Privacy Policy
Who we are
This website is operated by Runeflake. We build fixes for small businesses that are losing enquiries or losing hours to admin.
For the purposes of data protection law, Runeflake is the controller of the personal information described in this policy. That means we decide what is collected and what happens to it.
What this policy covers
This policy covers the Runeflake website and the enquiry form on it. It explains what we collect when you get in touch, what we do with it, how long we hold it and what you can ask us to do about it.
It does not cover the separate agreement we would put in place if you went on to work with us. That agreement sets out how we handle any data inside the systems we build for you, which is a different question from the one this page answers.
What we collect
There is one place on this site where you can give us information: the enquiry form on the Book a free call page. Nothing else on this site collects anything about you.
What you type in
- Name
- Required, so we know who we are replying to.
- Email address
- Required, so we can reply.
- Phone number
- Optional. Only used if you would rather we called.
- Message
- Optional. Whatever you choose to tell us.
What is recorded automatically
When the form is submitted, three further things are saved alongside it:
- IP address
- The address your request came from. We use it to stop the form being flooded with automated submissions.
- Browser user agent
- The description your browser sends about itself. It helps us tell a real enquiry from a bot.
- Page and time
- Which page you sent the form from, and when.
Your IP address is also held very briefly in the server's memory to limit how many submissions can come from one place in a minute. That short-lived copy is discarded within a couple of minutes and is never written to disk separately.
What we do not collect
We do not run analytics, advertising, heat-mapping or session recording on this site. We do not buy or enrich contact data, and we do not build a profile of you from your browsing. There is no automated decision-making and no profiling of any kind.
Why we use it, and our lawful basis
- To reply to your enquiry and arrange a call. Our lawful basis is legitimate interests — you asked us to get in touch, and answering is what you would reasonably expect. Where you are asking us to quote for work, we also rely on taking steps at your request before entering into a contract.
- To keep the form working and free of abuse. Our lawful basis is legitimate interests: keeping our own systems secure and usable.
- To keep records of what we agreed. Where we go on to work together, our lawful basis is contract, and in some cases legal obligation, such as keeping accounting records.
We do not use your details to send marketing. If that ever changes, we will ask you first and give you a way to stop it.
How long we keep it
We keep an enquiry for as long as we are dealing with it and for as long as it is useful to have a record of the conversation. If nothing comes of it, we delete it once it has clearly gone cold.
If we end up working together, the records that belong to that work are kept for as long as the law requires us to keep business and accounting records.
You can ask us to delete your enquiry at any time and we will, unless we are required to keep it.
How we protect it
Enquiries are stored in a database that is not reachable from the web. The page we use to read them is behind a password, locks out after repeated failed attempts, and is set never to be stored in any browser or intermediate cache. The form itself is rate-limited so it cannot be flooded.
No system is perfectly secure, and we would rather say so than promise otherwise. If something goes wrong in a way that puts your information at risk, we will tell you and the regulator where the law requires it.
Your rights
Data protection law gives you the following rights over your information. They are free to use, and we will respond within one month.
- Access — ask for a copy of what we hold about you.
- Rectification — ask us to correct anything wrong or incomplete.
- Erasure — ask us to delete it, where we have no good reason to keep it.
- Restriction — ask us to pause what we do with it while something is sorted out.
- Objection — object to us relying on legitimate interests, including for any marketing.
- Portability — ask for a copy in a portable format, where that right applies.
- Withdraw consent — where we ever rely on consent, take it back at any time.
To use any of them, send us a message through the contact form and say what you want us to do. We may ask you to confirm who you are before we act, so that we do not hand your information to somebody else.
Complaints
If you are unhappy with how we have handled your information, please tell us first so we can put it right.
You also have the right to complain to the data protection regulator. In the UK that is the Information Commissioner's Office, at ico.org.uk. If you are in the EU, you can complain to the supervisory authority where you live.
Children
This site is aimed at people running a business. It is not intended for children, and we do not knowingly collect information about them. If you think a child has sent us their details, tell us and we will delete them.
Changes to this policy
If what we do changes, this page changes with it, and the date at the top is updated. There is no archive of older versions, so if a particular wording matters to you, keep your own copy.
How to contact us
For anything about this policy or the information we hold, use the contact form and say that your message is about privacy, so it reaches the right person.