Privacy Notice

1. Who we are

CrinGlobal Ltd is a company registered in the United Kingdom, company number 15554320.

• VAT number: GB 471 8843 59
• Website: https://cringlobal.com
• Contact: office@cringlobal.com

CrinGlobal Ltd is the data controller for the personal data described in this notice.

2. Data we collect

a) Website usage. This website does not use cookies for analytics, advertising, or tracking (see our Cookie Policy). Loading a page causes your browser to request fonts and front-end libraries directly from third-party providers. See "Recipients and processors" below.

b) Enquiry and intro-call form data. When you submit the "Request a Free Intro Call" form, we collect your name, business name, email address, a description of what you need help with, and optionally your phone number and a preferred contact time.

c) Website Intelligence Report request data. When you request a free Website Intelligence Report, we collect your name, business name, email address, the website URL you want reviewed, and an optional note.

d) Report and account history. Where you have received one or more reports from us, we may keep a record linking your email address to the website(s) reviewed and the reports issued, so we can track progress over time if you request a further review.

e) Rate-limiting data. To protect our forms against automated abuse, a submission records a one-way cryptographic hash of the IP address it came from, not the IP address itself. This hash cannot, on its own, be reversed to reveal an IP address, but UK GDPR still treats it as personal data because it can be linked to a submission.

f) Hosted report activity. If we send you a hosted, link-based copy of a Website Intelligence Report, viewing it, downloading the PDF, or clicking through to book a call is logged against that report's identifier, the domain reviewed, a hashed version of the visitor's IP address, and a timestamp. This tells us whether a report has been opened. It is not used to build a profile of you across other websites.

What we do not collect here. We do not ask for, and you should not send us, payment card details, passwords, or other account credentials through any form on this website. Payment for the Cybersecurity & IT Health Check is arranged separately, by bank transfer, and is not processed through this website. See our Terms.

3. Purposes and lawful basis

Where we rely on legitimate interests, we consider the processing to be limited, expected by you as part of requesting our services, and not overridden by your rights and freedoms.

4. Recipients and processors

• Hosting and infrastructure. This website, and the systems that store submitted form data and generated reports, are hosted on DigitalOcean's infrastructure, in a UK region (verified as DigitalOcean's London data centre via public network registration records).
• Email delivery. Internal notification emails (including a summary of your submission, sent to our own office@cringlobal.com mailbox so we can respond to you) are sent using IONOS's business email service.
• Encrypted backups. Backups of our systems are stored with Backblaze B2, using their EU Central endpoint. Data is encrypted on our own server before it is uploaded (client-side encryption, via rclone's "crypt" feature), so Backblaze never holds an unencrypted copy of your data.
• Professional advisers. We may share limited information with our own professional advisers (for example, for invoicing a paid engagement).

We do not sell personal data, and we do not share it with third parties for their own marketing purposes.

5. International transfers

Not all of our processing stays within the UK. Our website and form-handling systems are hosted in the UK, but our encrypted backup provider, Backblaze B2, stores backup copies using an EU Central endpoint, meaning backup data (which may include personal data, always encrypted before it leaves our server) is stored outside the UK. Other service providers we use may also process or store data outside the UK. Where that happens, we will use an appropriate safeguard, such as an applicable UK adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism.

6. Retention

• Enquiries and contact-form records: retained for 12 months after the last meaningful contact, then securely deleted, unless a longer period is required for legal, accounting, or dispute purposes.
• Free website-report requests and generated reports: retained for 12 months after creation or last activity, then securely deleted, unless needed for a live customer relationship or legal obligation.
• Completed paid reports and client history: retained for 24 months after the engagement or last activity, then reviewed for deletion or anonymisation.
• Security and operational logs: retained for up to 12 months, then deleted or anonymised where practical.
• Encrypted backups: rolling retention of 30 days. Backup copies may contain data that was deleted from the live system until the relevant backup expires.

We may keep personal data for longer than the periods above where necessary to comply with a legal or accounting obligation, to establish, exercise, or defend a legal claim, or to prevent or investigate fraud or a security incident.

7. Security

We apply the following measures to reduce risk to your data:

• Forms are protected by a hidden honeypot field and rate limiting to reduce automated abuse.
• IP addresses recorded against submissions and report views are stored as one-way cryptographic hashes, not in plain form.
• Directories containing submitted request data are configured to block direct public access.
• This website is served over HTTPS.
• Backups are encrypted on our own server before upload, so our backup provider never holds an unencrypted copy of your data (see "Recipients and processors").

8. Your rights

Under UK GDPR, you have the right to:

• be informed about how your data is used (this notice);
• request access to the personal data we hold about you;
• request correction of inaccurate data;
• request erasure of your data in certain circumstances;
• request that we restrict, or object to, certain processing;
• request a copy of your data in a portable format, where applicable;
• withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, contact office@cringlobal.com. We may need to verify your identity before acting on a request.

9. Complaints

If you are unhappy with how we have handled your personal data, please contact us first at office@cringlobal.com so we can try to put it right. You also have the right to complain to the UK's independent data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk. CrinGlobal's ICO registration reference is C1581856.

10. Automated decision-making

We do not use your personal data for any automated decision-making that produces legal or similarly significant effects on you.

11. Children

This website and our services are directed at businesses, not children. We do not knowingly collect personal data from children.

12. Changes to this notice

We may update this notice from time to time. The date at the top of this page shows when it was last updated.

13. Contact

CrinGlobal Ltd · office@cringlobal.com · +44 1206 523 496 · https://cringlobal.com