Privacy Policy

1. Who we are

Cast Iron CAD Ltd is a private limited company registered in England & Wales, company number 07353071. Registered office: PlusX Innovation, Brighton, BN2 4GL. VAT registration: GB310485531. ICO registration: C1913062. We operate this Site under the trading brand “Innovate Engineer”. The brand name and domain are held by Innovate Engineer Ltd (company number 13687318), a non-trading entity that has authorised Cast Iron CAD Ltd to operate the Site and provide services under the Innovate Engineer brand. Cast Iron CAD Ltd is the data controller for all personal data collected through this Site.

Questions about this policy or your personal data should be directed to privacy@innovate.engineer. We have not appointed a statutory Data Protection Officer because we are not required to under UK GDPR Article 37, but the privacy contact above receives and handles all data protection enquiries.

2. Personal data we collect

• Contact form submissions: name, email address, company name (optional), and the content of your message. Submitted via our Sprint Intake form and sent to Notion (Notion Labs Inc, US), where it is stored in our Sprint Intake database for lead management and service delivery. We do not store form submissions in the WordPress site database.
• Email correspondence: any information you include when you contact us directly.
• Technical data: IP address, browser type, device type, referring page, and pages visited. Collected via server logs and, where you consent, cookies.
• Cookie and analytics data: only where you give consent via the cookie banner. See section 7.

3. How we use your data and lawful basis

• To respond to enquiries – lawful basis: legitimate interest (UK GDPR Article 6(1)(f)) in responding to business contact.
• To deliver services you have engaged us for – lawful basis: performance of a contract (Article 6(1)(b)).
• To maintain site security and prevent fraud – lawful basis: legitimate interest in operating a secure service.
• For analytics and site improvement – lawful basis: consent (Article 6(1)(a)), withdrawable at any time via the cookie banner.
• To comply with legal obligations – lawful basis: legal obligation (Article 6(1)(c)).

4. Data retention

• Contact enquiries: retained for 24 months from last contact, then deleted.
• Client records (where you become a client): retained for 7 years from end of engagement to satisfy UK accounting and statutory limitation periods.
• Server access logs: rotated and deleted after 30 days.
• Analytics data: aggregated only, retained up to 14 months.

5. Who we share data with (sub-processors)

We use a small number of third-party service providers to operate this Site and our business. Each is bound by a data processing agreement (where applicable) and processes data only on our instructions:

• Email hosting and delivery – handles inbound contact form submissions and outbound correspondence (UK/EU hosted).
• Website hosting and infrastructure – the Site is hosted on infrastructure operated by Cast Iron CAD Ltd. As Cast Iron CAD Ltd is also the data controller, no separate processor relationship exists for hosting.
• Notion (Notion Labs Inc, US) – project and client management platform. Sprint Intake form data is transmitted to and stored in Notion via API. Data is stored on Notion servers (US) under Standard Contractual Clauses and the UK International Data Transfer Addendum.
• Google Analytics 4 (Google LLC) – only if you consent. Data transferred to Google servers including outside the UK/EU under Standard Contractual Clauses and the UK Addendum. IP addresses are anonymised.
• Complianz – cookie consent plugin. Consent records stored locally.

6. International data transfers

Where personal data is transferred outside the UK or European Economic Area (EEA) – notably for Google Analytics and Notion – we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses and the UK adequacy mechanism where applicable. Details available on request.

7. Cookies

We use a minimum set of cookies. Strictly necessary cookies (session, security, consent record) are set without consent, as permitted under PECR regulation 6(4). All other cookies – including analytics, marketing, and embedded third-party content – are set only after you give explicit, informed consent via the cookie banner. You can change or withdraw consent at any time by clicking “Cookie settings” in the footer. Consent is requested again after 12 months, or sooner if our cookie categories change. Full detail in our Cookie Policy.

8. Your rights

Under UK GDPR you have the right to: access your personal data, correct inaccurate data, request deletion (“right to be forgotten”), restrict processing, object to processing based on legitimate interest, request portability of data, and withdraw consent at any time. To exercise any of these rights, email privacy@innovate.engineer. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk. Cast Iron CAD Ltd is registered with the ICO under registration number C1913062.

9. Contact form specific disclosure

When you submit the Sprint Intake form on innovate.engineer/start: (i) your submission is sent via API to our Notion workspace and stored in the Sprint Intake database in Notion for up to 24 months, (ii) we use this data to route you to the appropriate service tier and to follow up on your enquiry, (iii) we do not share it with third parties except as set out in section 5, and (iv) you may request deletion at any time via the email address above. The data controller for this submission is Cast Iron CAD Ltd.

10. Changes to this policy

We will post any changes to this policy on this page with an updated “Last updated” date. Material changes (including any change to the data controller, sub-processors, or retention periods) will be announced via the site and, where we have your email, by direct notice.