Privacy Policy

Who we are

This website is operated by Passion Connection LTD, an independent Cloudflare security and performance consultancy serving e-commerce, SaaS and high-traffic websites. We are registered in England and Wales under company number 8252252, with our registered office at 44 Broadway, London E15 1XH, United Kingdom. We are the “data controller” responsible for the personal data described in this policy.

If you have any questions about this policy or how we handle your data, you can reach us by email at [email protected] or through our contact page.

What information we collect

We collect the information you provide directly when you complete our contact form or email us. Depending on the fields you fill in, this may include:

• Your name
• Company or organisation name
• Email address
• Website or domain
• E-commerce or SaaS platform (e.g. Shopify, WooCommerce, Magento)
• Your current Cloudflare plan
• A description of the problem or project you need help with
• Urgency or timeline
• Approximate traffic level
• Indicative budget
• Any additional message or details you choose to share

We also automatically collect limited technical information when you visit the site, such as your IP address, device and browser type, referring page and general usage data. This helps us keep the site secure, available and performant.

Information we do not ask for

Please do not send us sensitive personal data (such as payment card numbers, passwords, health information or special-category data) through the contact form. If you need to share credentials or secrets to deliver a project, we will agree a secure method with you separately.

How we use your information

We use the information we collect to:

• Respond to your enquiry and answer your questions
• Scope, quote and deliver the consulting services you request
• Communicate with you about a project or engagement
• Keep records of our correspondence and agreements
• Maintain the security, performance and reliability of this website
• Meet our legal, accounting and tax obligations

We do not sell your personal data, and we do not use it for automated decision-making that produces legal or similarly significant effects.

Legal basis for processing

Where data protection law (such as the EU and UK GDPR) applies, we rely on the following legal bases:

• Legitimate interests — to respond to enquiries, run and improve our consultancy, and keep the site secure, balanced against your rights and expectations.
• Performance of a contract — to take steps at your request before entering into a contract and to deliver agreed services.
• Consent — where you opt in to marketing communications or non-essential cookies; you can withdraw consent at any time.
• Legal obligation — where we must retain certain records for accounting, tax or compliance reasons.

Cookies and analytics

As shipped, this website uses only strictly necessary cookies that are required for it to function and stay secure. It does not use advertising or cross-site tracking cookies.

For measurement we use, or may use, a privacy-friendly, cookieless analytics tool that sets no cookies and stores no personal data, so no consent banner is required. If cookie-based analytics or marketing tools are added in future, they will only be set after you consent, and this policy and our Cookie Policy will be updated. You can control cookies through your browser settings at any time.

Data sharing and processors

We do not sell or rent your personal data. We share it only with trusted service providers (“processors”) who help us operate the website and respond to you, and only to the extent needed. These may include:

• Contact-form delivery provider — used to receive and route contact-form submissions to us.
• Email provider — used to manage correspondence and respond to enquiries.
• Hosting and content delivery — the infrastructure and CDN (including Cloudflare) that serve and protect this website.
• Cookieless analytics provider — where website analytics are enabled (no cookies, no personal data).

We put an appropriate data processing agreement (DPA) in place with each processor and require them to keep your data secure and to use it only for the purposes we specify. A current list of our processors / sub-processors is available on request.

Data retention

We keep personal data only for as long as necessary for the purposes set out in this policy, including to provide our services, maintain business records and comply with legal obligations. Where an enquiry does not lead to an engagement, we delete or anonymise the data after a reasonable period.

In practice, we keep enquiry data for up to 24 months where it does not lead to an engagement; client and project records for the duration of the engagement and for up to six years afterwards to meet UK legal, accounting and tax obligations; and we delete or anonymise data once these periods expire. We can confirm the retention period for a specific category on request.

International transfers

Some of our service providers may be located outside your country or outside the European Economic Area. Where personal data is transferred internationally, we take steps to help protect it with appropriate safeguards, such as standard contractual clauses or an adequacy decision, in line with applicable data protection law.

Where a provider processes personal data outside the UK or the EEA, we rely on an appropriate safeguard for that transfer — typically the UK International Data Transfer Agreement (IDTA) or an addendum to the EU Standard Contractual Clauses (SCCs), or a UK/EU adequacy decision where one applies.

Your rights

Depending on where you live, you may have some or all of the following rights in relation to your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your data in certain circumstances.
• Restriction — ask us to limit how we use your data.
• Objection — object to processing based on legitimate interests or for direct marketing.
• Portability — receive your data in a portable format where applicable.
• Withdraw consent — withdraw any consent you have given, at any time.

To exercise any of these rights, contact us at [email protected]. You also have the right to lodge a complaint with a data protection supervisory authority — in the UK, the Information Commissioner’s Office (ICO, ico.org.uk) — if you believe we have not handled your data properly.

Children

Our website and services are intended for businesses and professionals, not for children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

Changes to this policy

We may update this privacy policy from time to time to reflect changes in our practices, technology or legal requirements. When we make material changes we will update the “last updated” date at the top of this page. We encourage you to review this policy periodically.

Contact

If you have questions about this privacy policy or wish to exercise your rights, please email us at [email protected] or use our contact page. We aim to respond to all genuine privacy requests promptly.