Privacy policy.

Who we are

Zolveo is a trading name of Sax Ltd, a company registered in the Isle of Man under company number 136910C. Our registered office is Sandford Villa, Douglas, Isle of Man. Sax Ltd is the data controller for the personal data described in this policy.

This policy covers our website (zolveo.co.uk), enquiries and bookings made through it, and the personal data we handle when scoping and delivering projects for clients. It does not cover the systems we build for clients: those are operated by the client, who is the controller of the data inside them, and we act on the client's instructions as their processor under a written contract.

Which law applies

We are based in the Isle of Man, so we are regulated by the Isle of Man Information Commissioner and work under the Isle of Man Data Protection Act 2018 and the GDPR and LED Implementing Regulations 2018 (the "Applied GDPR"). Where we offer services to people in the United Kingdom, the UK GDPR and the Data Protection Act 2018 also apply to that data. The two regimes are closely aligned, and we apply the same standards to everyone.

What we collect, and why

We collect only what we need to respond to you, run a mapping session, prepare a quote and deliver a project. We do not buy personal data, scrape it, or collect it from social media.

When	What we collect	Why, and our lawful basis
You book a call	Your name, email address, the time you choose, and anything you type into the booking form (for example your company name or a note about your business). Cal.com also records the time zone your browser reports.	To hold the call and prepare for it. Lawful basis: taking steps at your request before entering into a contract.
You email us or speak to us	Your name, email address, phone number if you give it, your company, and the content of our correspondence and call notes.	To answer your enquiry and keep a record of what was discussed. Lawful basis: pre-contract steps and our legitimate interest in running the business and keeping accurate records.
You become a client	Contact details of the people we work with at your business, contract and billing details, project documentation, and support correspondence.	To deliver and support the project and to invoice for it. Lawful basis: performance of our contract with you, and legal obligations around accounting and tax records.
You visit the website	Our hosting provider's server logs record your IP address, browser type, the pages requested and the time of the request. We also use Vercel Web Analytics, which counts page views, referring sites, country and device type without cookies and without identifying you; it does not track you across other sites.	To keep the site secure and working, and to investigate faults or abuse. Lawful basis: our legitimate interest in security and reliability.

We do not use your data for automated decision-making or profiling, and we do not send marketing emails. If that changes, we will ask for your consent first and you will be able to withdraw it at any time.

Who we share it with

We do not sell personal data and we do not share it with anyone for their own marketing. We use a small number of service providers who process data on our behalf, under contracts that require them to protect it:

• Cal.com, Inc., which runs our booking page. When you book a session, your booking details are stored by Cal.com in accordance with its own privacy policy. Cal.com is headquartered in the United States; see "Transfers outside the Isle of Man" below.
• Google Fonts. Our pages load two typefaces from Google's font servers. To do this your browser sends a request to Google that includes your IP address. Google's handling of that request is described in its privacy policy. Google does not set cookies through the Fonts service.
• Vercel, which hosts this website and provides its cookieless visitor statistics, under its privacy policy.
• Our email provider, which stores our email correspondence. We choose providers with data centres in the United Kingdom or the European Union.
• Our accountants and professional advisers, where needed for accounting, tax, legal or insurance purposes.

We will also disclose personal data if the law requires it, for example to a court, regulator or law-enforcement body, or to protect our legal rights.

Transfers outside the Isle of Man

Our hosting is in the UK or the EU. The Isle of Man, the UK and the EU each recognise one another as providing adequate protection for personal data, so data can move between them without additional safeguards. Cal.com processes booking data in the United States; those transfers rely on the standard contractual clauses in Cal.com's data processing terms. If we add a provider outside these areas, we will make sure an appropriate safeguard is in place before any data is transferred.

How long we keep it

Enquiries and mapping-session notes that do not lead to a project	Two years from our last contact with you, then deleted.
Client contracts, project records and correspondence	Six years after the end of the engagement, which is the limitation period for contract claims, then deleted.
Invoices and accounting records	Six years after the end of the financial year they relate to, as required by tax and company law.
Website server logs	Ninety days, then deleted automatically.
Booking records held by Cal.com	According to Cal.com's retention policy. You can ask us to delete our copy at any time.

How we protect it

Security is central to how we work, for our own data as much as our clients'. Access to personal data is limited to the people who need it for their role, protected by strong passwords and two-factor authentication. Data is encrypted in transit and at rest with our providers, and backed up regularly so that a mistake or outage does not become a loss. If we ever suffer a breach that is likely to put you at risk, we will tell you and the relevant regulator without undue delay, and within 72 hours where the law requires it.

Your rights

You have the right to:

• ask for a copy of the personal data we hold about you (access);
• ask us to correct anything that is inaccurate or incomplete (rectification);
• ask us to delete your data where we no longer need it (erasure);
• ask us to stop or limit how we use it while a question is resolved (restriction);
• object to processing based on our legitimate interests;
• receive the data you gave us in a machine-readable format, or have it sent to another provider (portability);
• withdraw consent at any time, where consent is the basis we rely on.

To exercise any of these, email hello@zolveo.co.uk. We will respond within one month and will not charge you, unless a request is clearly unfounded or excessive. We may need to confirm your identity before acting on a request.

Complaints

If you are unhappy with how we have handled your data, please tell us first and we will do our best to put it right. You also have the right to complain to a supervisory authority:

• Isle of Man Information Commissioner, our lead regulator: www.inforights.im.
• Information Commissioner's Office (UK), if you are in the United Kingdom: ico.org.uk.

Cookies

This website does not set cookies and does not use advertising or social-media tracking. Our visitor statistics come from Vercel Web Analytics, which is cookieless and anonymous. The only other third-party requests the pages make are to Google Fonts (described above) and, if you choose to book a session, to Cal.com, which may set its own cookies on its booking page under its own policy.

Changes to this policy

We will update this page if our practices or the law change, and the date at the top will show when it was last revised. If a change materially affects how we use data we already hold about you, we will contact you directly.