Privacy Policy
Last updated: 31 October 2026
1. Introduction
AurumFlux respects your privacy and is committed to protecting your personal data. This privacy policy explains how we collect and use personal data when you visit aurumflux.co.uk (the “website”), contact us, or otherwise deal with us as a prospective client, client, supplier or business contact. It also tells you about your privacy rights and how the law protects you.
We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR). Please read this policy together with any other privacy notice we may give you on specific occasions.
2. Who we are
AurumFlux (“we”, “us” or “our”) is the data controller responsible for your personal data, meaning we decide how and why it is used.
We have not appointed a Data Protection Officer. Questions about this policy or your data can be sent to info@aurumflux.co.uk.
3. Personal data we collect
Personal data means any information about an individual from which that person can be identified. We may collect:
| Category | Examples |
|---|---|
| Identity data | First and last name, job title, company name. |
| Contact data | Email address, telephone number, business address. |
| Enquiry data | The type of enquiry, services you are interested in, budget range, roles, team size, project duration, and the content of your messages. |
| Client and contract data | Details needed to provide our services, invoices, payment and billing contact information (for clients). |
| Technical data | IP address, browser type and version, device and operating system, pages requested and date/time of access, collected in server and security logs. |
| Preference data | Your light/dark theme choice, stored only in your own browser. |
We do not intentionally collect special category data (such as health, ethnicity, religious beliefs or biometric data) or data about criminal convictions. Please do not include this kind of information in your messages. We do not use analytics or advertising tracking on this website.
If you do not provide the information marked as required in our contact form (your name, email address and message), we will not be able to respond to your enquiry.
4. How we collect your data
- Directly from you — when you complete our contact form, email or call us, meet us, or become a client.
- Automatically — technical data is recorded by our hosting provider when you use the website.
- From third parties or public sources — for example business contact details from your organisation (if you are a client's employee), referrals, or publicly available professional profiles and company registers.
5. How we use your data
| Purpose | Data used | Lawful basis |
|---|---|---|
| Responding to your enquiry and sending you a confirmation copy | Identity, Contact, Enquiry | Legitimate interests (responding to business enquiries); steps at your request before entering into a contract |
| Arranging consultations, preparing proposals and quotes | Identity, Contact, Enquiry | Steps at your request before entering into a contract; legitimate interests |
| Providing our services and managing our relationship with clients | Identity, Contact, Client and contract | Performance of a contract; legitimate interests |
| Invoicing, accounting and record-keeping | Identity, Contact, Client and contract | Legal obligation; performance of a contract |
| Keeping the website and contact form secure, preventing spam and misuse | Technical | Legitimate interests (security of our systems) |
| Remembering your theme preference | Preference | Strictly necessary for a feature you request (stored on your device only) |
| Complying with the law and defending legal claims | Any relevant data | Legal obligation; legitimate interests |
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another, compatible reason. If we need to use it for an unrelated purpose, we will tell you and explain the legal basis that allows us to do so.
6. Lawful bases for processing
- Contract — processing necessary to perform a contract with you, or to take steps at your request before entering into one.
- Legitimate interests — processing necessary for our legitimate business interests (such as responding to enquiries, running and securing our business), provided your interests and fundamental rights do not override them. You can ask us for more information about how we balance these interests.
- Legal obligation — processing necessary to comply with the law, for example tax and accounting rules.
- Consent — where we rely on your consent (for example, for marketing emails), you can withdraw it at any time.
7. Marketing
We do not send marketing emails unless you have agreed to receive them or, where permitted by PECR, you are an existing client and have not opted out. Every marketing email will include a simple way to unsubscribe, and you can also opt out at any time by emailing info@aurumflux.co.uk. We never sell or rent your personal data to third parties for their marketing.
8. Who we share your data with
We share personal data only where necessary, with:
- IT and communications providers — such as our email and website hosting providers, which help us operate our website and business communications.
- Professional advisers — such as accountants, lawyers and insurers, where necessary.
- Authorities — HMRC, regulators, law enforcement or courts, where we are required by law.
- Business transfers — a buyer or successor if all or part of our business is sold or restructured, under the same protections.
Our service providers act as data processors: they may only process your data on our instructions, under a contract that requires them to keep it secure and confidential.
