Privacy policy

1. Important information and who we are

Purpose of this privacy policy

This privacy policy gives you information on how Neurotic Ltd collects and processes your personal data through your use of this website, including any data you provide when you send us an enquiry through our contact form or sign in to the client area.

Controller

Neurotic Ltd is the controller and is responsible for your personal data.

• Company name: Neurotic Ltd, registered in England and Wales, company number 11547128
• Registered office: 33 Colville Road, London W11 2BT, United Kingdom
• Email address: [email protected]
• Telephone number: +44 20 3983 5430

Changes to this privacy policy

We keep this privacy policy under regular review. It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

2. The data we collect about you

Personal data means any information about an individual from which that person can be identified. It does not include data where the identity has been removed.

We collect a deliberately small amount. We do not sell anything through this website, so we hold no payment or transaction data of any kind. The categories we do collect are:

• Enquiry data. When you use the contact form we collect the name, email address and telephone number you give us, and the subject of your enquiry.
• Account data. If you have a client or administrator account, we hold your name, your email address and a cryptographic hash of your password. We never store the password itself.
• Technical data. We record the IP address and browser user agent attached to an enquiry, to a sign-in attempt and to an active session. This is kept as a security record, so that we can see who has tried to reach the private areas of this site.

3. How we use your personal data

We will only use your personal data when the law allows us to. Most commonly, we will use it in the following circumstances:

• Where it is necessary for our legitimate interests in replying to an enquiry you have sent us, in operating the client area, and in keeping the site secure, and your interests and fundamental rights do not override those interests.
• Where we need to perform a contract we are about to enter into or have entered into with you.
• Where we need to comply with a legal obligation.

We do not use your personal data to send you marketing you have not asked for, and we do not profile you.

4. Cookies and similar technology

This website sets one cookie of its own: a session cookie, which is strictly necessary to keep you signed in and to protect forms against cross-site request forgery. It needs no consent and cannot be turned off without breaking the site.

Your answer to the cookie banner is stored in your browser's local storage rather than in a cookie, so that asking the question does not itself set one. It never reaches our servers.

We set no analytics, advertising or tracking cookies. If that ever changes, the banner will ask you first and nothing will be set unless you accept.

5. Sharing your personal data

We may share your personal data with the parties set out below, for the purposes set out in section 3:

• Service providers acting as processors who provide IT, hosting and system administration services.
• Google, which provides the reCAPTCHA robot check on our forms and serves the fonts this site uses. Both receive your IP address and basic technical data when a page loads. Google acts as an independent controller for this purpose and its own privacy policy applies.
• Professional advisers including lawyers, bankers, auditors and insurers who provide consultancy, banking, legal, insurance and accounting services.
• HM Revenue and Customs, regulators and other authorities who require reporting of processing activities in certain circumstances.

We do not sell your personal data and we do not share it with advertisers.

6. International transfers

This website and its database are hosted in the European Union. Some of your personal data is still transferred outside the United Kingdom: to the EU for hosting, and to the Google services described above, which are provided from outside the UK.

Where we transfer personal data out of the UK we rely on the safeguards permitted under UK data protection law, including the UK International Data Transfer Addendum to the European Commission's standard contractual clauses, or an adequacy decision where one applies.

7. Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. Traffic to this site is encrypted in transit, passwords are stored only as cryptographic hashes, and access to the private areas is logged. We limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know, and they are subject to a duty of confidentiality.

8. Data retention

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including satisfying any legal, accounting or reporting requirements. Enquiries are kept while we are in contact with you and for a reasonable period afterwards. Security records such as sign-in attempts are kept for a shorter period, because their value is in the recent past.

9. Your rights

Under UK data protection law you have the right to request access to your personal data, to have it corrected or erased, to object to or restrict our processing of it, and to ask us to transfer it to someone else. You also have the right to withdraw consent at any time where we are relying on consent.

To exercise any of these rights, write to [email protected]. You will not have to pay a fee, and we will respond within one month. If you are unhappy with how we have handled your personal data you have the right to complain to the Information Commissioner's Office at ico.org.uk, though we would ask that you come to us first.