Last updated: 11 October 2026
Who we are and how to contact us
Beriden Solutions is a UK-based website and digital-solution business. We are the controller of personal information used to manage our website, enquiries and business relationships: we decide why and how it is used. For privacy questions, complaints or rights requests, email hello@beriden.co.uk or use our contact form, marking your message “Privacy”.
This notice covers this website and our own business communications. Where we handle personal information within a client’s system solely on that client’s instructions, the client’s privacy notice and our agreed data-processing terms govern that work. Products linked from Beriden Labs may have separate privacy notices.
Personal information and its sources
Enquiries: the contact form asks for your name, email address, service choice and message; your business or organisation is optional. If you arrive from a selected package, that package name is also submitted. The form sends your privacy-notice acknowledgement and includes a hidden spam-detection field. We receive any project details or other personal information you include in your message.
Email and client communications: when you email us, we receive your email address, message, email headers and any signature or attachments. If you become a client, records may also include business contact details, proposals, agreed scope, correspondence, support information and invoice or transaction records needed for that relationship. This website has no account registration, payment-card collection or file-upload field.
Technical information: hosting and form providers receive information needed to deliver and protect their services, such as IP address, browser or device information, requested page, referring page, request time, response details and security-cookie information. Formspree receives technical information when you submit the form. We do not run advertising pixels or behavioural analytics on this website.
Most enquiry information comes directly from you. A colleague or client may give us your business contact details so we can work with you; in that case we use them for that business relationship and explain their source when appropriate. Please send only information needed for your enquiry. Do not send passwords, payment-card details, identity documents, health information or other sensitive personal data through the form.
Purposes and UK GDPR lawful bases
Answering enquiries and preparing proposals: where you are the prospective contracting individual, we rely on steps taken at your request before entering a contract (Article 6(1)(b)). For general enquiries or where you represent an organisation, we rely on legitimate interests (Article 6(1)(f)) in answering relevant requests and establishing business relationships.
Delivering agreed services and support: we rely on performance of a contract with you (Article 6(1)(b)); for contacts acting on behalf of a business client, our legitimate interest is managing and delivering that business relationship (Article 6(1)(f)).
Operating and protecting the website and communications: we rely on legitimate interests (Article 6(1)(f)) in keeping services available, diagnosing faults and preventing spam or abuse. Managing necessary correspondence and establishing or defending legal claims also relies on legitimate interests. We must consider the necessity of this use and balance our interests against your rights.
Accounting, tax and legally required disclosures: where the law requires the processing, we rely on legal obligation (Article 6(1)(c)). We use only the records needed for the relevant requirement.
The form’s acknowledgement confirms that you have seen this notice; it is not consent to marketing and is not the lawful basis for handling your enquiry. We do not use the form to subscribe you to a mailing list. If we introduce processing that requires consent, we will explain it and request consent separately; you can withdraw that consent at any time without affecting earlier lawful processing.
Providing enquiry information is your choice, not a statutory requirement. The fields marked required are needed to process a form enquiry and reply; without them the form cannot be submitted. You can email us instead. Additional details may be necessary to prepare a proposal or deliver an agreed service.
Recipients and how information is disclosed
Formspree, Inc.: when you press “Send enquiry”, your browser sends the form fields directly to Formspree over HTTPS. Formspree processes submissions and spam checks and may store submissions and associated technical information as part of its service. See Formspree’s privacy policy.
Purelymail (Add Rabbit LLC): our enquiry workflow uses Formspree to deliver messages to our Purelymail business inbox at hello@beriden.co.uk. This mailbox and a previously delivered website form submission have been verified. Purelymail handles email contents, sender and recipient addresses, attachments and delivery metadata. Direct emails also pass through your email provider and our email service. See Purelymail’s privacy policy. The website itself does not save a separate copy of form submissions in a Beriden website database.
Hosting and network services: the website is published through OpenAI Sites and served using Cloudflare infrastructure. These services handle web requests and associated technical information to host, deliver and protect the site. See OpenAI’s privacy policy and Cloudflare’s privacy policy.
Where necessary for a particular client engagement, relevant information may be shared with agreed technical providers; the services and data involved should be identified in the engagement arrangements. Business records may be disclosed to accountants, legal advisers or public authorities where needed for professional advice, legal obligations or legal claims. Disclosure may be by email, an agreed service platform or a response to a lawful request. We do not sell personal information. We share only information relevant to the purpose.
International processing and transfers
Information is not necessarily kept in the UK. Formspree states that its services are hosted in the United States. Purelymail states that its servers are in AWS’s US-East-1 region in northern Virginia. Cloudflare operates internationally and states that security-cookie data may be processed in the United States by default. Hosting, support and provider subprocessors may also involve processing outside the UK.
UK GDPR requires an applicable transfer mechanism for restricted international transfers, such as UK adequacy regulations or appropriate contractual safeguards, including the UK International Data Transfer Agreement or the UK Addendum to EU Standard Contractual Clauses, together with any required assessment. Formspree publicly states that it relies on Standard Contractual Clauses as a processor. That statement alone does not confirm the UK arrangements applying to our account.
