How we handle your data.

Short version: we keep what you send us so we can reply and do the work. We pass it to the services that run our websites, email and AI tools, and otherwise only to our professional advisers or where the law requires it. We delete it when we no longer need it.

Who we are

Hppn is the trading name of two companies. Each is a separate controller, which means each is responsible for the personal data it holds. Hppn Studios Ltd (company number 17269553) is the controller for enquiries sent through hppn.co.uk and enjn.ai, and for new Hppn work. Hppn Limited (company number 13383140) is the controller for the information it holds under its own existing client engagements. The proposal or engagement letter names the company responsible for your project. Both companies are registered in England and Wales at 14 High Street, Saffron Walden, Essex CB10 1AY. Questions about this notice go to hello@hppn.co.uk.

What we collect, and why

When you send us a problem or a key, or write to us. Your name, email address and company, and what you tell us: the problem, what is riding on it and by when, or the question you must answer, the date and who will ask, and anything else you write. We use it to reply, to understand what your organisation needs, and to arrange the first conversation. We rely on our legitimate interest in handling business enquiries. If you are contracting with us personally, we may instead rely on the steps you ask us to take before a contract.

Other people you mention. The "who will ask" blank, and your message, may name other people, such as a board member or a buyer. We may also look up business contact and role information about your company and its people on company websites, Companies House and similar public business sources. We use this only to understand and answer your enquiry, relying on legitimate interests. Please do not put sensitive personal data or confidential client material in the form. Contact us first if you need to share it.

When we talk. Notes from calls and meetings, kept so we can do what we said we would. We rely on legitimate interests.

When you visit the sites. We set no cookies and use no analytics. If you choose a light or dark theme, the site stores that choice under the name "hppn-theme" in your browser's local storage, until you change it or clear your storage. We use it only to show the theme you asked for, so we do not ask for consent. Netlify, which hosts the sites, processes technical request information on our behalf to deliver, protect and operate them: your IP address, the page requested, the time, your browser type, the referring page, your country and a request identifier. We rely on our legitimate interest in running reliable, secure websites. How long Netlify keeps it is set by our agreement and settings with Netlify.

Records the law requires. We keep the records that tax, accounting and company law require us to keep. We rely on our legal obligations for those.

Who handles it for us

We pass personal data only where necessary to the services that host our websites, capture form submissions, screen spam, carry our email and documents, or provide the business AI services described below. We may also disclose it to our professional advisers, or to public authorities where the law requires it. We do not sell personal data.

• Netlify, Inc. hosts the sites and captures form submissions. Netlify Forms currently screens submissions for spam with Akismet. Netlify and its authorised subprocessors process the submission under our agreement with Netlify.
• Google Workspace carries our email and documents, under Google's data processing terms.
• AI services. We may use AI tools to help us read what you sent and prepare for a conversation, using your message and public information about your company. We use commercial AI services, on settings where the provider says it does not use what we send or receive to train its general models unless we opt in. We don't opt in. Providers may keep or review limited data for security, abuse prevention, support or legal compliance, as their business terms describe. See how we use AI.

Where it goes

Some of these providers process personal data outside the UK. Where that happens we rely on a UK adequacy regulation, on the UK Extension to the EU-US Data Privacy Framework for providers that take part in it, or on contractual safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. Email us if you would like to know which safeguard applies to a particular provider.

How long we keep it

We keep an enquiry for twelve months after our last substantive contact about it. If an engagement begins, we keep the project correspondence and the contractual records for the engagement and for up to six years afterwards, where we need them for accounting, legal claims or other legal obligations. We delete or anonymise information we no longer need. Deletion from a provider's backups may take a further limited period under that provider's process. You can ask us to delete your data sooner, and we will, unless we need it for a legal reason.

Your rights

Under UK data protection law you can ask us for a copy of your personal data, ask us to correct or delete it, object to or restrict how we use it, and, for some information processed automatically on the basis of consent or a contract, ask for it in a portable form. These rights do not apply in every circumstance. We normally respond within one month, after any identity checks we need to make. For a complex request, or several at once, we may take up to two further months, and we will tell you within the first month if so.

You can make a data protection complaint to us at hello@hppn.co.uk. We will acknowledge it within 30 days, look into it, and tell you the outcome as soon as we can. You can also complain to the Information Commissioner's Office at ico.org.uk.

Clients

When we work for you, we normally process your project data only on your instructions, as your processor under our contract. You are responsible for telling the people whose data it is how it is used. The Hppn company named in the engagement is the controller for its own business contacts, billing, security and legal records, and this notice covers those.

Changes

We keep this notice under review and show the date of the latest change at the top. If a change materially affects how we use information we already hold, we will take reasonable steps to tell the people affected before the new use begins.