Privacy Policy

1. Who we are

Cast Iron CAD Ltd is a private limited company registered in England & Wales, company number 07353071. Registered office: PlusX Innovation, Brighton, BN2 4GL. VAT registration: GB310485531. ICO registration: C1913062. We operate this Site under the trading brand “Innovate Engineer”. The brand name and domain are held by Innovate Engineer Ltd (company number 13687318), a non-trading entity that has authorised Cast Iron CAD Ltd to operate the Site and provide services under the Innovate Engineer brand. Cast Iron CAD Ltd is the data controller for all personal data collected through this Site.

Questions about this policy or your personal data should be directed to privacy@innovate.engineer. We have not appointed a statutory Data Protection Officer because we are not required to under UK GDPR Article 37, but the privacy contact above receives and handles all data protection enquiries.

2. Personal data we collect

• Contact form submissions: name, email address, company name (optional), and the content of your message. Submitted via our Sprint Intake form or our contact form and sent to Notion (Notion Labs Inc, US), where it is stored in our intake databases for lead management and service delivery. We do not store form submissions in the WordPress site database.
• Email correspondence: any information you include when you contact us directly.
• Technical data: IP address, browser type, device type, referring page, and pages visited. Collected via server logs and, where you consent, cookies.
• Cookie and analytics data: only where you give consent via the cookie banner. See section 7.

3. How we use your data and lawful basis

• To respond to enquiries – lawful basis: legitimate interest (UK GDPR Article 6(1)(f)) in responding to business contact.
• To deliver services you have engaged us for – lawful basis: performance of a contract (Article 6(1)(b)).
• To maintain site security and prevent fraud – lawful basis: legitimate interest in operating a secure service.
• For analytics and site improvement – lawful basis: consent (Article 6(1)(a)), withdrawable at any time via the cookie banner.
• To comply with legal obligations – lawful basis: legal obligation (Article 6(1)(c)).

4. Data retention

• Contact enquiries: retained for 24 months from last contact, then deleted.
• Client records (where you become a client): retained for 7 years from end of engagement to satisfy UK accounting and statutory limitation periods.
• Server access logs: rotated and deleted after 30 days.
• Analytics data: aggregated only, retained up to 14 months.

5. Who we share data with (sub-processors and other recipients)

We use a small number of third-party service providers to operate this Site and our business. Most act as our processors and process data only on our documented instructions under a data processing agreement (where applicable). Where a provider acts as an independent controller in its own right – for example OpenAI, below – that is stated in its entry, and that provider’s own terms and privacy policy govern its processing:

• OpenAI (ChatGPT) – the free Viability Sprint runs as a custom GPT hosted inside ChatGPT. You choose whether to run it, and you do so on your own ChatGPT account under OpenAI’s own terms and privacy policy. For that interaction OpenAI acts as an independent data controller, not as our processor: you interact with OpenAI directly, we do not transmit your personal data to OpenAI, and the custom GPT configuration does not give Innovate Engineer or Cast Iron CAD Ltd access to, or a copy of, your individual sprint conversations. Please do not submit information you would not share with a third-party AI service.
• Email hosting and delivery – handles inbound contact form submissions and outbound correspondence (UK/EU hosted).
• Website hosting and infrastructure – the Site is hosted on infrastructure operated by Cast Iron CAD Ltd. As Cast Iron CAD Ltd is also the data controller, no separate processor relationship exists for hosting.
• Notion (Notion Labs Inc, US) – project and client management platform. Sprint Intake form data is transmitted to and stored in Notion via API. Data is stored on Notion servers (US) under Standard Contractual Clauses and the UK International Data Transfer Addendum.
• Google Analytics 4 (Google LLC) – only if you consent. Data transferred to Google servers including outside the UK/EU under Standard Contractual Clauses and the UK Addendum. IP addresses are anonymised.
• Complianz – cookie consent plugin. Consent records stored locally.

6. International data transfers

Where personal data is transferred outside the UK or European Economic Area (EEA) – notably for Google Analytics and Notion – we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses and the UK adequacy mechanism where applicable. Details available on request.

7. Cookies

We use a minimum set of cookies. Strictly necessary cookies (session, security, consent record) are set without consent, as permitted under PECR regulation 6(4). All other cookies – including analytics, marketing, and embedded third-party content – are set only after you give explicit, informed consent via the cookie banner. You can change or withdraw consent at any time by clicking “Cookie settings” in the footer. Consent is requested again after 12 months, or sooner if our cookie categories change. Full detail in our Cookie Policy.

8. Your rights

Under UK GDPR you have the right to: access your personal data, correct inaccurate data, request deletion (“right to be forgotten”), restrict processing, object to processing based on legitimate interest, request portability of data, and withdraw consent at any time. To exercise any of these rights, email privacy@innovate.engineer. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk. Cast Iron CAD Ltd is registered with the ICO under registration number C1913062.

9. Form submissions (Sprint Intake and contact forms)

When you submit the Sprint Intake form on innovate.engineer/start or the contact form on innovate.engineer/contact: (i) your submission is sent via API to our Notion workspace and stored in our intake databases in Notion for up to 24 months, (ii) we use this data to route you to the appropriate service tier and to follow up on your enquiry, (iii) we do not share it with third parties except as set out in section 5, and (iv) you may request deletion at any time via the email address above. The data controller for this submission is Cast Iron CAD Ltd.

10. Changes to this policy

We will post any changes to this policy on this page with an updated “Last updated” date. Material changes (including any change to the data controller, sub-processors, or retention periods) will be announced via the site and, where we have your email, by direct notice.