Privacy Policy

Hephaestus Systems Ltd ("we", "us", "our") is a private limited company registered in England and Wales. We are the data controller responsible for your personal data when you use this website or engage our services. If you have any questions about this Privacy Policy or how we handle your data, contact us at contact@hephaestussystems.co.uk.

We collect the following categories of personal data: • Contact details — your name, email address, and phone number (if provided) when you submit a service request, use our chat assistant, or create a client portal account. • Project details — information you share about your project requirements, business, domain names, hosting needs, and timeline. • Billing information — payment amounts and transaction records. Card details are processed entirely by Stripe and never touch our servers. • Account credentials — your email address used to log into the client portal. You can authenticate using a password, your Google account, or a one-time passcode sent to your email. • Communications — messages you exchange with us through the portal or email. • Usage data — basic, anonymised or pseudonymous information about how you interact with our website, collected only with your consent.

Our website includes a chat assistant that lets visitors describe their project without creating an account or signing in. When you use the chat, we collect the personal data you choose to share — typically your name, email address, project requirements, budget, timeline, and any domain names you mention. Lawful basis: We process this data under legitimate interests (Art. 6(1)(f)) and pre-contractual steps (Art. 6(1)(b)) — we need these details to respond to your enquiry and prepare a proposal. No cookie consent or account is required because the chat is a direct enquiry to us, not background tracking. What we do with it: Your chat responses are reviewed by our team and, if you proceed, used to create a formal service request. If you don't become a client, we retain the chat data for up to 12 months in case you follow up, then delete it. Your rights: You can request deletion of your chat data at any time — even if you only used the chat once and never became a client — by emailing contact@hephaestussystems.co.uk. We'll remove your conversation and any associated enquiry records within 30 days.

Under UK GDPR, we rely on the following lawful bases: • Performance of a contract (Art. 6(1)(b)) — processing your data to deliver services you've requested, including project work, hosting, and billing. • Pre-contractual steps (Art. 6(1)(b)) — collecting project details when you submit an enquiry before any contract is formed. • Legal obligation (Art. 6(1)(c)) — retaining billing and accounting records as required by HMRC and company law. • Legitimate interests (Art. 6(1)(f)) — responding to your enquiries, protecting our systems from abuse, and communicating with active clients. • Consent (Art. 6(1)(a)) — loading the Meta Pixel and other non-essential cookies only after you've opted in via our cookie banner.

We share personal data with the following third parties, each acting as a data processor under our instructions: • Stripe — payment processing (EU and US). Stripe participates in the EU–US Data Privacy Framework. • Resend — transactional email delivery (EU and US). Protected by Standard Contractual Clauses. • ResellersPanel — domain registration and hosting provisioning (EU). • Meta (Facebook) — website analytics and conversion measurement (US), only loaded after you accept cookies. Meta participates in the EU–US Data Privacy Framework. • GitHub — code hosting (US). GitHub participates in the EU–US Data Privacy Framework. • Vercel — deployment infrastructure (US). Protected by Standard Contractual Clauses. • Railway — deployment infrastructure (US). Protected by Standard Contractual Clauses. • Google Fonts — font delivery (US). Google participates in the EU–US Data Privacy Framework. International transfers safeguard: Where personal data is transferred outside the UK to a provider without EU–US Data Privacy Framework certification, we put Standard Contractual Clauses (SCCs) — the module two "controller to processor" terms approved by the ICO under Article 46 of UK GDPR — in place with that provider before any transfer occurs. Where a provider is certified under the EU–US Data Privacy Framework, we rely on that certification as the transfer safeguard. We do not sell your personal data to anyone.

We use two categories of cookies: Essential cookies — these are necessary for the website to function (for example, remembering your cookie consent decision and keeping you logged into the client portal). They do not require consent and cannot be disabled. Non-essential cookies — the Meta Pixel sets cookies to measure how visitors find our website and which marketing channels are effective. These are only loaded after you click "Accept all" on our cookie banner. You can decline or withdraw your consent at any time by clearing your browser's stored consent for this site. We do not use cookies to identify you personally or to build a profile for advertising targeting.

We keep your personal data only as long as necessary: • Enquiry and chat data — if you submit an enquiry but don't proceed, we retain it for up to 12 months, then delete it unless you ask us to sooner. • Active project records — kept for the duration of your engagement and for 7 years thereafter, to meet accounting and tax record-keeping requirements. • Billing and payment records — retained for 7 years as required by HMRC. • Client portal accounts — deleted on request, or when no longer needed. • Messages — kept for the lifetime of your project and archived alongside project records. You can request early deletion of your data at any time (see Your Rights below), subject to our legal obligation to retain certain records.

Under UK GDPR, you have the following rights: • Right of access — request a copy of the personal data we hold about you. • Right to rectification — ask us to correct inaccurate or incomplete data. • Right to erasure — ask us to delete your personal data (the "right to be forgotten"). • Right to restrict processing — ask us to limit how we use your data in certain circumstances. • Right to data portability — receive your data in a structured, machine-readable format and have it transferred to another provider. • Right to object — object to processing based on legitimate interests or for direct marketing. • Right to withdraw consent — withdraw your cookie consent at any time without affecting processing that took place before withdrawal. To exercise any of these rights, email us at contact@hephaestussystems.co.uk. We will verify your identity and respond within one month, as required by UK GDPR. You do not need to give a reason for your request.

We take reasonable technical and organisational measures to protect your personal data, including: • Encrypted data transmission (HTTPS/TLS) across all pages. • Authentication via passwords (hashed, never stored in plain text), Google OAuth, or one-time passcodes sent to your email. • Role-based access controls limiting data visibility to authorised administrators only. • Webhook signature verification for payment and email integrations. No system is 100% secure. In the unlikely event of a personal data breach, we will notify the Information Commissioner's Office (ICO) within 72 hours where required by law, and inform affected individuals without undue delay if the breach poses a high risk to your rights and freedoms.

Our services are directed at businesses and adults. We do not knowingly collect personal data from anyone under 18. If you believe we have collected data from a minor, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Material changes will be posted on this page with an updated "Last reviewed" date. We encourage you to review this page periodically.

If you believe we have mishandled your personal data, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113. We would, however, appreciate the opportunity to address your concerns directly first.