Privacy Policy | Flux Technology

Flux Technology ("we", "us", "our") is committed to protecting your personal data and respecting your privacy. This policy explains what information we collect, why we collect it, how we use it, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Our website is www.flux-technology.co.uk. The data controller is Flux Technology, operated by Cameron Shields, United Kingdom. If you have any questions, contact us at contact@flux-technology.co.uk.

1. Information we collect

We collect information in the following ways:

Information you provide directly

Contact and enquiry forms — name, email address, company name, and the content of your message when you submit a build plan request or general enquiry.
Account registration — email address and password (stored as a secure hash) when you create an account.
Newsletter sign-up — email address if you opt in to our mailing list.
AI Assessment tool — responses you submit through our AI readiness assessment. These are used solely to generate your personalised report and are not shared with third parties.

Information collected automatically

Usage data — pages visited, time on site, referral source, and browser/device type, collected via analytics cookies (see our Cookie Policy).
IP address — logged by our hosting infrastructure for security and fraud prevention.

2. How we use your information

We use your personal data only for the purposes set out below and always on a lawful basis:

To respond to your enquiries — processing contact form submissions and build plan requests (lawful basis: legitimate interests / pre-contractual steps).
To deliver our services — project communication, delivery, and account management (lawful basis: contract performance).
To send marketing communications — newsletters and product updates, only where you have opted in (lawful basis: consent). You can unsubscribe at any time via the link in any email.
To improve our website — analysing aggregated usage data to understand how visitors use the site (lawful basis: legitimate interests).
To comply with legal obligations — retaining records as required by UK law (lawful basis: legal obligation).

We do not sell your personal data to any third party, ever.

3. Sharing your information

We share your data only with trusted third-party service providers who help us operate the site and deliver our services. Each provider is bound by a data processing agreement and handles your data only on our instructions:

Supabase — database and authentication hosting (data stored in EU region).
Vercel — website hosting and edge network.
Google Analytics — anonymised website analytics. Google's privacy policy: policies.google.com/privacy.
Email service providers — for transactional and marketing emails where you have opted in.

We may also disclose your information if required to do so by law, a court order, or a regulatory authority.

4. International transfers

Some of our service providers process data outside the UK or EEA. Where this occurs, we ensure appropriate safeguards are in place (such as UK adequacy decisions or standard contractual clauses) in compliance with UK GDPR Chapter V.

5. Data retention

We retain your personal data for as long as necessary for the purposes described in this policy:

Enquiry / contact data — 2 years from last contact, unless a project contract is entered into.
Client project data — 6 years from project completion (UK statutory limitation period).
Marketing opt-ins — until you unsubscribe or withdraw consent.
Account data — until you delete your account, then 30 days for backup retention before permanent deletion.

6. Your rights

Under UK GDPR you have the following rights in relation to your personal data:

Right of access — request a copy of the data we hold about you.
Right to rectification — ask us to correct inaccurate or incomplete data.
Right to erasure — request deletion of your data ("right to be forgotten"), subject to legal retention requirements.
Right to restrict processing — ask us to limit how we use your data in certain circumstances.
Right to data portability — receive your data in a structured, machine-readable format.
Right to object — object to processing based on legitimate interests or for direct marketing.
Rights related to automated decision-making — we do not use fully automated decision-making that produces legal or similarly significant effects.

To exercise any of these rights, email us at contact@flux-technology.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

7. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include encrypted connections (TLS), hashed password storage, and access controls limited to authorised personnel. No method of transmission over the internet is 100% secure, so we cannot guarantee absolute security.

8. Children's privacy

Our website and services are not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.

9. Links to other websites

Our website may contain links to third-party websites. This privacy policy applies only to flux-technology.co.uk. We are not responsible for the privacy practices of external sites and encourage you to read their policies.

10. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or legal requirements. The "last updated" date at the top of this page will reflect any changes. We encourage you to review this policy periodically. For material changes, we will notify active users by email where we hold your address.

11. Contact us

For any questions about this privacy policy or how we handle your data, please contact:

Flux Technology
Email: contact@flux-technology.co.uk
Website: www.flux-technology.co.uk