Privacy notice

HAE Systems Ltd is the controller of the personal data described in this notice.

• Registered in England and Wales, company number 17191321.
• Registered office: Suite A, 82 James Carter Road, Mildenhall, England, IP28 7DE.
• Email: hello@haesystems.co.uk

We are not required to appoint a data protection officer and have not done so. Questions about this notice go to the email address above.

When you use the contact form. Your name, your email address, your company name if you give it, and the message you write. We also record the date and time of the message and the page you sent it from.

When you book a call. The booking page is provided by our calendar provider. It collects your name, your email address, the time you choose and any notes you add. We receive the same details in our calendar.

When you email us. Your email address, your name if you include it, and the content of your email.

When you visit the website. Our hosting provider processes technical data to deliver pages and protect the site, such as your IP address, browser type and the pages requested. The spam-protection check on the contact form processes similar technical data to tell people from automated bots. This happens in the background, and we do not use it to identify you.

If analytics are enabled. We may use a cookieless analytics service that counts page views and a few actions, such as a form being sent. It stores no cookies, collects no personal data and does not track you across other sites.

When you become a client. We collect the information needed to deliver and invoice the work. That is covered by our contract with you and by a separate data processing agreement where we handle personal data on your behalf.

Please do not send us special category data, such as health information, through the form. We do not need it to reply to you.

• To respond to your enquiry and arrange calls. Lawful basis: our legitimate interest in answering people who contact us about our services.
• To run and protect the business and this website, including keeping the site secure and free of spam. Lawful basis: legitimate interests.
• To deliver work you have asked us to do, including the steps you ask for before a contract is signed. Lawful basis: performance of a contract.
• To keep business and accounting records. Lawful basis: legal obligation.

Where we rely on legitimate interests, we have checked that our use is what you would reasonably expect and does not override your rights. You can object at any time, as described under Your rights.

We do not send marketing email unless you ask us to keep in touch. We do not make automated decisions about you, and we do not profile you.

• Enquiries that do not become work. Deleted twelve months after our last contact with you, from our inbox, our calendar and the lead log.
• Enquiries that become work. Kept for the length of the engagement, then as part of our business records.
• Business and accounting records. Kept for as long as the law requires, then deleted.
• Email. Kept according to the rules above, and deleted when it falls outside them.
• Technical and security logs. Held by our hosting provider for a short period, then deleted.
• Analytics data. Contains no personal data, so there is nothing to delete about you.

We do not sell personal data, and we do not share it with anyone for their own marketing. We share it only with:

• Service providers (processors), who handle data on our instructions. They are listed below.
• Professional advisers, such as our accountants, lawyers and insurers, where needed.
• Authorities, where the law requires it.
• A buyer or successor, if the business is sold or reorganised, under the same protections.

Our processors

Each provider processes data only on our instructions, under a written contract. Where data leaves the UK, we rely on the safeguard shown.

• Cloudflare, Inc. (United States). Hosting, domain name services, spam and abuse protection, and the secure store that keeps a copy of each form submission (our lead log). Safeguard: the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
• Resend (Plus Five Five, Inc., United States). Sending the email that brings your enquiry to our inbox, and the automatic reply you receive. Safeguard: the UK International Data Transfer Addendum.
• Google (Google Workspace, United States). Our business email, calendar and the call booking page. Safeguard: the EU Standard Contractual Clauses with the UK Addendum, or the UK International Data Transfer Addendum.
• Umami Software, Inc. (United States). Cookieless website analytics, only if enabled. It receives no personal data.

Where a provider is also certified under the UK Extension to the EU-US Data Privacy Framework, we may rely on that certification instead. Email us if you would like a copy of the safeguards.

This website does not use cookies. It does not store anything in your browser’s local storage, session storage or any other storage on your device. There is no cookie banner because there is nothing to consent to.

The spam-protection check on the contact form is strictly necessary to keep the form working and to protect it from abuse. It processes technical data about your browser only to tell people from bots.

Access to personal data is limited to the people who need it, behind accounts with two-step login. Connections to this website and to our providers are encrypted. We choose providers with security in mind and hold a written contract with each. We do not place personal data in chat tools or shared documents, and we remove access when it is no longer needed. No method of storage or transfer is completely secure, but we work to protect your data in line with these measures.

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Correct data that is wrong or incomplete.
• Erase your data, in certain circumstances.
• Restrict how we use your data, in certain circumstances.
• Object to our use of your data, including any use based on legitimate interests.
• Portability. Receive the data you gave us in a usable format, where we process it under a contract.

To use any of these rights, email hello@haesystems.co.uk. We respond within one month. We may ask you to confirm your identity first. There is no charge, unless a request is clearly unfounded or excessive.

If you are unhappy with how we have handled your data, please contact us first and we will try to put it right.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator.

• Website: ico.org.uk
• Telephone: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

This website and our services are for businesses. We do not aim them at children, and we do not knowingly collect children’s data. If you believe a child has sent us personal data, email us and we will delete it.

This website links to other sites, such as our booking page and the ICO. Their privacy notices apply there, not this one.

We may update this notice when our services, our providers or the law change. The latest version is always on this page, with the date it was last updated. If a change affects how we use data you have already given us, we will email you where we hold your address.

Last updated: 21 October 2026.