Privacy notice.

1. Who is responsible for your data

The data controller is Marrinn Ltd, a company registered in England & Wales, company number 17374329, registered office 20 Wenlock Road, London N1 7GU, England.

For anything in this notice, including a request to exercise your rights, write to privacy@marrinn.co.uk. We reply within one UK business day and complete rights requests within one month.

We have not appointed a Data Protection Officer. We are not required to.

2. What we collect

Only two things.

• What you type into a form. The demo form and the enquiry form ask for your full name and work email, which are required, and your company, team size and a description of what you need built, which are not. Anything you choose to put in the free-text box is collected too, so please do not paste confidential material into it.
• Ordinary server logs. Our web server records the IP address, browser user agent, requested page, referrer and timestamp of requests, as every web server does. We use these for security and to keep the site running, not to build a profile of you.

We do not ask for, and have no use for, any special category data as defined in Article 9 of the UK GDPR. Please do not send us any.

3. Cookies, analytics and tracking

This website sets no cookies and runs no analytics. There is no advertising pixel, no session recording, no A/B testing tool and no third-party tag manager on any page. Nothing on this site follows you to another one.

Two things do store data in your browser, and neither identifies you:

• A service worker cache, which keeps a copy of the pages and images so the site still works if your connection drops. It holds public files only. Clearing your browser's site data removes it.
• Web fonts are currently requested from Google Fonts, which means Google receives your IP address when a page loads. We are moving these fonts onto our own domain so that stops happening.

The map on our contact page is a flat image served from our own domain. No map provider is contacted and nothing about that map tracks you.

4. Why we use it, and our lawful basis

• Replying to your enquiry and discussing a possible project. Lawful basis: legitimate interests, Article 6(1)(f). Our interest is responding to someone who has asked us to get in touch, which is also what you wanted when you filled the form in. You can object at any time and we will stop.
• Keeping the site secure and available. Lawful basis: legitimate interests, Article 6(1)(f), in preventing abuse of our own infrastructure.
• Meeting our legal and accounting obligations once you become a customer. Lawful basis: legal obligation, Article 6(1)(c).

We do not send marketing email to people who have not asked for it, and we do not add form submissions to a newsletter list. If that ever changes we will ask you first.

Our legitimate interests assessment is available on request.

5. Who we share it with

We do not sell your data, we do not share it with data brokers, and we do not pass it to anyone for their own marketing.

It is handled by our own staff, and by the suppliers that operate our infrastructure on our instructions under Article 28 contracts:

• Hosting, the Marrinn Control Panel and email. Codeinn, the software development company that built the Marrinn platform and operates the servers this website, its admin system and our email run on. Everything you send us through a form on this site is stored in the Control Panel, which Codeinn hosts. CODEINN LEGAL ENTITY NAME AND COUNTRY
• Google LLC, for web font delivery only, as described above. No form data reaches Google.

A current list of sub-processors is available on request, and customers are told before we add one.

6. Where your data is held

Two different things get confused here, so we will separate them.

Software we build for you is deployed wherever you tell us to put it. Your own servers, your own cloud account, or hosting we arrange in the region you choose. You choose, and it is written into the contract. Nothing in this section changes that.

What you send us through a form on this website is different. It is stored in the Marrinn Control Panel, which Codeinn hosts for us (see section 5), on servers in Jordan. Staff in Jordan access it, and CONFIRM WHETHER KUWAIT-BASED STAFF ACCESS IT TOO.

Jordan is not covered by UK adequacy regulations. That means we may only send your data there if we put a specific legal safeguard in place first, and we have: NAME THE SIGNED SAFEGUARD — IDTA OR UK ADDENDUM — AND ITS DATE. You can ask us for a copy of it at any time by writing to privacy@marrinn.co.uk, and we will send it to you.

If you would rather your enquiry never left the UK, email us instead of using the form and say so, and we will keep the exchange in UK-hosted email.

7. How long we keep it

• Enquiries that do not become projects are deleted after RETENTION PERIOD from our last contact with you.
• Enquiries that become customers are kept for the life of the relationship and then for six years, because UK tax and company law requires us to keep the records.
• Server logs are kept for LOG RETENTION and then rotated out.

8. How we protect it

The site is served over HTTPS. Form submissions are encrypted in transit. Access to enquiry records is limited to the people who need it, protected by individual accounts and two-factor authentication, and every access is logged.

9. Your rights

Under the UK GDPR you have the right to:

• be told what we hold about you, and get a copy of it;
• have anything inaccurate corrected;
• have it deleted, where we have no overriding reason to keep it;
• restrict what we do with it while a dispute is resolved;
• receive it in a portable, machine-readable format;
• object to our use of it under legitimate interests, which includes telling us to stop contacting you.

Exercising any of these is free and we will not treat you differently for it. Write to privacy@marrinn.co.uk.

If you are not happy with how we have handled it you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, by phone on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We would rather you came to us first, but you do not have to.

10. Automated decision-making

We do not make any decision about you by automated means, and we do not profile you. A person reads every enquiry.

11. Changes to this notice

If we change how we handle personal data we will update this page and change the version and date at the top. Material changes affecting existing contacts will be sent to them by email.