Privacy Policy
Last updated July 2026. This is a working draft pending legal review.
What we collect
When you submit a form (assessment request, contact, newsletter, tool report) we collect the details you provide: name, company, job title, work email, phone or WhatsApp, country / city, your message, tool scores, and any files you attach. We also process basic technical data (IP address, request headers) to protect our forms from automated abuse via Cloudflare Turnstile.
Lawful basis (UK / EU GDPR)
Enquiry data: processed on the basis of taking steps at your request prior to entering a contract, and our legitimate interest in responding to you. Newsletter sign-ups and analytics: processed on the basis of your consent, which you can withdraw at any time via the cookie preference centre in the site footer.
How we use it
To respond to your enquiry, to scope potential work, and (where you have explicitly opted in for marketing) to send occasional Ordinox insights. We do not sell your personal data.
Retention
By default we retain enquiry PII for 24 months from submission, after which we anonymize the record (aggregate fields are retained for analytics). Uploaded files are deleted at the same time. You can request earlier erasure by contacting us.
Processors and sub-processors
We host the site on Cloudflare (Pages, Workers, D1, R2, KV, Turnstile). Where the AI assistant fallback is enabled, questions may be sent to Google (Gemini API) with only category-scoped reference text; personal identifiers (name, email, phone) are not passed to Gemini. Where you consent to analytics, Cloudflare Web Analytics collects aggregate traffic data (page paths, referrer, device type, country derived from IP - no cookies, no individual tracking, no personal data stored). If your data is processed outside your region, we rely on appropriate safeguards including standard contractual clauses.
Consent record
The version of consent text you accepted is stored with each submission so we can prove what was agreed at the time.
Your rights
You may request access, correction, deletion, restriction, or portability of your personal data, and object to processing. To exercise any right, contact us at hello@ordinox.net. We respond within 30 days.
Security
HTTPS everywhere with HSTS. Public forms are Turnstile-protected and rate-limited. Admin access uses bcrypt password verification, HttpOnly Secure SameSite=Strict cookies with an 8h absolute session lifetime, KV rate limits, JWT jti revocation on logout, and an append-only audit log of every mutating admin action. Uploads are validated by magic bytes, extension and declared MIME. Files are stored in a private R2 bucket and served through short-lived signed links only.