at any time, subject to legal or contractual limits, and we’ll explain what that means.
• You can access and correct your information and challenge our compliance with us, or complain to the Office of the Privacy Commissioner of Canada. Your information may be processed in the UK and the US and be accessible to authorities there under local law.

Brazil (LGPD)

• Legal bases (Art. 7): consent (analytics), legitimate interests (enquiries, security), preliminary steps for or performance of a contract, and compliance with legal obligations.
• Your rights (Art. 18): confirmation that we process your data; access; correction; anonymisation, blocking or deletion of unnecessary or excessive data; portability; deletion of data processed with consent; information about who we share data with and about refusing consent; and withdrawal of consent. You can also complain to the ANPD.
• Controller and contact (encarregado): eplatforms ltd, info@eplatforms.com, 0303 666 5485.

Türkiye (KVKK, Law No. 6698)

• Data controller: eplatforms ltd, contact details in section 1.
• Purposes and legal grounds: we process data collected electronically through this website, its cookies and email. We use it to answer enquiries and communicate with you (to set up or perform a contract, and our legitimate interests), to keep the site secure (legitimate interests), for analytics (your explicit consent), and to meet legal obligations. Transfers abroad to the service providers in section 3 take place on the grounds permitted by Article 9.
• Your rights under Article 11: to learn whether your data is processed and request information about it; learn the purpose and whether it is used accordingly; know the third parties in Türkiye or abroad it is transferred to; request correction, and erasure or destruction under Article 7, and that third parties be told of this; object to a result against you arising solely from automated analysis; and claim compensation for damage from unlawful processing.
• Send requests in writing to info@eplatforms.com. We reply free of charge within 30 days. You can also complain to the Personal Data Protection Authority.

South Africa (POPIA)

• Responsible party and information officer: eplatforms ltd. Contact our information officer at info@eplatforms.com or 0303 666 5485.
• Purposes: as in section 2. Your name, email address and message are needed to answer an enquiry; everything else is optional.
• Your rights: to access and correct or delete your information, object to processing, withdraw consent, not be subject to decisions based solely on automated processing, and complain to the Information Regulator. Transfers outside South Africa use the safeguards in section 4.

United Arab Emirates and Saudi Arabia (PDPL)

• Controller and contact: eplatforms ltd, info@eplatforms.com, 0303 666 5485 (see section 1).
• Purposes and legal bases: as in section 2: your consent for analytics, and our legitimate interests, a contract or a legal obligation for everything else.
• United Arab Emirates (Federal Decree-Law No. 45 of 2021): you can ask for information about your data and access to it, portability, correction or erasure, restriction, an end to processing, and object to decisions based on automated processing. You can withdraw consent at any time (Articles 6 and 13–18) and complain to the UAE Data Office.
• Saudi Arabia (Personal Data Protection Law): you have the right to be informed, to access your data and get a copy, to have it corrected, to have it destroyed when it is no longer needed, and to withdraw consent (Articles 4 and 5). The law is overseen by the Saudi Data & AI Authority (SDAIA), and you can complain to its National Data Management Office.
• Transfers: your data may be processed outside the UAE and Saudi Arabia, in the UK and the countries in section 4, using the safeguards described there.

10. Changes to this policy

We’ll post any changes on this page and update the date at the top. If a change affects your cookie choices, we’ll ask you again.