Legal
Privacy Policy
This policy explains what personal data Bundlespoppi Digital Labs Ltd processes when you use bundlespoppi.cfd, why we process it, who we share it with and how you can exercise your rights. Last updated 12 January 2026.
1. Who we are
Bundlespoppi Digital Labs Ltd ("Bundlespoppi", "we", "us") is the data controller for personal data processed through this website. We are registered in England and Wales under company number 15482097, with a registered office at Unit 4, 27 Kingsland Road, London E2 8AA, United Kingdom. You can reach our data protection contact at [email protected] or by post at the registered address, marked "Data Protection".
2. What data we collect
We keep collection deliberately narrow. We process the following categories:
- Contact form data — the name, email address, optional organisation name, enquiry category and message you submit through our contact page.
- Email correspondence — the content and metadata of messages you send to any bundlespoppi.cfd address.
- Technical data — IP address, user agent, requested URL, referring URL and timestamp, recorded in server logs for security and troubleshooting.
- Cookie and preference data — your cookie choice and any interface preferences stored locally in your browser, as described in our Cookie Policy.
- Aggregate usage data — anonymised or pseudonymised measurements of which style guides are opened and which specifications are copied, collected only where you have consented to analytics cookies.
We do not ask for special category data, we do not knowingly collect data from children under sixteen, and we do not operate accounts, payments or user profiles on this site.
3. Why we process it, and on what legal basis
Under the UK GDPR and the EU GDPR we rely on three bases. Legitimate interests cover keeping the site secure, preventing abuse of the contact form, and maintaining server logs; our interest in operating a safe website is balanced against the limited nature of the data. Consent covers analytics and functional cookies and any optional marketing email; you may withdraw it at any time without affecting the lawfulness of earlier processing. Contract and pre-contract steps cover replying to a consultation enquiry and negotiating any work that follows.
4. Processors and third parties
We use a small number of service providers who process data on our instructions under written terms: a website hosting and content delivery provider, which stores server logs and serves the site; a transactional email provider, which delivers contact form submissions to our inbox; and a privacy-focused analytics provider, activated only after consent. Image placeholders on the site are requested from a third-party image service, which receives your IP address as part of the ordinary HTTP request. We do not sell personal data, we do not share it with advertising networks, and we do not use it for automated decision-making or profiling.
Where a processor stores data outside the United Kingdom or European Economic Area, we rely on adequacy regulations or on the International Data Transfer Addendum and Standard Contractual Clauses, together with encryption in transit and at rest. A current list of processors and their locations is available on request from our data protection contact.
5. Retention
Contact form submissions and related correspondence are kept for twenty-four months from the last message in the thread, then deleted, unless the enquiry becomes a client engagement, in which case records are kept for six years to satisfy contractual and tax obligations. Server logs are retained for ninety days. Analytics data is retained in aggregate for fourteen months. Cookie choices persist in your browser for twelve months or until you clear site data.
6. Your rights
If the UK or EU GDPR applies to you, you have the right to be informed, the right of access, the right to rectification, the right to erasure, the right to restrict processing, the right to data portability, the right to object to processing based on legitimate interests, and the right to withdraw consent. To exercise any of these, email [email protected]. We respond within one month and may ask for information to confirm your identity. You can also complain to the Information Commissioner's Office at ico.org.uk or to your local supervisory authority.
If you are a California resident, the CCPA as amended gives you the right to know what personal information we collect and disclose, the right to delete it, the right to correct inaccurate information, and the right to opt out of sale or sharing. We do not sell or share personal information as those terms are defined, and we do not discriminate against anyone exercising these rights. Requests can be made to the same address and will be verified using the email address associated with your enquiry; an authorised agent may act for you with written permission.
7. Security
The site is served exclusively over HTTPS. Access to the contact inbox and hosting console is restricted to named personnel and protected by multi-factor authentication. We keep dependencies minimal — this site ships no third-party JavaScript frameworks or tag managers — which reduces the attack surface and the number of parties who can observe your visit.
8. Changes to this policy
We update this policy when our processing changes. The date at the top of the page records the latest revision, and material changes will be announced on the home page for at least thirty days. Questions about any version, current or historic, can be sent to [email protected]. Related documents: Terms of Service and Cookie Policy.