Privacy Policy

This Privacy Policy explains how Lemuran Ltd(“we”, “us”, “our”) collects, uses, and protects your personal data when you use our website. We are committed to handling your data lawfully, transparently, and securely in accordance with the UK GDPR and the Data Protection Act 2018.

1. Data controller

Lemuran Ltd is the data controller responsible for your personal data. For any data protection enquiries, contact us at privacy@lemuran.com.

2. Data we collect

• Contact form data: your name, business email, company name, company size, industry, areas of interest, and the message you send us.
• Technical metadata: when you submit the contact form we record the time of submission, your browser user agent, and a one-way hashed (non-reversible) form of your IP address. We use this only to detect and prevent spam and abuse; we do not store your raw IP address.
• Analytics data: if you consent, aggregated and pseudonymised usage data (pages visited, device type, approximate location) via Google Analytics.

3. How we use your data and legal basis

• To respond to enquiries submitted through our contact form, and to manage the resulting sales conversation. Legal basis: your consent (given via the form) and our legitimate interest in responding to and following up on business enquiries.
• To prevent spam and abuse using the technical metadata above. Legal basis: our legitimate interest in keeping the service secure.
• To improve our website through analytics. Legal basis: your consent.

4. Where your data is stored and who processes it

Contact-form submissions are sent to us by email and are also stored in a secure database so we can manage and respond to your enquiry. Data is hosted within the European Union. We share data only with processors that help us operate the website, each under a data processing agreement:

• Supabase: hosts the database (EU region) that stores contact-form submissions.
• Resend: delivers the notification and acknowledgement emails generated by the contact form.
• Vercel: hosts and serves the website.
• Google Analytics: measures website usage, loaded only after you grant analytics consent.

We never sell your personal data.

5. Data retention

Contact-form submissions (including the technical metadata above) are retained for up to 24 months from the date of submission, after which they are automatically and permanently deleted by a scheduled process. We may retain data for longer only where we are required to do so by law, or where an active client relationship provides a continuing lawful basis. Analytics data is retained according to our Google Analytics configuration.

6. Your rights

Under the UK GDPR you have the right to:

• access the personal data we hold about you;
• request correction of inaccurate data;
• request erasure of your data (“right to be forgotten”);
• request data portability;
• object to or restrict processing;
• withdraw consent at any time.

To exercise any of these rights, email privacy@lemuran.com. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO).

7. Cookies

We use a small number of cookies. Essential cookies are required for the site to function. Analytics cookies are only set after you opt in via our cookie banner. You can change your preferences at any time.

8. Data security

We use HTTPS, strict security headers, input validation and sanitisation, and the principle of least privilege to protect your data. Access to stored contact submissions is restricted to authorised personnel, protected by single sign-on and an explicit allowlist, and administrative access to that data is logged. No method of transmission over the internet is 100% secure, but we take appropriate technical and organisational measures to safeguard it.

9. Changes to this policy

We may update this Privacy Policy from time to time. The “last updated” date at the top reflects the latest revision.

10. Contact

For any questions about this policy or your data, contact privacy@lemuran.com.