Privacy Policy

1. Who We Are

Charnette Ltd (trading as Charnette Labs) is a company registered in England and Wales. We build websites, mobile applications, and push notification systems exclusively for tourism businesses.

This policy explains how we collect, use, store, and protect personal data when you visit charnette.io or contact us about our services. It applies to all visitors and prospective clients.

2. What Data We Collect

We only collect personal data that you actively provide to us or that is generated through your use of this website.

Contact and enquiry data: When you submit an enquiry through our contact form or email us directly, we collect your name, email address, business name, and the content of your message.

Usage data: We may collect anonymised information about how visitors use this website — including pages visited, time on site, and general geographic location (country/region level). This data is not linked to any individual and is used only to understand how the site is being used so we can improve it.

Communications: If you correspond with us by email, we retain those communications for the purposes of responding to you and maintaining a record of our conversation.

We do not collect payment information directly — any payments are processed through third-party providers under separate terms.

3. Legal Basis for Processing

Under UK GDPR and the Data Protection Act 2018, we process your personal data on the following legal bases:

• Legitimate interests — responding to enquiries you have sent us, and improving our website based on anonymised usage data.
• Contractual necessity — processing data necessary to fulfil a project or service agreement with you.
• Legal obligation — retaining certain records as required by UK law.
• Consent — where you have explicitly agreed to receive communications from us. You may withdraw consent at any time.

4. How We Use Your Data

We use personal data only for the purposes for which it was collected:

• To respond to your enquiry or project request
• To communicate with you about a project in progress
• To send relevant information you have asked for
• To improve this website and our services
• To comply with legal obligations

We do not use your data for automated decision-making or profiling. We do not sell, rent, or trade your personal data to any third party for marketing purposes.

5. Data Sharing and Third Parties

We do not share your personal data with third parties except in the following limited circumstances:

• Service providers — we use trusted third-party tools to operate our business (such as email hosting and website hosting). These providers process data only on our instruction and under appropriate data processing agreements.
• Legal requirements — we may disclose data where required to do so by law, court order, or regulatory authority.
• Business transfers — in the event of a merger, acquisition, or sale of all or part of our business, personal data may be transferred as part of that transaction. We will notify affected individuals in advance.

All third-party providers used by Charnette Labs are required to process data in accordance with UK GDPR.

6. Data Retention

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected:

• Enquiry data — retained for 2 years from the date of last contact, after which it is securely deleted.
• Project correspondence — retained for 6 years from project completion in line with standard UK business record-keeping requirements.
• Anonymised usage data — retained indefinitely as it cannot be linked to any individual.

You may request deletion of your personal data at any time by contacting us at [email protected].

7. Cookies

This website may use cookies — small text files stored on your device — to help the site function correctly and to understand how it is being used.

Essential cookies are required for the site to operate and cannot be disabled.

Analytics cookies help us understand site usage in aggregate, anonymised form. No personally identifiable information is collected through analytics cookies.

We do not use advertising cookies, tracking pixels, or any cookies that identify you individually without your consent.

You can control and delete cookies through your browser settings at any time. Disabling cookies may affect the functionality of some parts of the website.

8. Your Rights Under UK GDPR

You have the following rights in relation to your personal data:

• Right of access — you may request a copy of the personal data we hold about you.
• Right to rectification — you may ask us to correct any inaccurate or incomplete personal data.
• Right to erasure — you may ask us to delete your personal data, subject to legal retention obligations.
• Right to restriction — you may ask us to restrict the processing of your data in certain circumstances.
• Right to data portability — you may request a copy of your data in a structured, machine-readable format.
• Right to object — you may object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. There is no charge for exercising your rights in most circumstances.

If you are unsatisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

9. Data Security

We take reasonable and appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, alteration, or disclosure. These measures include encrypted communications, access controls, and regular review of our data handling practices.

No method of transmission over the internet is entirely secure. While we take data protection seriously, we cannot guarantee absolute security of data transmitted to us electronically.

10. International Transfers

Where we use third-party service providers whose infrastructure is located outside the UK or EEA, we ensure that appropriate safeguards are in place — such as Standard Contractual Clauses or reliance on adequacy decisions — to protect your data in accordance with UK GDPR requirements.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The date at the top of this page shows when it was last revised. We encourage you to review this policy periodically.

Material changes will be communicated to existing clients by email.

12. Contact Us

For any questions, requests, or concerns relating to this Privacy Policy or how we handle your personal data, please contact us: