Privacy Notice

Effective date: 3 October 2026 · Last updated: 3 October 2026

1. Who we are

This notice explains how ABJAK LTD, trading as "Abjak" ("Abjak", "we", "us"), uses personal information. We are the controller for the information described here. We follow the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

• Registered in England and Wales, company number 13983797
• Registered office: C/O Stuart Mcbain Ltd (Accountants), Unit 14 Tower Street, Brunswick Business Park, Liverpool, England, L3 4BJ
• Registered with the UK data protection regulator (the Information Commission, formerly the Information Commissioner's Office) where the law requires it
• Privacy contact: [email protected]
• We are not required to appoint a Data Protection Officer and have not done so. Please send any privacy question to the contact above.

2. The information we collect

Where it comes from	What we collect
Contact / callback form	Name, email address, phone number, company name, and anything you type in the message box. The form is delivered to our email inbox (Google Workspace) by Web3Forms
Booking a call	Name, email, the time you pick, and any notes you add. Booking runs through Google Calendar appointment scheduling (part of Google Workspace)
Buying online	Name, email, billing details and payment information, collected by Stripe on its secure checkout page. We don't see or store your full card number
Working with us	Business contact details for you and your colleagues, meeting notes, and information you share during Discovery & Diagnosis or a project
Emails and calls	What you send us and our replies
Our website	Our host, Cloudflare, receives your IP address and basic request details (such as the page requested, browser type and time) when pages load. Our font files are served from our own site. See section 6
Other sources	Sometimes we obtain business contact details (such as name, job title, company and work email) from public sources, such as company websites and LinkedIn, or from business data providers. If we get your details this way, we tell you within one month or at our first contact with you, whichever is sooner

We don't knowingly collect special category data (such as health data), and we ask you not to send it. Our website and services are for businesses and aren't aimed at children.

3. Why we use it and our legal basis

Purpose	Legal basis (UK GDPR Art 6)
Replying to your enquiry or callback request, and arranging calls	Steps you asked us to take before a contract (6(1)(b)), or our legitimate interest in answering business enquiries (6(1)(f))
Taking payment and delivering services you buy	Contract (6(1)(b))
Keeping accounting and tax records	Legal obligation (6(1)(c))
Managing our relationship with business clients and contacts	Legitimate interests (6(1)(f)): running and growing our business
Sending marketing emails to individuals, sole traders and partnerships	Your consent (6(1)(a)), or the "soft opt-in" for existing customers, where we give you a way to opt out every time
Sending marketing emails to people at companies	Legitimate interests (6(1)(f)). You can opt out at any time
Running and securing our website (server logs kept by our host)	Legitimate interests (6(1)(f)): keeping our website available and secure
Keeping our site and systems secure, and preventing fraud	Legitimate interests (6(1)(f))
Handling legal claims	Legitimate interests (6(1)(f))

You don't have to give us your details. Without them we can't reply to you, book a call, or deliver services. We don't make decisions about you based solely on automated processing that have legal or similarly significant effects on you.

4. Who we share it with

We share information only with service providers who act on our behalf under contract (processors), our professional advisers (such as our accountants), and authorities where the law requires it. Our providers are:

• Website hosting and content delivery: Cloudflare (Cloudflare Pages)
• Contact form delivery: Web3Forms
• Payments: Stripe
• Email and call scheduling: Google Workspace (Gmail and Google Calendar appointment scheduling)
• Accounting: our external accountants and any bookkeeping software they use for us
• Subcontractors who help us deliver a client project, where needed, under written confidentiality and data protection terms

We don't sell your personal information.

5. International transfers

Some of our providers (Cloudflare, Google, Stripe and Web3Forms) may store or access data outside the UK, including in the United States. When that happens we rely on UK adequacy regulations (for the US, only where the provider participates in the UK Extension to the EU-US Data Privacy Framework) or on the ICO's International Data Transfer Agreement or Addendum included in the provider's data processing terms. To get a copy of the safeguards, contact us.

6. Cookies and similar technologies

Our own site doesn't set analytics, testing or advertising cookies. The only third-party technology that may store information on your device is listed below. Our Cookie Notice explains it in full.

Name / tool	What it does	How long
Stripe (checkout pages only)	Stripe may set its own cookies on its checkout pages for security and fraud prevention. See Stripe's cookie policy	As set by Stripe; see its cookie policy

You can block cookies at any time in your browser settings. We don't use analytics, advertising or cross-site tracking cookies. If that changes, we'll ask for your consent first.

7. How long we keep it

• Enquiries, callback requests and call bookings that don't lead to work: 24 months after our last contact with you
• Client and contract records, invoices and payments: 6 years from the end of the financial year they relate to (HMRC and Companies Act record-keeping rules), or longer if the law requires
• Marketing lists: until you opt out; after that we keep only a suppression record so we don't contact you again
• Website server logs: kept by our host, Cloudflare, under its standard retention periods (typically a short period, such as around 30 days). We don't keep separate copies

8. Your rights

You have the right to:

• ask for a copy of your data
• have wrong data corrected
• have data deleted
• restrict how we use it
• object to our use based on legitimate interests
• object at any time to direct marketing
• receive your data in a portable format (where it applies)
• withdraw consent at any time (this doesn't affect use before you withdrew)

To use any of these, email [email protected]. We'll reply within one month. We can extend that by up to two more months for complex or numerous requests, and we'll tell you if we do.

9. Complaints

If you're unhappy with how we've handled your information, please tell us first at [email protected]. We'll acknowledge your complaint within 30 days, look into it, and tell you the outcome. You can also complain to the UK data protection regulator, the Information Commission (formerly the Information Commissioner's Office, ICO), at ico.org.uk, by phone on 0303 123 1113, or by post to 4th Floor, No.3 Circle Square, 5 Hawkshaw Street, Manchester M1 7BL.

10. Security

We use appropriate technical and organisational measures to protect your information, including access controls on our accounts and systems, and encryption of our website traffic (HTTPS).

11. US visitors (including California)

• Categories we collect: identifiers and contact details (name, email, phone, company), commercial information (purchases), and internet activity on our site (see sections 2 and 6).
• Who we share them with: see section 4. We don't sell or share personal information for cross-context behavioural advertising.
• Do Not Track: our site doesn't currently respond to browser "Do Not Track" signals. Because we don't use tracking or advertising cookies, there is no tracking for those signals to switch off. As far as we know, no third party collects information about your activity across other sites through our site.
• Reviewing or changing your data: email [email protected].
• Changes: we'll post any update here with a new effective date, and for material changes we'll show a notice on the site and email current clients.

12. Changes to this notice

We'll update this notice when our practices change. The date at the top shows when it last changed.