Privacy Policy
Last updated: 23 September 2026
This notice explains what Foundry does with personal data collected through this website: what we collect, why, what allows us to do it in law, who else sees it, how long we keep it, and what you can ask us to do about it. We collect very little, and we have tried to say so in plain words rather than legal ones.
Who is responsible for your data
The data controller is Foundry Solutions Ltd, trading as Foundry. The company, not any individual, decides why and how personal data collected through this website is used.
For anything to do with your personal data, email contact@foundrysolutions.co.uk, or write to us at the registered office. We have not appointed a Data Protection Officer, because the scale and nature of our processing does not require one.
What we collect, why, and what permits it
Every use of your data is listed below with the legal basis we rely on and how long we keep it. We do not collect special category data, we do not knowingly collect data about children, and we do not buy personal data from anyone.
| Why we use it | What we use | Legal basis | How long we keep it |
|---|---|---|---|
| Answering a contact or quote enquiry | Name, email, and optionally company, phone, team size, plan interest, current IT setup, timeframe, and your message | Steps taken at your request before entering a contract (Art.6(1)(b)), supported by your explicit tick on the form | 24 months from the last contact about the enquiry, then deleted; longer only if you become a client, under your service agreement |
| Sending you a confirmation that your enquiry arrived | Name and email address | Legitimate interests (Art.6(1)(f)) — confirming receipt of a message you sent us | Held in the mail provider's delivery log for up to 30 days |
| Evidencing that you consented to be contacted | Consent wording version, timestamp, and truncated IP address | Legal obligation to demonstrate consent (Art.7(1)) | Kept for as long as the enquiry record itself |
| Stopping automated abuse of our forms | IP address, processed transiently as a counter | Legitimate interests (Art.6(1)(f)) — keeping the service available and secure | 1 hour rolling window, then discarded |
| Understanding how the site is used | Pages viewed, referrer, approximate location, device and browser type; with Clarity, scrolling, clicks and mouse movement | Your consent (Art.6(1)(a) and PECR reg.6) — off unless you accept | 14 months in Google Analytics; 30 days for Microsoft Clarity recordings; Vercel metrics are aggregate-only and never identify you |
| Answering your questions in the website assistant | Whatever you type into the chat, and the rest of that conversation | Legitimate interests (Art.6(1)(f)) — answering questions a visitor chose to ask about our services | Not stored by us. The conversation exists only in your browser tab and is sent to our AI processor to generate each reply; closing or reloading the page ends it |
| Stopping automated abuse of the website assistant | IP address, processed transiently as a counter | Legitimate interests (Art.6(1)(f)) — keeping the service available and its cost predictable | 1 hour rolling window, then discarded |
| Booking an introductory call | Name, email, the time you chose and your time zone, and optionally company, phone, team size and notes | Steps taken at your request before entering a contract (Art.6(1)(b)), supported by your explicit tick on the form | Handled like an enquiry: 24 months from the last contact about it, then deleted; longer only if you become a client, under your service agreement |
| Sending marketing emails about Foundry's services | Name, work email address, company name, and a record of how and when you subscribed or opted out | For corporate subscribers (a limited company's or LLP's business address): legitimate interests (Art.6(1)(f)), which PECR permits for business-to-business email without prior consent. For individual subscribers, including sole traders and some partnerships: your consent, or the soft opt-in (PECR reg.22(3)) where we got your details while you were buying, or negotiating to buy, a similar service from us. Nobody who contacts us through a form on this site is added without being asked first. You can object at any time, and we will stop (Art.21(2)–(3)) | Until you unsubscribe or object. After that we keep only your email address on a suppression list, so that you are never emailed again |
Filling in a form is voluntary. You are not required by law or by contract to give us anything — but if you leave out your name, email address or message, we cannot answer your enquiry, because those are the only things we have to go on.
Marketing emails and how to unsubscribe
We send marketing emails only on the basis set out in the table above. If you contacted us through a form on this site, you will not receive marketing emails unless you have agreed to them first; ticking the box to be contacted about your enquiry is not that agreement.
You can stop marketing emails at any time, free of charge, in either of these ways:
- use the unsubscribe link included in every marketing email we send; or
- email contact@foundrysolutions.co.uk and tell us you no longer want them.
Your right to object to direct marketing is absolute: we do not ask why, and we do not weigh your objection against our interests. Once you opt out we keep only your email address on a suppression list, so that you are not emailed again. Opting out of marketing does not affect messages about an enquiry, a booking or a service you have with us.
Cookies and analytics
No analytics or advertising technology loads on this site until you accept it. Google Tag Manager, Google Analytics 4 and Microsoft Clarity are not requested at all unless you press Accept analytics on the banner shown on your first visit, and Google Consent Mode is set to denied by default. If your browser sends a Global Privacy Control signal, we record that as a rejection automatically and never show you the banner.
