This policy covers the personal information we handle as a business: visitors to our website, people who send us an enquiry, and the contacts we work with during a project.

It does not cover the systems we build for our clients. Where we develop or maintain software that handles personal data belonging to a client, that client decides how the data is used and their own privacy policy applies. Our role there is set out under client project data below.

When you contact us or use our website, we collect your name, email address, company name, phone number, project details and anything else you choose to include. We only collect what you give us.

We also collect limited technical information automatically, such as your approximate location, browser and device type, and how you moved through the site. This is used to keep the site working and to understand which pages are useful.

To respond to your enquiry, prepare quotations, deliver and support the work we have agreed, and keep in touch about a live project.

To operate the business — invoicing, record keeping, improving our services and keeping the website secure.

To meet our legal and regulatory obligations, including tax and accounting requirements.

We do not use your information to train AI models, and we do not use the content of client projects for anything beyond delivering that project.

Under UK GDPR we rely on one or more of the following. Contract, where processing is necessary to deliver work you have engaged us for. Legitimate interests, in running and improving our business and securing our systems. Legal obligation, where the law requires us to keep or disclose records. Consent, where you have opted in — for example to marketing.

Where we rely on consent, you can withdraw it at any time without affecting anything processed beforehand.

When we build, host or maintain a system for a client, that system may hold personal data about the client's own customers, staff or users. For that data the client is the controller and we act as a processor, working only on their documented instructions.

Those arrangements are governed by the contract and data processing terms agreed with each client, which cover confidentiality, security, sub-processors, breach notification and what happens to the data when the engagement ends.

If you are the customer or user of a business we have built software for, contact that business in the first instance — they hold the relationship with you and can action your rights directly.

We do not sell your personal information, and we do not share it for anyone else's marketing.

We share it with service providers who help us operate — cloud hosting, email delivery, analytics, payment and accounting — and only to the extent each needs to perform its service. We also share information where we are legally required to, or where it is necessary to establish or defend a legal claim.

Our website and internal tooling rely on trusted third parties including hosting and cloud infrastructure, analytics, and email delivery. Each processes information only as needed to provide its service to us, under contractual terms that require appropriate safeguards.

We review the providers we depend on and keep the list as short as the work allows.

Some of our providers process information outside the United Kingdom. Where personal information is transferred abroad, we rely on the safeguards recognised under UK data protection law — an adequacy decision covering the destination country, or standard contractual clauses together with the UK International Data Transfer Addendum.

You can ask us which safeguard applies to a particular transfer.

We apply technical and organisational measures appropriate to the risk — encryption in transit, access controls and least-privilege permissions, secured infrastructure, and restricted access to client environments.

No system is perfectly secure. If a breach affects your personal information and is likely to result in a risk to your rights, we will notify you and the Information Commissioner's Office as required.

We keep personal information only as long as we need it for the purpose it was collected for, or as long as the law requires.

Enquiries that do not become projects are deleted once they are no longer of use. Project and client records are kept for the duration of the engagement and afterwards for the period required by contract and by UK tax and accounting law. You can ask us to delete your information sooner where nothing obliges us to keep it.

Under UK GDPR you have the right to access the personal information we hold about you, to have it corrected, to have it erased, to restrict or object to how we process it, to receive it in a portable format, and to withdraw consent where we rely on it.

To exercise any of these, email hello@syntragrid.com. We respond within one month, and we may need to confirm your identity first. There is no charge unless a request is manifestly unfounded or excessive.

If you are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk or on 0303 123 1113. We would appreciate the chance to resolve it with you first.

Our website uses cookies and similar technologies to keep the site working, remember your preferences and understand how the site is used. Non-essential cookies are only set where you have agreed to them.

You can clear or block cookies in your browser settings. Blocking essential cookies may stop parts of the site working.

We update this policy when our services, providers or legal obligations change. The current version always sits on this page with the date it was last updated, and we give additional notice where a change is material.

Questions about this policy, or about how your personal information is handled, go to hello@syntragrid.com. We are happy to explain any part of it.