Legal
Privacy Policy
This policy explains what personal data Mirnova collects through this website, why we collect it, how long we keep it and what you can ask us to do with it. It is written to be read rather than skimmed past, so it is short and specific.
This website sets no cookies. Not one, of any kind: no advertising trackers, no third-party pixels, and nothing stored in your browser. That is why you were not asked to accept anything when you arrived. Our visitor statistics are counted without identifying you, and our fonts are served from this domain rather than someone else's.
Who we are
Mirnova is the data controller for the personal data described here, which means we decide what is collected and why.
You can reach us about anything in this policy, including any request to see or delete your data, at info@mirnova.co.uk. We aim to reply within a few working days, and we are required to respond to a formal rights request within one month.
What we collect, and why
There are only three ways this site results in us holding anything about you. Each one is listed below with the lawful basis we rely on under the UK GDPR.
1. If you send us an enquiry
The contact form asks for your name, email address, optionally your company, and whatever you write in the message. It is relayed straight to our inbox as an email. It is not saved to a database, it is not added to a marketing list, and it is not passed to anyone else.
Lawful basis: legitimate interests, namely replying to someone who has asked us a question. If the conversation turns into a piece of work, we rely on the necessity of taking steps prior to entering a contract. We do not ask for your consent for this because consent is the wrong basis when you are the one making contact, and asking for it would imply you could withdraw it and still get a reply.
Please do not send confidential client information, special category data such as health or ethnicity, or anything commercially sensitive through a web form. Tell us it exists and we will arrange a better route.
2. Email you send us directly
If you email info@mirnova.co.uk, that correspondence sits in our mailbox, which runs on Google Workspace. Lawful basis: legitimate interests in conducting business correspondence.
3. Server logs and visitor statistics
Our host records standard web server logs when a page is requested, including the IP address, the page requested, the time, and the browser and device reported. These exist so the site can be kept running and defended against abuse. An IP address is personal data under the UK GDPR, which is why it is listed here.
We also use Vercel Web Analytics to count visits. It is cookieless. Visitors are counted using a hash that Vercel derives from the incoming request on its own servers and discards after 24 hours, so no identifier is written to your device and the data we see cannot be traced back to you or followed across other websites. What we get is aggregate: page views, referrers, rough location at city level, browser and device type.
Lawful basis: legitimate interests in keeping the site secure and understanding, in aggregate, whether it is useful. Because nothing is stored on or read from your device, the consent rule in Regulation 6 of PECR does not apply, which is why there is no cookie banner.
Cookies and similar technologies
We do not use cookies, local storage, session storage or device fingerprinting. There is no advertising network on this site, no social media tracking pixel, and no third-party script that follows you anywhere.
Our typeface is served from this domain rather than a font CDN, so loading a page here does not quietly announce your IP address to a third-party font provider. If we ever add something that does require consent, a banner will appear before it loads and nothing will run until you choose, and this page will be updated to say so first.
Who else processes your data
We use a small number of service providers. They act as processors, which means they handle data on our instructions and are contractually bound not to use it for their own purposes.
| Provider | What it handles | Where |
|---|---|---|
| Vercel Inc. | Website hosting, server logs, cookieless visitor statistics | United States |
| Resend | Delivers the contact form to our inbox as an email | United States |
| Google (Workspace) | Our email, so any message you send us rests there | United States and EU |
| IONOS | Domain registration and DNS for mirnova.co.uk | European Union |
We do not sell personal data, and we do not share it with anyone for marketing. The only other circumstance in which we would disclose it is where the law requires us to.
Transfers outside the UK
Some of the providers above are based in the United States, so your data may be processed there. These transfers are covered by the UK International Data Transfer Addendum to the European Commission's standard contractual clauses, or by the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it. In plain terms: there is a contract in place obliging them to protect your data to a UK standard.
How long we keep things
| What | How long |
|---|---|
| Enquiries that do not become work | Up to 24 months, then deleted |
| Correspondence with clients | For the engagement, then 6 years, to match the limitation period for contract claims and HMRC record-keeping |
| Server logs | Short-term, as retained by our host for operational and security purposes |
| Visitor statistics | Aggregated only; the 24-hour visitor hash is discarded by Vercel and never reaches us |
If you would rather we did not keep your enquiry at all, say so and we will delete it once we have answered you.
Your rights
Under the UK GDPR you can ask us to do any of the following, free of charge. We will not treat you any differently for asking.
- Access a copy of the personal data we hold about you.
- Rectify anything inaccurate or incomplete.
- Erase it, where we have no continuing reason to keep it.
- Restrict how we use it while a concern is resolved.
- Object to processing we base on legitimate interests. Because that is the basis for nearly everything above, this is a meaningful right here, not a formality.
- Portability: receive the data you gave us in a machine-readable form.
- Withdraw consent, where consent is what we relied on. At present we do not rely on it for anything.
- Not be subject to a solely automated decision with legal or similarly significant effects. We do not make any.
Email info@mirnova.co.uk to exercise any of these. We may ask you to confirm who you are before we hand over personal data, which protects you rather than us.
Complaints
If you think we have handled your data badly, please tell us first so we can put it right. You also have the right to complain to the UK supervisory authority at any time:
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline 0303 123 1113 ·
ico.org.uk/make-a-complaint
Changes to this policy
If we add anything that changes what we collect, we will update this page and change the date at the top. If the change is significant, such as introducing any technology that does require your consent, we will make that clear on the site rather than leaving you to notice.
← Back to Mirnova