The one exception is a browser with JavaScript switched off, which cannot show the banner. There the page loads a hidden Google Tag Manager frame without asking, which sends your IP address and browser details to Google. Nothing else runs; the details are in our cookie policy.
You can change your mind at any time using Cookie settings in the footer — withdrawing consent is as easy as giving it. The full list of what can be stored on your device, and for how long, is in our cookie policy.
We also use Vercel Web Analytics and Vercel Speed Insights. Both are cookieless and aggregate-only: they store nothing on your device and cannot identify you, so they run without consent.
Who else sees your data
We do not sell personal data, we do not share it for advertising, and we do not disclose it to anyone except the service providers below, who process it only on our written instructions and only to provide their service to us. We may also disclose data where the law requires it.
| Provider | What they do for us | Where | Transfer safeguard |
|---|---|---|---|
| Vercel Inc. | Website hosting, CDN, form API endpoints, cookieless performance analytics | United States, with edge delivery worldwide | Standard Contractual Clauses with the UK International Data Transfer Addendum |
| Google Ireland Ltd / Google LLC | Google Tag Manager and Google Analytics 4 — loaded only after you accept analytics cookies | Ireland and the United States | EU–US Data Privacy Framework and the UK Extension, backed by Standard Contractual Clauses |
| Microsoft Ireland Operations Ltd / Microsoft Corporation | Microsoft Clarity session recordings and heatmaps, with form fields masked — loaded only after you accept analytics cookies | Ireland and the United States | EU–US Data Privacy Framework and the UK Extension, backed by Standard Contractual Clauses |
| Resend, Inc. | Delivery of enquiry notifications and your confirmation email | United States | Standard Contractual Clauses with the UK International Data Transfer Addendum |
| Anthropic PBC | Generates the replies in the website assistant — receives the conversation, does not train on it, and stores nothing on our behalf | United States | Standard Contractual Clauses with the UK International Data Transfer Addendum |
| Upstash, Inc. | Rate limiting of form submissions — processes your IP address transiently | United States and European Union regions | Standard Contractual Clauses with the UK International Data Transfer Addendum |
Sending data outside the UK
Some of the providers above are based in the United States, so your data may be transferred there. Where that happens we rely on the safeguards named in the table — the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, and, for Google, the EU–US Data Privacy Framework and its UK Extension. You can ask us for a copy of the relevant safeguard by emailing contact@foundrysolutions.co.uk.
How we protect it
The site is served over HTTPS with a strict content security policy. Form submissions are validated and rate-limited, enquiry contents are never written to our application logs, and access to the sales inbox is limited to the people who need it and protected by multi-factor authentication. No system is perfectly secure, but we treat your enquiry the way we would treat a client’s environment.
Your rights
Under UK data protection law you can ask us to give you a copy of the personal data we hold about you, correct it if it is wrong, delete it, restrict what we do with it, send it to another provider, or stop processing it altogether. Where we rely on your consent — analytics, and being contacted about your enquiry — you can withdraw it at any time, and doing so does not affect anything we did before you withdrew it.
Email contact@foundrysolutions.co.uk and we will respond within one month. We will not charge you, and we will not treat you any differently for asking.
The law these rights come from
United Kingdom
UK GDPR and the Data Protection Act 2018. Access, rectification, erasure, restriction, portability, objection (including to direct marketing at any time), and the right to withdraw consent. Complaints go to the Information Commissioner's Office at ico.org.uk.
European Economic Area and Switzerland
EU GDPR and the Swiss FADP. The same rights as above. You may complain to the supervisory authority in the country where you live, work, or where the issue arose. We do not make decisions about you by automated means.
Complaints
Please raise anything with us first — most things are quickest to fix directly. You also have the right to complain to a regulator without speaking to us at all. In the UK that is the Information Commissioner's Office. If you are in the European Economic Area, you can also complain to the data protection authority where you live or work.
Automated decisions and profiling
We do not make decisions about you by automated means, and we do not profile you. Every enquiry is read and answered by a person.
The “Ask Foundry” assistant on this site does generate its answers automatically, from published content on these pages. It decides nothing about you, has no access to any of our systems, and cannot pass a message to us — anything you send through it reaches nobody. Use the contact form to reach a person. Its answers are not quotes, advice or commitments, and they can be wrong.
Children
This site is aimed at businesses and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has sent us their details, email us and we will delete them.
Changes to this notice
We may update this notice as the business changes. The current version is always on this page with its date at the top; if we make a change that materially affects your rights, we will say so prominently on the site.