Privacy Policy

This Privacy Policy explains how Alves Rowe Ltd collects and uses personal data through our website at alvesrowe.com, in particular when you contact us through the site. It also sets out your rights under UK data protection law (the UK GDPR and the Data Protection Act 2018).

Our takeoff software, Kestrel™, and its marketing site at takeoff.alvesrowe.com have their own separate privacy policy. This policy covers the alvesrowe.com consultancy website only.

1. Who we are

Alves Rowe Ltd is the data controller for the personal data described in this policy. We are a company registered in England and Wales (Companies House number 16682818), with registered office at 44 Belmore Road, Eastbourne, BN22 8BL. Our VAT registration number is GB 520 3368 24. Contact: [email protected].

2. What we collect

• Enquiry details. When you use our contact form, we collect your name, email address, and message, and optionally your company name and phone number if you choose to provide them.
• Fee schedule requests. When you ask us for our fee schedule, we collect your name, work email address, company name, when you might need us, and anything you tell us about your project. We also record the date, time, IP address and browser the request came from.
• Marketing preferences. If you tick the box asking us to keep you posted, we record that you did, the exact wording you agreed to, the version of that wording, the date and time, your IP address and browser. We keep the same kind of record if you later opt out.
• Technical and security data. Like most websites, our hosting provider (Cloudflare) processes your IP address and standard server-log information to keep the site available and secure. Our contact form runs a Cloudflare Turnstile check to block spam and automated abuse.
• Site usage data. We use Cloudflare Web Analytics to count page views and see which pages are read and where visitors arrived from. It is cookieless and does not identify you.

We do not run advertising or tracking cookies, and we do not follow you across other websites or build a profile of you.

3. Why we use it, and our lawful basis

• To respond to your enquiry and discuss how we might work together. Our lawful basis is our legitimate interests (UK GDPR Article 6(1)(f)) in responding to people who contact us and, where you are asking us to take steps towards a possible contract, the performance of steps prior to entering that contract (Article 6(1)(b)).
• To keep the website secure and prevent spam, fraud and abuse. Our lawful basis is our legitimate interests in protecting our site and our business.
• To deal with a request for our fee schedule. Our lawful basis is our legitimate interests (UK GDPR Article 6(1)(f)) in responding to people who ask us about our commercial terms. We decide case by case whether to issue the schedule, and that decision is not affected by whether you asked for marketing.
• To send you marketing about our services, if you asked for it. Our lawful basis is your consent (UK GDPR Article 6(1)(a)). You give it by ticking a box that is not ticked for you and is not a condition of anything. You can withdraw it at any time by replying to any of those emails or using the unsubscribe link, and we will act on it straight away. Withdrawing does not affect anything we did before you withdrew.

4. Cookies and similar technologies

We use Cloudflare Web Analytics to understand how the site is used. It is cookieless: it sets no cookies, does not fingerprint your device, and does not follow you across other websites or build a profile of you. We use no advertising or tracking cookies, so no cookie-consent banner is needed.

The only other technology of this kind is Cloudflare Turnstile on the contact form, which is a strictly necessary security measure to tell humans from bots. It does not track you either.

5. Who we share it with

To run this website and respond to you, we share limited data with the following processors, who act on our instructions:

• Cloudflare, Inc. hosts the website, provides security, bot protection (including Turnstile) and cookieless web analytics, and stores fee schedule requests and marketing preferences in its database service.
• Postmark delivers your enquiry to our inbox by email.

We do not sell or rent your personal data, and we do not share it with anyone else for their own marketing.

6. International transfers

Some of our processors are based outside the UK or process data outside the UK (for example, email delivery via Postmark in the United States). Where this happens, we rely on the UK's adequacy decisions where they apply, or on Standard Contractual Clauses together with the UK International Data Transfer Addendum where they do not.

7. How long we keep it

We keep enquiry correspondence for as long as we need it to deal with your enquiry and any work that follows from it, and for a reasonable period afterwards for our business records, after which we delete it. Cloudflare retains standard server logs for a short period (typically up to 30 days). You can ask us to delete your enquiry data sooner at any time (see section 8).

We keep fee schedule requests for 24 months after we last hear from you, then delete them. Where you have asked for marketing updates, we keep a record of what you agreed to and when for as long as we are relying on it and for 24 months afterwards, because that record is how we show we asked properly. If you opt out, we keep your email address on a do-not-contact list so that we do not add you back by mistake. You can ask for a copy of your record, or ask us to delete it sooner, at any time.

8. Your rights

Under UK GDPR you have the right to: ask for a copy of the personal data we hold about you; ask us to correct inaccurate data; ask us to delete your data; restrict how we process it; object to processing based on our legitimate interests; and receive your data in a portable format. To exercise any of these rights, email [email protected]. We will respond within one month.

Where we rely on your consent you also have the right to withdraw it at any time, as easily as you gave it. You have an absolute right to object to us using your personal data for direct marketing: if you tell us to stop, we stop.

You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113. We would, however, appreciate the chance to address your concerns directly first.

9. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top shows when it last changed. Any updated version takes effect as soon as it is posted here.

10. Contact

Any questions about this policy or your personal data: [email protected], or write to Alves Rowe Ltd, 44 Belmore Road, Eastbourne, BN22 8BL.