Privacy notice

AUTH LTD is the data controller for the personal information described here. That means we decide what is collected through this website and what happens to it afterwards.

We have not appointed a Data Protection Officer. A company of our size and processing profile is not required to, and privacy questions go straight to the address above rather than through an intermediary.

This notice covers personal information we collect through authltd.com — in practice, the contact form and the email conversation that follows it.

It does not cover personal data we process inside a client's own product on their instructions. In that situation the client is the controller and we act as their processor, and the terms are set by the data processing agreement in the engagement contract, not by this page.

Information you send us

The contact form asks for:

• Your name.
• Your email address.
• Your company or organisation.
• A free-text message describing what you want to build.
• Qualification details you choose to give us: the service line you are interested in, an indicative budget range, and how you heard about us.

Only your name, email address and message are required. The rest is optional and the form works without it. We do not ask for a phone number, a postal address, or anything else we would not use.

Please do not put confidential material, credentials, or special category data — health, biometrics, political or religious views and the like — in a first message. We do not need it to reply to you and we do not ask for it.

Information collected automatically

When you load a page, our hosting provider processes the technical data it needs to serve the request and keep the service secure: your IP address, your browser and device user agent, the page requested, and the time of the request. We do not join that data to anything you send through the contact form, and we do not use it to build a profile of you.

We use your information for three things, each with a lawful basis under the UK GDPR:

Where we rely on legitimate interests, we have weighed our interest against your rights. Sending a business enquiry to a company and receiving a reply is what you would reasonably expect, and you can object to that processing at any time.

We do not use your information for automated decision-making or profiling. We do not sell it. We do not add people who send an enquiry to a marketing list.

We keep this list short deliberately. These are the third parties that handle personal information on our behalf:

We may also disclose information where the law requires it, or to our professional advisers where that is necessary — for example if a dispute arose. Nobody else receives it.

Transfers outside the UK

Resend and Vercel are United States companies, so your information may be processed outside the UK and the European Economic Area. Where that happens we rely on the safeguards those providers have in place — the UK International Data Transfer Addendum to the European Commission's standard contractual clauses, or another approved transfer mechanism. Email us if you want the detail for a specific provider.

• Enquiries that do not lead to work. We keep the email and any notes for 24 months from our last contact with you, then delete them. That window lets us recognise a returning enquiry instead of asking you to explain your project twice.
• Enquiries that lead to an engagement. These become part of the client record and are kept for the life of the relationship and for six years after it ends. Six years matches the limitation period for contract claims in England and Wales and the period HMRC expects business records to be kept.
• Technical and hosting logs. Retained by our hosting provider for the short operational and security window it applies, then discarded. We do not copy them anywhere else.

If you ask us to delete your enquiry sooner, we will, unless we have a legal reason to keep it. There is no separate database — deleting an enquiry means deleting the email.

Under the UK GDPR you have the right to:

• Access — ask for a copy of the personal information we hold about you.
• Rectification — have anything inaccurate corrected.
• Erasure — ask us to delete your information.
• Restriction — ask us to pause processing while something is being resolved.
• Object — object to processing we base on legitimate interests.
• Portability — receive information you gave us in a structured, machine-readable form.

If we ever rely on consent for something, you can withdraw it at any time. Nothing described in this notice currently relies on consent.

To exercise any of these rights, email hello@authltd.com. There is no charge, and we will respond within one month. We may ask you to confirm who you are first, so that we do not hand someone's information to the wrong person.

Complaints

If you think we have handled your information badly, tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection, at ico.org.uk. You do not have to come to us first.

What we measure, and how

We use Vercel Web Analytics and Vercel Speed Insights to count visits, see which pages people arrive on, and monitor how quickly pages load. We use them because we need to know which pages bring us enquiries and whether the site is fast enough to be useful — not to build a profile of you.

Both are cookieless. They do not set a cookie, do not write to local storage, and do not assign you a persistent identifier that follows you between sessions or across other websites. There is no tag manager, no advertising pixel, and no session recorder on this site.

What is processed is limited to the page you viewed, the referring page, and coarse device and country information derived from your request. Our lawful basis is Article 6(1)(f) — our legitimate interest in understanding whether our own website works. Vercel acts as our processor and is based in the United States; transfers are made under the safeguards described in clause 05.

Why there is no cookie banner

The Privacy and Electronic Communications Regulations require consent before storing information on, or reading information from, your device. Because the measurement described above stores nothing on your device, that requirement is not triggered, so this site does not ask you to accept cookies. Our hosting provider may set a small number of strictly necessary cookies to deliver the site securely; those are exempt from consent in any case.

You can object to this processing at any time under clause 07, and browser-level “do not track” or blocking extensions will prevent it entirely.

The site is served over HTTPS, so what you type into the contact form is encrypted in transit. We do not run a database or a CRM, so your enquiry lives in two places only: the email delivered to our inbox, and our hosting provider's server logs, where the submission is recorded so that a delivery failure cannot silently lose it. Those logs are retained by Vercel for a limited period and then discarded. Access to both is limited to the people at AUTH LTD who need it.

We do not take payment details on this website. No method of transmitting information over the internet is completely secure, so while we take reasonable steps to protect what you send us, we cannot guarantee absolute security.

This website is aimed at businesses. It is not directed at children and we do not knowingly collect personal information about anyone under 18 through it. If you believe a child has sent us information, email us and we will delete it.

We update this page when what we do changes. The date at the top is the date of the current version. If a change materially affects how we use information you have already given us, we will contact you about it rather than rely on you re-reading this page.

For anything in this notice, including a rights request, contact us: