Privacy notice
In effect from
This notice describes what happens to personal data that reaches us through this website. It is written against what the site actually does rather than from a template, and it is revised in the same change as anything it describes.
Who is responsible for your details
Opcela is the controller of the personal data described here, which means that Opcela decides why it is used and how.
Opcela is not yet a registered company. It is being formed as Opcela Software Ltd, and on the day it is incorporated this notice will name the company and its registered details will appear at the foot of every page. Until then there is no company number to give, and nothing on this site claims one.
Where to write about anything in this notice is at the end of it.
This notice, and the way your details are handled, are governed by the law of England and Wales.
What we collect, and only what
One route into this site collects personal data: the contact form. It asks for four things, and nothing on the site asks for anything else.
| What we ask for | Do you have to give it | Why we ask |
|---|---|---|
| Your name | Yes | So a reply can be addressed to a person |
| Your work email address | Yes | So there is somewhere to reply to |
| Your company | No | So the reply can be about your situation rather than generic |
| Your message | Yes | It is the enquiry itself |
You are under no statutory or contractual obligation to give us any of it. The consequence of leaving out your name or your email address is simply that the form cannot be sent, because there would be no way to reply. Leaving out your company changes nothing about the reply you get.
All of it comes from you directly. We do not buy contact details, and we do not receive them about you from anybody else.
We do not ask for special category data, such as anything about health, beliefs or background, and the message box is not an invitation to include any. Please do not send us information of that kind through this form.
What this website does, and what it does not do
This part is the one most often wrong on a site of this kind, so it is stated in detail.
- No cookies are set by this site, of any sort, for any purpose. There is no consent banner because there is nothing to consent to.
- Nothing kept on your device identifies you. The pages write no identifier of any kind and keep no record of what you have looked at. What the site's own software keeps in your browser is technical housekeeping, such as noticing that a newer version of the site has been published, and none of it describes you, follows you or is sent anywhere.
- There is no analytics. No measurement product runs on this site, no visitor statistics are collected, and nothing profiles you or follows you between pages. If that ever changes, this notice changes in the same release and the site publishes what is stored and how to refuse it before anything is measured.
- There are no third-party requests. No advertising network, no social media widget, no embedded video, no chat box, and no third-party content delivery network. The typefaces are served from this website rather than from a font service, so looking at a page tells nobody outside our hosting provider that you were here.
- The website itself stores nothing. It is a set of files, prepared in advance and served as they are. There is no database and no visitor account.
What does happen when you send an enquiry is a request to a small handler on the same site, which checks the enquiry and hands it to our email provider for delivery. It keeps no copy.
That handler does two things worth spelling out:
- It writes the outcome of a submission to our hosting platform's log: whether the enquiry was delivered, and, where something was filled in wrongly, the names of the boxes concerned. It never writes what you typed, in whole or in part, and it never writes your IP address.
- It limits how many enquiries one internet connection may send in a ten minute window, which is what stops the form being flooded by a script. Your IP address is turned into a one-way hash with a secret that exists only for as long as the server process does, and the address itself is neither stored nor written down anywhere. The hash is held in memory, falls out of use after ten minutes and does not survive a restart.
Our hosting provider operates the platform underneath all of that and keeps its own operational records of requests made to it, as any host does, and the outcome lines described above are written into that platform's own diagnostic logging. Nothing measures the pages you look at.
Why we use your details, and our lawful basis
We use what you send to answer your enquiry, and to take any steps you ask us to take before we start work together. That is the whole of it. Your details are not sold, not added to a marketing list, not used to build a profile, and not shared with anyone beyond the two providers named below.
Our lawful basis is legitimate interests, under Article 6(1)(f) of the UK GDPR. The interest is replying to a business enquiry that you chose to send, which is our interest and plainly yours as well. We have assessed it against your interests and rights and concluded that it does not override them: the details are the minimum a reply needs, they are used once for the thing they were sent for, and they are deleted at the end of a period that ends.
