Last updated 13 October 2026Privacy policy
How CODESIX.DEV LTD handles your personal data, from your first contact with us until a contract is signed.
Who we are
CODESIX.DEV LTD is the controller for the personal data described in this policy. We are a small IT consultancy and software development company, registered in England and Wales under company number 17516857.
| Registered office | 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ |
|---|---|
| ICO registration | Registered with the Information Commissioner's Office |
| Data Protection Officer | Not appointed (not required for our size and activities) |
In this policy, "we", "us" and "our" mean CODESIX.DEV LTD. Questions about this policy or your data can be sent by email or post using the contact details above.
What this policy covers
This policy covers personal data we handle from your first contact with us until a contract is signed. That includes:
- visiting our website, codesix.dev
- making an enquiry by email
- discovery calls, meetings and scoping work
- preparing quotes and proposals
- non-disclosure agreements (NDAs) signed before a contract
Once you or your organisation sign a contract with us, the contract and any data processing agreement in it govern the data we handle for that work. Where we build or support systems that hold your customers' or staff data, your organisation is normally the controller and we act as its processor under that agreement.
Our services are for businesses and organisations. They are not aimed at anyone under 18.
The personal data we collect
We collect only what we need to answer you and scope the work. Most of it comes from you directly.
| Type | Examples | Source |
|---|---|---|
| Contact details | Name, job title, organisation, work email, phone number | You, or a colleague who introduces you |
| Enquiry and project details | What you need, budgets, timescales, requirements, documents you send us | You |
| Meeting records | Calendar invites, notes we take during calls; we do not record calls unless we ask you first | You and us |
| Correspondence | Emails and messages between us | You and us |
| Proposal and NDA records | Quotes, proposals, signed NDAs, names of signatories | You and us |
| Business checks | Company details and officers' names | Public sources such as Companies House |
| Website usage | Pages viewed, referring site, browser, device type, country | Our analytics tool (see Website analytics) |
Please do not send us personal data about your customers, staff or members (for example database exports or screenshots of records) before a contract is in place. If a sample is needed to scope the work, we will agree how to minimise or anonymise it first.
We do not ask for special category data (such as health information) or criminal offence data. If any arrives with an enquiry, we will delete what we do not need.
Why we use it and our lawful basis
We rely on UK GDPR lawful bases as set out below. We never sell your data or use it for automated decisions that affect you.
| Purpose | Lawful basis |
|---|---|
| Replying to your enquiry and arranging calls | Legitimate interests (responding to people who contact us). If you enquire as an individual or sole trader: steps you ask us to take before a contract |
| Scoping work, preparing quotes and proposals | As above |
| Agreeing and keeping NDAs | Legitimate interests (protecting both parties' confidential information); contract, where you sign as an individual |
| Checking who we are dealing with | Legitimate interests (avoiding fraud and confirming an organisation is genuine) |
| Following up on a proposal you have not answered | Legitimate interests; we follow up a small number of times only and stop when you ask |
| Website analytics | Legitimate interests (understanding how the site is used so we can improve it) |
| Keeping records and handling legal claims | Legal obligation; legitimate interests (establishing or defending legal claims) |
Where we rely on legitimate interests, we have weighed our interests against yours and limited what we keep. You can object at any time (see Your rights).
We do not send marketing newsletters. If we ever offer one, we will ask for your consent first.
Website analytics
Our website uses Umami, a privacy-focused analytics tool, to count visits. It sets no cookies, does not store your IP address, and does not build a profile of you or follow you across other websites.
Umami records pages viewed, the referring website, browser, operating system, device type and country. Visits are grouped using an identifier that resets regularly, so we see totals and trends, not individuals. We do not use the data for advertising or share it with advertisers.
We run Umami on our own server, hosted with DigitalOcean in London. No analytics company receives the data.
Under the Privacy and Electronic Communications Regulations, as amended by the Data (Use and Access) Act 2025, analytics used only to improve a website do not need consent, provided visitors are told about them and can easily object. You can switch analytics off at any time using the toggle in our website footer. Your choice is remembered on your device only so the site can respect it.
We also use no advertising, social media or tracking cookies.
Where your data is stored
Our mailbox, calendar and files are held in Microsoft 365's UK data region, so they are stored in the UK.
Some providers, including Microsoft, may access data from outside the UK for support or security. Where that happens, the transfer is protected by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the provider is certified) or by the ICO's International Data Transfer Agreement or Addendum.
Our website runs on Cloudflare's global network, so your visit may be handled by the Cloudflare data centre nearest to you, which can be outside the UK. Our analytics server is in London.
How long we keep it
We delete or anonymise data when the period below ends. If you become a client, your records move to the retention terms in our contract.
| Record | How long we keep it |
|---|---|
| Enquiries that do not lead to a proposal | 12 months after our last contact |
| Proposals and quotes not taken up, with related emails and meeting notes | 2 years after our last contact |
| Signed NDAs | 6 years after the NDA ends |
| Documents you sent to scope the work | Deleted or returned when the proposal ends, or as the NDA requires |
| Personal data sent to us in error | Deleted as soon as we notice |
| Website server logs | 90 days |
| Website analytics | Kept as statistics; no data that identifies you |
| Records needed for a dispute or claim | Until the matter is resolved and any limitation period ends |
You can ask us to delete your enquiry sooner (see Your rights).
How we keep it secure
Access to your data is limited to the people at CODESIX.DEV LTD who need it for your enquiry.
- Multi-factor authentication on all business accounts
- Encrypted, managed devices with up-to-date software and screen locks
- Data held in business systems, not on personal accounts or removable media
- Security controls that follow the Cyber Essentials requirements, with our self-assessment to follow
- Professional indemnity and cyber liability insurance
If a breach is likely to put your rights at high risk, we will tell you without undue delay. We will report notifiable breaches to the ICO within 72 hours of becoming aware of them.
Your rights and how to complain
To use any of these rights, email us or write to our registered office (see Who we are). There is normally no fee, and we will respond within one month.
- Access: get a copy of the personal data we hold about you
- Rectification: have inaccurate data corrected
- Erasure: ask us to delete your data
- Restriction: ask us to limit how we use it
- Objection: object to our use based on legitimate interests, including follow-ups and analytics
- Portability: receive data you gave us in a reusable format, where the law allows
We may need to confirm your identity before acting. Some rights have legal limits, for example where we must keep records; if so, we will explain why.
Complaints
If you are unhappy with how we have handled your data, please tell us first, by email, by post, or any other way you contact us. We will acknowledge your complaint within 30 days, look into it and tell you the outcome without undue delay.
You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, or 0303 123 1113.
Changes to this policy
We review this policy at least once a year and when our services or suppliers change. The version on our website is the current one, and the date at the top shows when it was last updated.