Privacy Policy

2. What data we collect

Information you give us. When you submit our contact form, we collect your name, email address, company name (optional), project type and the message you write. We only ask for what we need to respond to your enquiry.

Information collected automatically. Like most websites, we and our analytics provider collect limited technical data when you browse — the pages you visit, the site that referred you, your browser and device type, and an approximate, non-precise location derived from your IP address. Where you consent, marketing cookies also record which of our own ads you've seen or clicked, so we can measure and improve our own campaigns. See our Cookie Policy for the specific cookies and tools involved and how to control them.

3. Why we process it, and our lawful basis

• To respond to your enquiry — processed on the basis of our legitimate interest in running our business and answering enquiries you've chosen to send us (UK GDPR/EU GDPR Art. 6(1)(f)), and, where you go on to become a client, to take steps toward a contract at your request (Art. 6(1)(b)).
• To understand how the site is used — processed on the basis of our legitimate interest in improving the site (Art. 6(1)(f)), using privacy-conscious analytics that avoid invasive tracking wherever possible.
• To run and measure our own marketing — where a cookie isn't strictly necessary, including any marketing/retargeting cookie, we only set it with your consent (Art. 6(1)(a)) — see the Cookie Policy.

4. How long we keep it

We keep contact form submissions for as long as needed to respond to your enquiry and for a reasonable follow-up period afterwards — typically no more than 24 months, unless you become a client, in which case the relevant records are kept for as long as our engagement and our legal/accounting obligations require. Aggregated analytics data is retained only in a form that does not identify you individually, or is deleted/anonymised on a rolling basis by our analytics provider. Marketing/retargeting cookie data is kept only for the consent period described in our Cookie Policy.

5. Who we share it with

We don't sell or rent your personal data. We share it only with the following processors, each acting under their own privacy terms and, where required, a data processing agreement with us:

• Resend — a transactional email delivery provider we use to route contact form submissions to our team's inbox. Resend processes the content of your message only to deliver it; it is not used for marketing.
• Analytics providers — privacy-conscious analytics tools used to understand aggregate site usage, as described in our Cookie Policy.
• Advertising platforms — where you consent to marketing cookies, Google Ads, Meta and LinkedIn may process limited browsing data to measure and retarget our own campaigns, under their own privacy terms.
• Hosting and infrastructure providers — the servers and content delivery network that serve this website, which process technical request data (such as IP address) as a normal part of delivering web pages.

Where a processor is based outside the UK or EEA, we rely on an adequacy decision or appropriate safeguards such as Standard Contractual Clauses to protect your data in transit.

6. Your rights

Under UK and EU GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request erasure of your data ("the right to be forgotten")
• Restrict or object to how we process your data
• Receive your data in a portable format
• Withdraw consent at any time, where processing is based on consent
• Complain to a supervisory authority — in the UK, the Information Commissioner's Office (ICO)

To exercise any of these rights, email hello@ripple18.co.uk or use our contact form. We'll respond within one month, as required by law.

7. Children

This website and our services are directed at businesses and professionals, not children. We do not knowingly collect personal data from children.

8. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or the law. The "Last updated" date at the top of this page shows when it last changed. Significant changes will be reflected here before they take effect.

9. Lead-capture forms (contact, quote and free audit)

Our contact, "Free audit" and enquiry forms collect the name, email address, company (optional), project type and message you enter, along with the technical details described above (IP address, user agent and the page you submitted from), so we can respond to your enquiry. Submitting a form requires ticking a consent checkbox; we store a timestamped record of that consent and the exact wording you agreed to, as proof of your lawful basis for us holding your data (Art. 6(1)(a) UK/EU GDPR). Each form also carries an invisible anti-spam field and a timing check used only to filter automated bot submissions — neither is used to identify or profile you.

Form submissions are stored in our own lead management system — a service we run ourselves, not a third-party marketing or CRM platform — and are used solely to track and respond to your enquiry. We keep each submission for a fixed retention period (currently up to 365 days from submission), after which it is automatically and permanently deleted, unless you've since become a client, in which case section 4's retention terms apply instead.

To request earlier deletion of a form submission, or to ask what we hold, email hello@ripple18.co.uk with the email address you submitted the form with.