The account-specific UK transfer safeguards and provider processing arrangements have not yet been verified. We therefore do not claim that a particular adequacy decision, UK Addendum or agreement covers every transfer. Contact us to request the countries and safeguards relevant to your information and a copy or explanation of any applicable safeguards. We will update this notice when those arrangements are confirmed.
Security
The live website uses HTTPS, and the form submits directly to an HTTPS Formspree endpoint. This encrypts traffic between your browser and those endpoints. The form includes a hidden field to help identify automated spam, and Cloudflare provides traffic-protection features on the live site.
Formspree reports encryption of its databases at rest and TLS protection for browser traffic. Purelymail reports encryption of permanent storage and SSL-enabled mail access; it describes transport encryption for mail delivery as used where possible. Our mailbox has spam filtering enabled. Search indexing is also enabled; Purelymail explains that its search indexes are not password-encrypted and may contain recoverable message information. These measures do not mean that every email is end-to-end encrypted or that all Beriden devices and accounts have the same controls. We do not claim multifactor authentication is enforced across our systems. Controls on other accounts and devices, and our own backup configuration, have not been verified for this notice. No internet or email service can guarantee absolute security.
Retention periods and criteria
Enquiries that do not become work: we retain information for the time needed to answer, prepare any requested proposal and complete reasonable follow-up. Relevant criteria are whether the discussion is still active, the date of the last meaningful contact and whether a complaint or dispute remains unresolved. Unneeded records should be deleted or anonymised when that purpose ends.
Client and support records: retention depends on the duration of the engagement, ongoing support or warranty needs, outstanding payments, contractual commitments and any applicable legal-claim period. Accounting and tax records are retained for the period required by the rules applicable to the business and the record concerned. A legal hold or unresolved dispute may require relevant records to be kept longer.
Provider copies and technical logs: retention is also affected by provider settings and backup cycles. Formspree’s policy gives purpose-based retention criteria rather than a fixed deletion period for our submissions, and its submission-history limits vary by plan. Purelymail publishes a 30-day diagnostic-log period and a one-month backup period for deleted email messages. Those provider periods do not mean that messages still in our inbox are deleted automatically after a month. Our webmail is currently set not to clear “Deleted Items” automatically on logout, and no automatic deletion filter was configured when reviewed. Moving a message to that folder does not permanently erase it; it remains until permanently removed, after which provider backup retention may still apply.
A fixed Beriden deletion schedule, Formspree account deletion settings and hosting-log retention periods have not yet been confirmed. The criteria above explain how retention is determined without promising an unverified automatic deletion deadline. Contact us about a particular record or to request deletion; legal and contractual retention requirements may limit what can be removed.
Your rights and requests
Subject to the applicable conditions, you can request access to your personal information and a copy, correction of inaccurate information, deletion, restriction of processing, and portability of information you supplied where processing is automated and based on consent or a contract. You can withdraw consent where we rely on it. These rights are not absolute; we will explain any lawful reason for refusing or limiting a request.
Your right to object: you can object to processing based on legitimate interests for reasons relating to your situation. We must stop unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims. You can object to direct marketing at any time.
Email hello@beriden.co.uk or use the contact form to make a request. We may ask for proportionate information to confirm your identity. We normally respond within one month, subject to lawful extensions or pauses; if an extension is needed, we will explain it. Requests are normally free, although the law permits charges or refusal in limited cases.
You may complain to us and have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint. You do not have to contact us first to exercise that right.
Cookies and similar technology
The current website has no advertising pixels, behavioural-analytics scripts or application cookies for marketing. Cloudflare sets security cookies to distinguish legitimate visitors from automated traffic. The __cf_bm cookie was observed on the live website; Cloudflare says it expires after 30 minutes of continuous inactivity and is used for bot protection. Its cookie data includes information used to calculate a bot score, and may include a session identifier when relevant protection features are enabled.
Cloudflare may also use challenge-related cookies when its security checks require them. See Cloudflare’s cookie documentation for purposes and lifetimes. Security cookies needed to provide and protect the requested service are used as necessary cookies, rather than for advertising. You can block or delete cookies through your browser, but this may affect access or security checks.
The enquiry form uses a direct submission request rather than an embedded Formspree widget. Visiting a provider’s own website is governed by that provider’s cookie information. If we introduce non-essential tracking, we will update this notice and obtain consent where required before it starts.
Children and sensitive information
This business website and its enquiry form are intended for business contacts, not directed at children. We do not ask for children’s information or sensitive personal data. If a message includes a child’s information or unnecessary sensitive information, contact us so we can assess what should be removed and whether any lawful retention is necessary. Do not include client, employee or child records in an initial project enquiry.
Automated decisions and changes
This website does not make solely automated decisions about you with legal or similarly significant effects. Provider spam and bot checks may affect whether a message is accepted or a page can be accessed; you can contact us if you encounter a problem. This is separate from any features of client systems or products with their own notices.
We will update this notice as our services, providers or handling of personal information change. The latest version remains at this /privacy page, with the revision date above.