Website Privacy & Cookie Notice

The data controller is Prothopic Limited, a company registered in England and Wales (company number 17220075), registered office Unit 7 Bourne Court, Southend Road, Woodford Green, England, IG8 8HD. We are registered with the Information Commissioner's Office (ICO) under reference ZC166621.

For anything about this notice or your personal data, email legal@prothopic.io.

This website has no sign-up, contact form, analytics, advertising or tracking. The only personal data we handle through it is:

• Server logs. Our hosting provider records each request to the site (IP address, browser type, the page requested and the time). We use these only to keep the site running and secure, and to investigate abuse. Lawful basis: our legitimate interest in operating a secure website.
• Emails you send us. Your name, email address, the message and any attachments. We use them to reply and to keep a record of the correspondence. Lawful basis: our legitimate interest in answering you; where the email relates to a contract with us, performance of that contract; and where we must keep it, legal obligation.
• Staff sign-in. A private administration area is available only to authorised Prothopic staff. Members of the public cannot create an account on this website.

We do not sell personal data, use it for advertising, or make automated decisions about you.

The public pages of this website set no cookies and use no similar tracking technology. Fonts are served from our own domain, so visiting the site sends nothing to third-party font or analytics services.

The staff administration area sets strictly necessary authentication cookies, which keep an authorised user signed in. Under the Privacy and Electronic Communications Regulations these do not require consent, which is why the site has no cookie banner. If we ever add a cookie that does need consent, we will ask first and update this notice.

We use these providers to run the website and our email. Each acts on our instructions:

• Vercel Inc. (USA): website hosting and content delivery; processes server logs.
• Proton AG (Switzerland): email hosting for our prothopic.io mailboxes.
• Supabase Inc. (servers in the EU): authentication for the staff administration area.

We may also disclose personal data where the law requires it, to establish or defend legal claims, or to a buyer if the business is ever sold.

Switzerland and the EU are covered by UK adequacy regulations. Transfers to Vercel in the USA are protected by the UK Extension to the EU–US Data Privacy Framework or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

• Server logs: only for the short period our hosting provider retains them (days, not months).
• Emails: for as long as the matter is open, then up to six years if they relate to a contract, a dispute or a legal obligation; otherwise up to 12 months.

Under UK data protection law you can ask us to give you a copy of your personal data, correct it, delete it, restrict or object to how we use it, or transfer it to another provider. Email legal@prothopic.io. We will reply within one month; in complex cases we may extend this by up to two more months and will tell you if we do.

You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.

We will update this notice when what we do changes, and change the “last updated” date above.