9. Data we process for our clients
When we build or operate software, AI or data solutions for a client, we may process personal data contained in that client's systems or datasets. In those cases the client is normally the data controller and we act as its data processor, processing data only on the client's documented instructions and under a data processing agreement. That processing is governed by our contract with the client and the client's own privacy notice, not by this policy. Questions about such data should be directed to the relevant client.
10. International transfers
Some of our service providers may store or process personal data outside the United Kingdom. Whenever we transfer personal data out of the UK, we ensure a similar degree of protection by relying on at least one of these safeguards:
- transfers to countries the UK government has found to provide an adequate level of protection (“adequacy regulations”);
- the ICO's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses;
- other safeguards recognised under UK data protection law.
Contact us if you would like more information about the safeguards we use.
11. How long we keep your data
| Data | Retention period |
|---|---|
| Enquiries that do not lead to work | Up to 24 months after our last contact |
| Client and contract records, correspondence and invoices | For the duration of the relationship and up to 6 years after it ends (UK tax and limitation periods) |
| Data used for spam and abuse prevention | Only as long as needed for that purpose (usually minutes) |
| Server and security logs | In line with our hosting provider's standard log retention |
| Theme preference | On your device until you clear it |
When data is no longer needed it is securely deleted or anonymised. In some circumstances you can ask us to delete your data earlier — see “Your rights” below.
12. Data security
We have put in place appropriate technical and organisational measures to protect personal data from accidental loss, unauthorised access, alteration or disclosure. These include encrypted connections (HTTPS/TLS), access controls that limit personal data to authorised staff on a need-to-know basis, and trusted service providers that are bound by confidentiality and security obligations.
We have procedures to deal with any suspected personal data breach and will notify you and the ICO where we are legally required to do so. No transmission over the internet is completely secure, so we cannot guarantee the security of data you send to us, but we work hard to protect it.
13. Cookies and similar technologies
Our website does not use cookies, analytics, advertising or tracking technologies. The only item we store on your device is your light/dark theme preference, saved in your browser's local storage when you use the theme switch. It is strictly necessary to provide that feature, is not sent to us and is not used to identify you. You can remove it at any time by clearing your browser's site data. If we introduce cookies in future, we will update this policy and ask for your consent where required.
14. Automated decision-making
We do not make decisions about you based solely on automated processing (including profiling) that produce legal or similarly significant effects.
15. Your rights
Under UK data protection law you have the right to:
- Access — request a copy of the personal data we hold about you (a “subject access request”).
- Rectification — ask us to correct inaccurate or complete incomplete data.
- Erasure — ask us to delete your data where there is no good reason for us to keep it.
- Restriction — ask us to suspend the use of your data, for example while we check its accuracy.
- Objection — object to processing based on legitimate interests, and to direct marketing at any time.
- Data portability — receive data you provided to us in a structured, machine-readable format, or have it sent to another organisation, where applicable.
- Withdraw consent — where we rely on consent, at any time, without affecting processing carried out before you withdrew it.
To exercise any of these rights, email info@aurumflux.co.uk. You will not usually have to pay a fee. We may need to confirm your identity before responding, to make sure personal data is not disclosed to anyone who has no right to receive it. We aim to respond within one month; if your request is particularly complex or you have made several requests, this may be extended by up to two further months, and we will tell you if so.
16. Children
Our website and services are intended for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.
17. Third-party links
Our website may include links to third-party websites and social media profiles. Clicking those links may allow third parties to collect or share data about you. We do not control these websites and are not responsible for their privacy practices, so please read the privacy policy of every website you visit.
18. Complaints
If you have concerns about how we handle your personal data, please contact us first at info@aurumflux.co.uk so we can try to resolve them. You also have the right to lodge a complaint at any time with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection: ico.org.uk/make-a-complaint or 0303 123 1113.
19. Changes to this policy
We keep this policy under regular review and may update it from time to time. The latest version will always be published on this page with the “last updated” date at the top. Where changes are significant, we will take reasonable steps to let you know. It is also important that the personal data we hold about you is accurate and current — please tell us if it changes.
20. Contact us
For any questions about this policy or to exercise your rights, contact:
AurumFlux — Data Protection
Email: info@aurumflux.co.uk