That is why there is no tick-box on the form. A box beside a send button cannot be refused without losing the reply, so it would not be valid consent, and it would record the absence of a lawful basis rather than the presence of one. You can object to this processing at any time, and how to do that is below.
There is no newsletter and no mailing list on this site. Nothing here signs you up to anything.
No decision about you is made by automated means, and there is no profiling.
Who your enquiry is shared with
Two providers, and nobody else. Each of them acts on our instructions rather than for its own purposes.
| Who | What they do | Where |
|---|---|---|
| Microsoft | Hosts this website, on Azure Static Web Apps, and provides the mailbox your enquiry is read in and replied from, through Microsoft 365 | The UK and the EU. This site is served from the West Europe region |
| Resend | Delivers your enquiry to that mailbox as an email | The United States |
Our reply goes out from the mailbox itself rather than through Resend, so Resend is in the path in one direction only.
There is no customer relationship management system, no analytics provider, no advertising network and no data broker anywhere in that path. If one is ever added, it is named here before it is used.
The transfer to the United States
Resend is a company in the United States, so your enquiry leaves the UK when it is sent. The safeguard for that transfer is the standard data protection clauses in Resend's data processing terms, which is the route Article 46 of the UK GDPR provides for a transfer of this kind. You can ask us for details of it at the address at the end of this notice.
How long we keep it
Per activity, because the two activities on this site keep things for very different lengths of time.
| The activity | How long |
|---|---|
| Answering your enquiry, and the correspondence that follows it | 24 months from the last contact with you about it, and then deleted. A conversation that carries on keeps its own clock alive; one that stops starts counting from where it stopped |
| Limiting how many enquiries one connection may send | The hashed value described above is held only in the memory of the running server, is disregarded once it is more than ten minutes old, and does not survive a restart. Nothing is written to disk |
Twenty four months is chosen because an industrial software purchase is decided over quarters rather than weeks, and somebody who comes back a year later expects the earlier conversation to be remembered rather than to start again. It is long enough to be useful and short enough to be a real limit.
Resend keeps its own record of the messages it has delivered for us, under its own terms, which we do not extend. An enquiry that becomes a contract is kept under our retention rule for contract records instead, from the point the contract exists.
Your rights
You have the right to ask us to:
- give you a copy of the personal data we hold about you, and tell you what we do with it;
- correct anything that is wrong or incomplete;
- delete it;
- restrict what we do with it while a question about it is being settled;
- stop using it, by objecting to the processing described above. Because we rely on legitimate interests, this right is yours at any time and you do not have to give a reason. For an unanswered enquiry we will normally act on an objection by deleting the enquiry and confirming that we have.
Data portability does not apply here. It is a right that exists where processing is based on your consent or on a contract with you and is carried out by automated means, and we rely on neither of those. There is no consent to withdraw, for the same reason.
Exercising any of them is one email or one letter, to the address at the end of this notice. Nothing has to be filled in, there is no form, and there is no charge. Tell us what you would like us to do, and enough to let us find your enquiry, which is usually the email address you sent it from.
We answer within one month. If a request is complicated we may take up to two months longer, and we will tell you inside the first month if that is going to happen, and why.
How to complain
If you are unhappy with how your details have been handled, please tell us first, at the address below. We would like the chance to put it right.
You can also complain to the Information Commissioner's Office, which is the UK's supervisory authority for data protection, and you can do that whether or not you have come to us first. The ICO takes complaints at ico.org.uk/make-a-complaint, and on its helpline, 0303 123 1113.
Changes to this notice
The date printed under the heading at the top of this page is the date this version took effect. When any of it changes, that date changes in the same edit, and there is one current version rather than an archive of superseded ones.
How to contact us
For anything in this notice, to exercise any of the rights above, or to ask about the safeguard for the transfer described above, write to us at: