Privacy policy

Who we are

MaboaSoft is the data controller for personal data collected through this website.

What we collect

Enquiry form. When you send us a message we collect the name, email address and message text you enter. We use it to reply to you and to carry the conversation forward if it becomes a project.

Direct contact. If you email or phone us, we hold that correspondence and the contact details in it.

Call bookings. Booking an introductory call is handled by Calendly, which collects the name, email address and scheduling details you provide.

Analytics. We use Umami, a privacy-focused analytics tool, to count page views and understand which pages are useful. It records page views, referrer, approximate location, browser and device type. It does not set advertising cookies, does not build cross-site profiles, and does not track you across other websites.

Free tools. The EU AI Act checker runs entirely in your browser. Your answers and the PDF report it generates are not uploaded to us and are not stored on our servers.

Cookies

We do not set advertising or profiling cookies, and our analytics is cookieless. Third-party services embedded in a page may set their own cookies once you interact with them — specifically Calendly when you open the booking widget, and YouTube when you play an embedded video. Those cookies are governed by the relevant provider's own policy.

Lawful basis

We rely on legitimate interests (UK GDPR Article 6(1)(f)) to respond to enquiries, to run and secure the website, and to measure aggregate usage. Where you have entered into or are negotiating an engagement with us, we rely on performance of a contract (Article 6(1)(b)). Where consent is required, we ask for it and you can withdraw it at any time.

How long we keep it

Enquiry correspondence is retained for up to 24 months from our last contact with you, so we can pick up a conversation that resumes later. Records connected to a signed engagement are kept for as long as the engagement runs and for six years afterwards, to meet UK accounting and legal obligations. Aggregate analytics carries no directly identifying data and is retained indefinitely. You can ask us to delete your data sooner.

Processors we use

We do not sell personal data and we do not share it for advertising. The following processors handle data on our behalf so the site can function.

International transfers

Several of the processors above are based in the United States, so your data may be transferred outside the United Kingdom. Where that happens we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or on UK adequacy regulations where they apply to the provider.

Your rights

Under UK GDPR you have the following rights over your personal data.

Access

Ask for a copy of the personal data we hold about you.

Rectification

Ask us to correct data that is inaccurate or incomplete.

Erasure

Ask us to delete your data where we have no overriding reason to keep it.

Restriction

Ask us to pause processing while a concern is resolved.

Portability

Ask for the data you provided in a portable, machine-readable form.

Objection

Object to processing carried out on the basis of our legitimate interests.

To exercise any of these, email [email protected]. We respond within one month. There is no charge unless a request is manifestly unfounded or excessive.

Complaints

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the UK supervisory authority, the Information Commissioner's Office, at ico.org.uk/make-a-complaint.

Changes to this policy

We update this policy when the site changes what it collects or which processors it uses. The date at the top reflects the most recent change.