Privacy policy

01Introduction

Unovo Limited (“we”, “our”, “us”) is a private limited company registered in England and Wales (Company No: 16375453) with its registered office at Steel City Stadium, Olympic Legacy Park, Worksop Rd, Sheffield, S9 3TL. We are committed to protecting and respecting your privacy.

This Privacy Policy explains how we collect, use, and protect personal data about you when you use our website, engage with our services, or interact with us.

We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and all other applicable data protection laws.

02Information we collect

We may collect and process the following categories of personal data:

Information you provide directly

• Name, email address, phone number, company name, job title.
• Information submitted through contact forms, proposals, or project discussions.

Information from our relationship with you

• Project details, communication history, billing and payment information.

Technical information

• IP address, browser type, operating system, referring URLs, and pages visited.
• Information collected through cookies and similar technologies.

Marketing and communications data

• Your preferences in receiving marketing communications.
• Your interactions with marketing emails (e.g. opens and clicks).

We only collect the minimum personal data necessary to provide our services and operate our business.

03How we use your data

We process your personal data for the following purposes, and always on a lawful basis (UK GDPR Article 6):

To provide services (performance of a contract)

• Responding to enquiries.
• Managing projects, proposals, and deliverables.

To operate our business (legitimate interests)

• Maintaining client records.
• Improving our website, services, and marketing.
• Ensuring IT security and preventing fraud.

To send you marketing communications (consent or legitimate interest, depending on context)

• Sharing news, updates, and information about our services.
• You can opt out of marketing at any time.

To comply with legal obligations

• Tax, accounting, and record-keeping requirements.

04Sharing your data

We do not sell your personal data, and we do not pass it to anybody for their own marketing. A small number of providers process it on our behalf so that we can run the business, and they are named below rather than described as categories.

The providers that process personal data on our behalf:

• Vercel

  Hosts this website and serves it to you.

  Anything you send through the site while it is in transit, plus server logs including your IP address.

• Krystal

  Hosts our own systems, including the one an enquiry becomes a record in. UK-based, so that data stays in the UK.

  Everything you send us through a form, and the record of any work we do together.

• Postmark

  Sends the email that tells us you have been in touch.

  Your name, email address and the message you wrote.

• Microsoft

  Runs our email and office systems, so anything you send us is stored in a mailbox there.

  Your contact details and the content of our correspondence with you.

• Slack

  Where our team is notified that an enquiry has arrived.

  Your name, email address, message and how you found us.

• Xero

  Our accounting system, where invoices and payment records are kept.

  Your name, business details and billing information, if you become a client.

• GoCardless

  Collects payments by Direct Debit where that is how you pay us.

  Your name, bank account details and your Direct Debit mandate and payment history. GoCardless collects those directly.

• Stripe

  Takes card payments where an invoice is paid that way.

  Your name, email address, the amount and the invoice reference. Card details go straight to Stripe: we never see or store a full card number.

• Google Analytics

  Counts visits and page views, and only runs if you accept analytics cookies.

  A cookie identifier, the pages you viewed and an approximate location.

• Microsoft Clarity

  Records how pages are used so we can see where a layout is failing. Also only with your consent.

  A cookie identifier and your interactions with a page.

• Motion

  Provides the calendar you use to book a call with us, where a page offers one.

  The name, email address and time you give it. Motion collects that directly, under its own terms.

The systems where an enquiry becomes a record and a project is run are built and operated by us, on the UK hosting named above. Nobody else runs them and nobody else is given access to what is in them.

We may also share your data, in specific circumstances only:

• With our professional advisers, such as accountants and legal advisers.
• With regulators or law enforcement, if we are legally required to.
• With a buyer, if the business or part of it is ever sold.

All third-party processors are contractually bound to keep your data secure and use it only for the purposes we specify. If this list changes we will update it here, and the date at the top of this page will move with it.

05International transfers

Our own systems are hosted in the UK, so the record of your enquiry and of any work we do together stays here.

Some of the providers named above are US companies and may transfer personal data outside the UK. Where this occurs, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses (SCCs).
• Adequacy regulations recognised by the UK Government.

06Data retention

We will only keep your personal data for as long as is necessary to fulfil the purposes we collected it for.

• Enquiries: up to 2 years from last contact.
• Client project data: retained for the duration of the engagement and for 6 years afterwards, for legal and accounting purposes.
• Marketing data: until you unsubscribe or withdraw consent.

When data is no longer needed, we securely delete or anonymise it.

07Your rights

Under UK GDPR, you have the following rights:

• To access your personal data (subject access request).
• To correct inaccuracies in your data.
• To request erasure (“right to be forgotten”).
• To restrict processing.
• To object to processing (including marketing).
• To data portability (where technically possible).
• To withdraw consent at any time (for marketing or other consent-based processing).

You can exercise these rights by contacting us at contact@unovo.io.

If you are not satisfied with our response, you have the right to complain to the Information Commissioner’s Office (ICO) at www.ico.org.uk.

08Security of your data

We use appropriate technical and organisational measures to protect personal data, including:

• Secure servers and firewalls.
• Encrypted data transmission (SSL/TLS).
• Regular updates and monitoring of systems.
• Restricted access controls within our organisation.

09Marketing communications

We may send you occasional information about what we do. If you are a client, or you have enquired about our services, we do this on the basis of our legitimate interest in telling people who have already shown an interest what we are working on. It is always relevant to the work, and it is never frequent.

If you are an individual, a sole trader or a partnership, we will only email you marketing where you have consented to it or where you are an existing customer and it relates to something similar to what you already bought.

Every marketing email carries an unsubscribe link, and using it stops everything immediately. You can also object at any time by replying to any email or writing to contact@unovo.io, and we do not need a reason.

We do not sell, rent, or share your details with anyone else for their own marketing.

10Cookies

Our website uses cookies to distinguish you from other users and improve your experience. For full details, see our cookie policy.

11Changes to this policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with the updated effective date.